Cybersecurity as a Foundation for Sustainable Digital Development: A Governance Framework for Emerging Economies

Digitalization has become a defining feature of contemporary development strategies. International organizations, development banks and national governments increasingly frame digital technologies as accelerators of the 2030 Agenda, capable of transforming public service delivery, expanding economic participation and improving the evidence base for planning decisions [1]. At the same time, a persistent lesson of development practice is that technology produces durable benefits only where complementary institutions, skills and regulation are in place; digital dividends do not accrue automatically, and their distribution depends on the analogue foundations that surround the technology [2]. Digital transformation is therefore best understood not as a technical migration but as a profound organizational and institutional change process [3].

Within this debate, one foundational condition has received comparatively little attention in the sustainable development and planning literature: cybersecurity. The expansion of e-government, digital finance, smart urban services and data-driven administration multiplies the attack surface of states and societies precisely in those contexts where protective capacity is weakest [4]. Cybersecurity has evolved from a narrow information-security concern into a societal issue that touches critical infrastructure, economic stability and the safety of citizens [5]. Global assessments consistently document a wide and persistent gap between the cybersecurity commitments of high-income countries and those of developing and transition economies [6]. For emerging economies, this gap is not merely a technical inconvenience; it is a structural vulnerability embedded in the core of their development model [7]. Cyber capacity building has consequently emerged as a field of international cooperation, though one still marked by fragmentation and asymmetries between donors and recipients [8].

This paper starts from a simple but consequential proposition: cybersecurity is institutional infrastructure for sustainable digital development. Just as roads, grids and water systems underpin physical development, the confidentiality, integrity and availability of digital systems underpin the digital layer on which modern administration, commerce and civic life increasingly depend. Where that layer is fragile, digitalization gains are reversible: a major incident against a tax administration, a payment system or a hospital network can destroy in days the public trust that took years of investment to build. Conceived in this way, cybersecurity connects directly to three Sustainable Development Goals: SDG 9, which calls for resilient infrastructure; SDG 11, which requires safe and sustainable cities whose services are increasingly cyber-physical; and SDG 16, which demands effective, accountable and transparent institutions.

The paper pursues two research questions. RQ1: How does cybersecurity governance capacity condition the sustainability of digital development in emerging economies? RQ2: What governance model can integrate cyber-resilience into sustainable development planning under the resource and institutional constraints typical of transition contexts? To address these questions, the paper combines a review of scholarship at the intersection of digital government, cybersecurity governance and Europeanization with a qualitative document analysis of the current generation of European Union (EU) regulatory instruments and their diffusion into the enlargement region. On this basis it develops a four-stage governance framework, Assess, Govern, Defend, Earn Trust, and illustrates its application through the case of Kosovo, a candidate economy in which rapid digitalization, regulatory approximation and institutional consolidation are unfolding simultaneously.

The remainder of the paper is organized as follows. Section 2 reviews the relevant literature and identifies the research gap. Section 3 presents the research methodology. Section 4 characterizes the cyber-governance gap in emerging economies. Section 5 develops the proposed framework. Section 6 illustrates the framework through the Kosovo case. Section 7 discusses the findings, introduces the concept of digital development debt and draws policy implications. Section 8 concludes.

The study adopts a qualitative, interpretive research design combining conceptual framework development with an illustrative single-case study [25]. This design is appropriate for the research questions, which concern how phenomena are connected, namely how cybersecurity governance conditions sustainable digital development, rather than how much, and for a field in which reliable quantitative indicators for the population of interest are scarce or, as discussed in Section 4, structurally absent for some territories.

