Effective cyber incident response and crisis management increasingly relies on the coordination of relevant actors at supranational levels. A polycentric governance structure is one of the institutional arrangements that can promote active participation of involved actors, an aspect decisive for the rapid and effective response to cyber incidents and crises. This research aims to dissect whether, and to what extent, a polycentric structure is manifested within the cyber crisis management framework of the European Union (EU) and assesses the extent to which these policies signal a balance between centralization and decentralization. By employing Institutional Grammar 2.0, we examine the roles and interactions among actors delineated within four key policies to identify the structural characteristics, institutional essentials, and prerequisites indicative of a polycentric governance system. Additionally, we apply network analysis to evaluate dyadic relationships of actors, further assessing the balance between centralization and decentralization in the EU's cyber crisis management framework. Our analysis reveals that the EU has adopted a polycentric governance model for cyber crisis management, characterized by a nuanced distribution of responsibilities and authorities. The findings highlight a tendency toward centralization, especially in the roles of Member States and the European Union Agency for Cybersecurity (ENISA), while maintaining a polycentric structure that blends centralization and decentralization. This balance can ensure structural integrity and coherence of the system, while theoretically providing the flexibility and resilience needed to adapt to the dynamic cyber threat landscape. The study contributes methodologically, offering a framework that can be applied to other domains, and provides insights into the effective coordination of cyber incident response and crisis management at supranational levels.

中文翻译：

---

欧盟网络事件的制度设计与作为复杂公共产品的危机管理


有效的网络事件响应和危机管理越来越依赖于超国家层面相关行为者的协调。多中心治理结构是可以促进相关行为者积极参与的制度安排之一，这是快速有效响应网络事件和危机的决定性方面。本研究旨在剖析多中心结构是否以及在多大程度上在欧盟 （EU） 的网络危机管理框架中表现出来，并评估这些政策在多大程度上标志着集中化和分散化之间的平衡。通过使用制度语法 2.0，我们研究了四个关键政策中描述的参与者之间的角色和互动，以确定表明多中心治理系统的结构特征、制度要素和先决条件。此外，我们应用网络分析来评估参与者的二元关系，进一步评估欧盟网络危机管理框架中集中化和去中心化之间的平衡。我们的分析表明，欧盟在网络危机管理方面采用了多中心治理模式，其特点是责任和权力的细致分布。研究结果突出了集中化的趋势，尤其是在成员国和欧盟网络安全局 （ENISA） 的角色中，同时保持了混合集中化和分散化的多中心结构。这种平衡可以确保系统的结构完整性和连贯性，同时在理论上提供适应动态网络威胁形势所需的灵活性和弹性。 该研究在方法上做出了贡献，提供了一个可应用于其他领域的框架，并为在超国家层面有效协调网络事件响应和危机管理提供了见解。