Print Friendly, PDF & Email

The NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) based in Estonia is a NATO-accredited cyber defence hub offering a unique interdisciplinary approach to the most relevant issues in cyber defence. This multinational military organisation conducts research, training and exercises in four focus areas – technology, strategy, operations and law.

The heart of the Centre is a diverse group of international experts from military, government, academia and industry. To date the CCDCOE brings together 21 nations as its members, among them 18 NATO Allies. The mission of CCDCOE is to support NATO, its member nations, and the international community with wide-ranging cyber defence expertise.

The annual Conference on Cyber Conflict CyCon has become a community- building event for cyber security professionals. (Photo: NATO CCDCOE)

The CCDCOE embodies and fosters the cooperation of like-minded nations in cyber defence. Our member nations are allies in NATO and like-minded partners beyond the Alliance. CCDCOE is staffed and financed by member nations – to date Austria, Belgium, the Czech Republic, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Latvia, Lithuania, the Netherlands, Poland, Portugal Slovakia, Spain, Sweden, Turkey, the UK and the US. Australia, Bulgaria, Denmark, Japan, Norway, Romania and many others are also on the path of joining the Centre.

In ten years since the establishment in 2008, the CCDCOE has earned recognition for its unique flagships – the world´s largest and most complex international live-fire cyber defence exercise Locked Shields, international conference and community-building event CyCon and Tallinn Manual 2.0, the most comprehensive guide on how International Law applies to cyber operations.

Locked Shields

Locked Shields, organised by CCDCOE since 2010, is the largest and most complex international live-fire cyber defence exercise in the world. The annual real-time network defence exercise is a unique opportunity for national cyber defenders to practise protection of national IT systems and critical infrastructure under the intense pressure of a severe cyber-attack. The exercise involves around 4000 virtualised systems and more than 2500 attacks altogether. In addition to keeping up complex IT systems the training audience must be effective in reporting incidents, executing strategic decisions and solving forensic, legal and media challenges. To stay abreast of market developments, Locked Shields focuses on realistic and cutting-edge technologies, scenarios, networks and attack methods. More than 1000 cyber experts from 30 nations took part in Locked Shields 2018. In addition to new critical infrastructure components it included also a strategic game, enabling participating nations to practice the entire chain of command in solving a large-scale a cyber incident.

Crossed Swords

Crossed Swords organised by CCDCOE since 2016 focuses on developing tactical responsive cyber defence skills of cyber experts. The exercise aims to practice the skills required to fill the role of the Red Team and offer the most cutting-edge and challenging training experience for national cyber defenders. In 2018 for the first time the exercise brought together Critical Information Infrastructure (CII) providers, military units and specialised military equipment.


CyCon, the annual International Conference on Cyber Conflict, addresses the most relevant issues concerning the cyber defence community. In the ten years of its existence, CyCon has become a community-building event for cyber security professionals, adhering to the highest standards of academic research and bringing to Tallinn around 600 decision-makers, opinion-leaders, top military brass, law and technology experts, from the governments, military, academia and industry of around 50 countries. In 2018, the event focused on the theme of maximising effects in the cyber domain. Keynote speakers included H.E. Kersti Kaljulaid, the President of Estonia, Alex Stamos, Chief Security Officer of Facebook, Dr. Antonio Missiroli, NATO Assistant Secretary General on Emerging Security Challenges, H.E Toomas Hendrik Ilves, former President of Estonia, Thomas Dullien, Staff Software Engineer at Google Zero and many others distinguished experts. In 2019, the 11th CyCon will take place from 28 to 31 May on the theme of „Silent Battle“.

The Tallinn Manual 2.0

The Tallinn Manual 2.0 is the most comprehensive guide for policy advisors and legal experts on how International Law applies to cyber operations carried out between and against states and state actors. An invaluable analysis by an international group of renowned scholars, published in 2017, it serves to inspire both academic research and state practice. The Tallinn Manual process is continuing at the Centre with a legal, technical, strategic and operational assessment of cyber scenarios, with the aim of publishing a practical reference source for Cyber Commands.

Cyber Security Training

CCDCOE promotes lifelong learning in cyber security. The training courses arranged by CCDCOE are based on the latest research and cyber defence exercises of the Centre. CCDCOE is committed to continually improving the training offerings to address the changing needs of the ever-developing cyber security field.

As of January 2018, CCDCOE is responsible for identifying and coordinating education and training solutions in cyber defence for all NATO bodies across the Alliance. NATO Allied Command Transformation has provided CCDCOE with an unconditional quality assurance accreditation for its contribution to high-quality NATO Education and Training.
To best meet the training requirements of our Allies, Partners and NATO as a whole, courses are provided in different formats and locations, covering a broad range of topics in the technical, legal, strategic and operational cyber security domains.

Team of Authors, CCDCOE