3.1 Document corpus and analysis procedure

The research proceeded in three stages. In the first stage, a structured document analysis was conducted on two corpora. The first corpus comprises seven primary legal and regulatory instruments, listed in full in Appendix Table A and cited hereafter as [D1]-[D7]: five EU instruments, the NIS2 Directive [D1], the DORA [D2], the Cyber Resilience Act [D3], the AI Act [D4] and the GDPR [D5], and two Kosovo instruments used in the case analysis, the Law on Cyber Security [D6] and the Central Bank of the Republic of Kosovo Regulation on Information Systems and Cyber Risk Management [D7]. The second corpus comprises international assessment and policy documents relevant to emerging economies, including the International Telecommunication Union (ITU) Global Cybersecurity Index [6], the United Nations E-Government Survey [4], the European Union Agency for Cybersecurity (ENISA) Threat Landscape [26] and European Commission enlargement reporting for the Western Balkans [27].

The legal corpus was coded at the level of individual articles or article paragraphs of the operative text, following a two-cycle procedure adapted from qualitative content analysis; recitals and, with the exception of the Cyber Resilience Act's Annex I, annexes were excluded. In the first cycle, open coding of 89 provisions across [D1]-[D5] (35 in NIS2, 24 in DORA, 6 in the Cyber Resilience Act, 12 in the AI Act and 12 in the GDPR) generated 73 distinct provision-level codes describing discrete governance functions; examples include all-hazards risk management, management-body accountability, incident-notification deadlines, supply-chain security, management-training obligations and certification requirements, several of which recur across instruments (for instance, incident-notification deadlines are coded in NIS2 Article 23, DORA Article 19, the AI Act Article 73 and GDPR Article 33). In the second cycle, these codes were consolidated through constant comparison into six governance-function categories: (GF1) risk identification and assessment (9 provisions); (GF2) accountability and governance (15); (GF3) operational defence and incident response (25); (GF4) supply-chain and third-party oversight (11); (GF5) transparency, assurance and trust (20); and (GF6) capacity and resources (9). The codebook, with category definitions, example constituent codes, anchor provisions and boundary rules, is provided in Appendix Table B. Because the study is single-authored, inter-coder reliability could not be computed; consistency was instead addressed through an independent second coding pass on a purposive subsample of 28 provisions spanning the most control-dense parts of the corpus (NIS2 Article 21(2) and Article 23, DORA Articles 5-14 and GDPR Articles 25 and 32-35), conducted against the category definitions alone. Agreement between the two passes was 85.7% (24 of 28). The four disagreements concerned predictable boundary cases (asset management versus access control; post-incident learning versus plan revision; security-by-design versus trust safeguards; and breach notification to an authority versus to affected persons); each was resolved by adopting an explicit boundary rule, now recorded in Appendix Table B, after which the full corpus was checked against the final rules. A provision-level audit trail (coding workbook) is provided as supplementary material and referenced in the Data Availability statement.

In the second stage, the six governance-function categories identified in the document analysis were synthesized with the literature reviewed in Section 2 into a four-stage framework. The synthesis was guided by two design criteria derived from the institutional literature: parsimony, so that the framework can be operated by administrations with limited specialized staff, and cyclicality, so that the framework treats cyber-resilience as a continuous planning process rather than a one-off compliance exercise. The mapping is direct: GF1 grounds the Assess stage; GF2 and GF6 ground the Govern stage; GF3 and GF4 ground the Defend stage; and GF5 grounds the Earn Trust stage.

In the third stage, the framework was applied to the case of Kosovo. Kosovo was selected through purposive sampling as a revelatory case [25]: it combines rapid digitalization of public and financial services, active approximation of the EU acquis, acute human-resource constraints and, uniquely, exclusion from the principal international measurement systems, which makes the planning problem this paper addresses visible in a particularly sharp form. The case analysis draws on publicly available regulatory and policy documents, including the Law on Cyber Security [D6], financial-sector regulation issued by the Central Bank of the Republic of Kosovo [D7] and European Commission country reporting [27], complemented by the author's professional observation of governance practice across the financial, public-administration and higher-education sectors, gathered through advisory and audit engagements conducted in accordance with professional confidentiality obligations. Throughout Section 6, claims that rest on this observational component rather than on citable documents are explicitly flagged as observational judgments, and Table 1 distinguishes documentary from observational evidence. This observational component is used strictly for illustration of the framework categories, not for hypothesis testing, and its limitations are acknowledged in Section 7.3.

