What is the aim?
To improve the capacity of officials and decision makers in the partner government to strategically plan and oversee the implementation of their strategy.
Why do it?
Experts have experience to share from the strategy process in multiple countries and will often also have competence in training, coaching and running workshops. In-country, in-person capacity building is the common way for experts to provide their support within a project.
What are typical outputs?
There can be a wide range of outputs, but often include increased capacity of those being trained, advised or mentored. For example, officials and decision makers have gained knowledge of the critical issues in drafting and implementing the strategy and understand what the necessary processes are.
How is it delivered?
Many options including discussion meetings, training sessions and workshops. They can also embed within the drafting team and use a desk in their office, some or all of the time.
How easily can a country do it themselves?
A country could contract directly with experts. Several implementers provide similar services under direct contract to governments and via capacity-building projects.
What good practice guidance is available?
What good practice guidance is applicable will depend upon the topic the international experts are building capacity to address. Strategy guidance docs are listed at Activity 10. RAND Europe wrote their “Developing Cybersecurity Capacity. A proof-of-concept implementation guide” as a guide that could help officials or project experts as an aide memoire for good practice resources across all themes of capacity building.
- Whether the experts are flying in or locally based can change a project in several ways: timing; flexibility; how they deliver their support; budget; local perception, etc. This is explored in more detail in the section below “international vs. local experts”.
- When using experts, be clear whether they are meant to provide capacity building, capacity augmentation or capacity substitution, and monitor whether the reality matches the plan. There has traditionally been a pressure on experts to draft strategies rather than use strategies.
- Discuss with the drafting team and the expert(s) where the final strategy will be on the continuum from a standard template (or another country’s strategy) at one end to a completely unique structure at the other.
Cost
The costs normally comprise a daily rate, expenses, travel, accommodation (if visiting) and security. The cost range is very wide, reflecting the range of complexity and duration from a single workshop to multi-year, locally based teams.
Duration
Experts may be needed for only a one-day workshop. However, if supporting the Stocktaking and Production phases of strategic planning, the duration could be anywhere up to a couple of years.
For several years, MITRE has been supporting the development and implementation of an African nation’s cyber strategy.
MITRE’s expert consultation was first employed during an in-country engagement designed to assess the country’s capacity to develop and implement a cyber strategy. This engagement included a facilitated discussion on identifying the country’s national aspirations and the need for secure ICT infrastructure to achieve those aspirations. This facilitation involved high-level government and industry leaders and resulted in comprehensive recommendations regarding next steps for the host country as well as for other government donors.
Follow-on work included a comprehensive in-country risk management workshop that included public (including law enforcement, military and regulatory agencies) and private stakeholders who collaborated in defining national threats and vulnerabilities, as well as risk mitigation approaches and priorities.
Additionally, MITRE provided expert consultation remotely by reviewing important strategic documents. The key to expert engagement in these efforts was including comprehensive ‘next step’ recommendations in expert reports and assessments that provided the host country with options for timely and pertinent expert involvement, including the potential for provisioning technical expertise for sector-specific risk assessments and mitigation determinations; expert program and “change” management support; national cybersecurity awareness program development; and incident response and recovery organizations and exercises.
More Top Tips:
- Planning well-timed expert interventions can help a country maintain implementation momentum.
- Align the experience of experts used to the priority implementation needs of the country.
- Clearly identify the roles of experts regarding whether they are meant to provide capacity building, capacity augmentation or capacity substitution, or track implementation and make recommended modifications. When an expert drafts a country’s strategy and implementation plans for them, this is not capacity building; it is capacity substitution.
Nationality of experts and where they are based: why it matters
Feedback on past projects and lessons from the development community suggest that the nationality of experts and where they are based is an important issue for capacity building. Until now cyber capacity building projects have mostly deployed international experts on short visits. This was influenced by, among other things, the shortage of cybersecurity experts, especially in developing countries, and the low appetite for taking risk. However we are beginning to see three trends that may change this:
- there is more interest in contracting local implementing organizations and consultants, who have the nationality of the beneficiary country and are locally based;
- some projects are deploying international experts to be locally based for 6+ months at a time, or they are recruiting in-country international expat experts who happen to live locally already; and
- more projects are using regional international experts, who can visit more easily and frequently than those coming from farther afield.
Each type of expert has its own advantages and disadvantages. Using visiting experts can allow for more flexibility to change project direction and opens up a wider pool of experts to draw from. Locally-based experts can be more flexible in how and when they provide their assistance, and more easily follow up training and workshop sessions with monitoring and further support. In some contexts, an international expert may be listened to more closely than a local national, while in others the local national, or someone from the region, may receive greater attention. Individual skills and experience of course play a large role too.
In a number of GFCE meetings, governments have said that they would prefer that projects strengthened the pool of local experts so that they could be self-reliant in the future. However they have also asked funders and implementers to be careful when doing this and consider the secondary consequences of hiring local experts for projects. Projects can attract essential staff away from government and/or create unintended divisions within the local cyber community as some benefit from well-paid project assignments and others do not. This can be particularly acute where projects pay top-up salaries to officials or hire officials who are working for a project in addition to their government day job.
Advice for using international experts
- International experts who are not locally based can strengthen their relationships and understanding of the local context by connecting together a series of visits and staying in touch remotely. This can have more impact than ‘fly in and fly out’ for a one-off training.
- International experts can form partnerships with a local expert and work as a team. Expertise can be transferred within these teams in both directions.
- Project beneficiaries can be involved in the selection of international experts.
- Consider using an international expert from the region (e.g. from a neighboring country).
- Consider providing international experts with training or briefings on the local political, cultural and digital context before they deliver activities.
Advice for using local national experts
- Design team management processes that include and make use of your local national experts. This may have been made easier because of the ‘remote working by default’ team management approaches developed for COVID19.
- Consider how you can provide support and skills transfer to your local national experts.
- Mitigate the risks of income differences between government employees and local (or international) consultants and staff with topped up salaries.
Advice for locally-basing international experts
- Make use of experts you already have in your international networks (e.g. some countries have networks of law enforcement officers who could take on cybersecurity capacity building responsibilities).
- Locally based international experts are commonly used in international development programs.