Efforts to institutionalize international cooperation are rudimentary. In 2011 the Department of Homeland Security negotiated a memorandum of understanding with India on cyber attack cooperation, and in 2012 negotiated a cooperative arrangement with the Canadian government to integrate “respective national cyber-security activities and improved collaboration with the private sector.” This is a bare beginning.

The attacks on Estonia prompted some interesting beginnings in NATO's cooperative effort, not only for cooperation after an attack but also for attack prevention. Both Estonia and NATO treated those attacks under Article 4, which provides for member state consultations after an attack: no action is promised. In contrast, Article 5 of the NATO charter states that “the Parties agree that an armed attack against one or more of them in Europe or North America shall be considered an attack against all.” The potential for NATO collective action does exist if a cyber attack were part of a traditional attack, or produced similar kinetic effects, which was not arguably the case in Estonia, where the damage was economic and relatively short term.

At the Wales summit in September 2014, NATO announced an enhanced cyber strategy recognizing that a cyber attack might be as harmful as a conventional attack. It affirmed that cyber defense “is part of NATO's core task of self defense,” but added that the decision to intervene would be made on a case-by-case basis. Thus it was left ambiguous what kind of attack might prompt NATO to respond under Article 5, and left unaddressed the issue of widespread economic harm.

At present, NATO has put in place an institutional structure to deal with cyber attacks: the Cyber Defense Management Board, creating, inter alia, a Computer Incident Response Capability (NCIRC) to protect its own systems, and the NATO Cooperative Cyber Defense Center of Excellence in Tallinn. The Cyber Defense Policy is now integrated into the NATO Defense Planning Process. There are conferences and membership training to defend against cyber attack including NATO training the Jordanian army to defend against ISIS cyber attacks. It is not clear yet how effective any of these developments may turn out to be, but they are part of a developing institutional framework.