Table 1. Mapping Kosovo's sectors against the framework (evidence basis per cell: Documentary sources cited; observational = author's professional observation, see Sections 3 and 7.3)

This section develops the paper's central contribution: a four-stage governance framework that integrates cyber-resilience into sustainable digital development planning. The framework, shown in Figure 1, is deliberately parsimonious. It compresses the governance functions (GF1-GF6, Appendix Table B) prescribed by the EU regulatory corpus and recommended by capacity-building practice into four stages, Assess, Govern, Defend and Earn Trust, arranged as a continuous cycle around the objective of sustainable digital development. The cycle closes through a feedback loop from trust outcomes back into assessment, reflecting the premise that resilience is a process property of institutions, not a state achieved once. Table 2 summarizes the stages, their core functions, characteristic instruments and primary SDG linkages.

1.png

Figure 1. The Assess-Govern-Defend-Earn Trust governance framework for sustainable digital development

Table 2. The four stages of the framework: Functions, instruments and Sustainable Development Goals (SDG) linkages

5.1 Assess: Evidence before architecture

The first stage establishes the evidence base on which all subsequent governance choices depend. It comprises the identification of critical services and their digital dependencies, structured risk assessment, maturity benchmarking and continuous monitoring of the threat landscape. In mature regulatory systems this function is institutionalized: the NIS2 Directive obliges essential and important entities to adopt risk-management measures grounded in an all-hazards analysis [D1], and DORA requires financial entities to maintain a comprehensive ICT risk-management framework as a precondition for everything else the regulation demands [D2]. For emerging economies the stage has an additional, compensatory role identified in Section 4: where international indices do not reach, domestically generated assessment evidence must substitute for external benchmarks. Practically, this argues for lightweight national instruments, a register of critical information infrastructure, a recurring public-sector maturity self-assessment and a national vulnerability-assessment programme, whose results feed directly into development planning documents rather than remaining confined to security institutions.

5.2 Govern: Institutions before controls

The second stage translates evidence into institutional arrangements: laws and secondary regulation, designated competent authorities, allocation of accountability within organizations and, critically, resourcing. The design principle here is proportionate approximation. The EU corpus offers candidate countries a coherent regulatory model, but wholesale transposition without regard to administrative capacity reproduces the shallow Europeanization documented in the enlargement literature [19, 20]. Proportionate approximation instead sequences obligations, prioritizing the governance spine, a competent authority with real supervisory powers, management-level accountability duties modelled on Article 20 of NIS2 [D1], and a functioning national Computer Security Incident Response Team (CSIRT), before extending sectoral coverage. The stage also encompasses the workforce dimension: governance arrangements that presuppose specialists who do not exist in the local labour market are decorative. Emerging economies therefore need explicit cybersecurity workforce strategies linking higher education, professional certification and public-sector retention, a point developed in the Kosovo case.

5.3 Defend: Resilience of what matters

The third stage concerns operational protection: preventive and detective controls, incident response, crisis management and continuity of critical services, including the cyber-physical services, energy, water, transport, health, that constitute the material substance of SDG 11. Two emphases distinguish the framework's treatment of this stage from conventional control catalogues. The first is selectivity: under resource constraints, defence must concentrate on the services whose disruption would most damage development outcomes, as identified in the Assess stage, rather than distributing thin controls uniformly. The second is exercised capability: incident-response plans that have never been rehearsed fail under pressure, and therefore regular crisis exercises, including at the executive and board level, are treated as first-order governance instruments rather than training luxuries. Baseline control frameworks such as ISO/IEC 27001 provide a common vocabulary, but the framework treats certification as an instrument of the Defend stage, not as its objective.

