Türkiye’s Cybersecurity Architecture: A Comparative Analysis of Compliance Strategies Within NATO and UN Frameworks
Although Türkiye is a NATO member, it does not engage with all international cybersecurity frameworks at the same intensity. This study examines the pattern of this differentiation and its possible drivers through a qualitative comparative case analysis covering 2016-2025. The analysis applies a four-category coding framework to NATO summit documents, Türkiye’s own statements at the UN Open-Ended Working Group (OEWG), its national submissions to the UN Secretary-General, a European Union statement with which Türkiye aligned as a candidate country, and national strategy and legal documents. The findings indicate that within the binding NATO framework Türkiye displays operational compliance through institutional memberships and the endorsement of summit decisions. Its engagement in UN processes is more selective and of lower intensity. The UN statements examined do not contest the existing voluntary norm framework; they stress the voluntary character of recommendations and capacity building. Emphasis on digital sovereignty, data localization and domestic technology appears mainly in national strategy documents and in the 2024 national submission to the Secretary-General rather than in negotiating statements. The study labels this pattern “dual-layered compliance” and proposes the concept as an analytical tool that adapts Acharya’s norm localization approach and Börzel and Risse’s compliance typology to settings in which several platforms are engaged at once. Because the document-based design does not cover confidential negotiations, the findings should be read as a pattern consistent with theoretical expectations rather than as causal proof.

Keywords
Türkiye, cybersecurity policy, NATO, norm compliance, digital sovereignty, dual-layered compliance