5.4 Earn Trust: The sustainability test

The fourth stage is the framework's distinctive element and the point at which cybersecurity connects most directly to sustainability. Digital development is sustainable only if citizens, firms and international partners are willing to keep using, and investing in, digital systems; that willingness is a stock of trust that security incidents, opaque data practices and unaccountable automation steadily deplete. The Earn Trust stage therefore assembles the outward-facing governance functions: transparent breach notification and public communication; independent audit and assurance over public digital systems; data-protection governance aligned with the GDPR model [D5]; participatory oversight of algorithmic and AI systems consistent with the risk-based logic of the AI Act [D4]; and sustained investment in digital skills and awareness, which convert citizens from the weakest link into a distributed sensor network. Trust outcomes, measured through service uptake, incident-reporting behaviour and survey instruments, feed back into the Assess stage, closing the cycle. In this design, trust is not a public-relations by-product of security; it is the criterion against which the sustainability of the whole digital development trajectory is evaluated, echoing the institutional emphasis of SDG 16.

7.1 Digital development debt

The analysis motivates a concept that names the central risk facing digitalizing emerging economies: digital development debt. By analogy with technical debt in software engineering, digital development debt is the accumulated gap between the pace at which a polity digitalizes its critical functions and the pace at which it builds the assessment, governance, defensive and trust-maintaining capacity that digitalization presupposes. Like financial debt, it is invisible while conditions are benign and is called in at the worst moment: a successful attack against a core registry, payment system or municipal service does not merely impose recovery costs, it liquidates trust, suppresses service uptake and can reverse years of development gains. The Kosovo public-administration case shows how the debt accumulates through the most well-intentioned channel, rapid legal approximation, when transposition outruns institutional absorption. The framework's cyclical design is, in essence, a debt-management instrument: each pass through Assess-Govern-Defend-Earn Trust amortizes accumulated exposure and prevents new borrowing against institutional capacity that does not exist.

7.2 Policy implications

Four implications follow for policymakers and planners in emerging economies. First, cyber-resilience indicators should be integrated formally into national sustainable development planning frameworks, alongside conventional infrastructure and governance indicators, so that security investment competes for resources as development spending rather than as discretionary IT expenditure. Second, regulatory approximation should be sequenced by governance function rather than by legal instrument: the supervisory spine and accountability duties first, comprehensive sectoral coverage later, accepting slower formal alignment in exchange for real institutional depth. Third, sectoral asymmetries should be exploited deliberately: mature sectors such as finance can serve as capability exporters to public administration through structured secondments, shared exercises and common assurance services, rather than remaining isolated resilience islands. Fourth, for territories excluded from international measurement systems, governments should institutionalize domestic assessment instruments whose methodology mirrors the international indices, generating comparable evidence for planning and for external partners, and should treat this evidence-generation capacity itself as development infrastructure.

7.3 Limitations

Three limitations bound the contribution. First, the framework is derived conceptually from regulatory analysis and literature synthesis; it has not been validated through comparative empirical testing, and its stage boundaries are analytical conveniences that overlap in practice. Second, the case illustration rests on a single territory and incorporates the author's professional observation, which, while grounded in sustained sectoral engagement and now explicitly flagged wherever it is relied upon (Section 6, Table 2), is subject to selection and confirmation biases inherent to participant observation; the associated conflict-of-interest considerations are declared in the statements below. Third, the argument generalizes most safely to EU candidate and neighbourhood countries, for which the European regulatory model is the operative reference; its transfer to emerging economies in other regulatory orbits requires adaptation that this paper does not undertake. Future research should operationalize the framework's stages into measurable indicators, test the digital development debt proposition against incident and service-uptake data across a panel of transition economies, and examine comparatively whether trust-centred governance models outperform compliance-centred ones in sustaining digitalization gains.

The author declares no conflict of interest. Although the case observations are informed by the author’s professional advisory and audit experience, these roles did not influence the conduct, analysis, or reporting of the research.

All documents analysed in this study are publicly available from the official sources listed in Appendix A and in the reference list. The provision-level coding audit trail (workbook containing the codebook, the 89 coded provisions with first-cycle codes and category assignments, and the consistency-check subsample with agreement calculation) is provided as supplementary material and is also available from the corresponding author. No further datasets were generated or analysed.