## 2 Materials and Methods  
Collaborative networks consist of \"a variety of entities (e.g., organisations and people) that are largely autonomous, geographically distributed, and heterogeneous in terms of their operating environment, culture, social capital and goals, but that collaborate to better achieve common or compatible goals, thus jointly generating value\" [9]. Subject of this study is the governance of Collaborative Networked Organisations (CNOs) consisting of independent organisations, connected by IT, that work together to jointly accomplish tasks, reach common goals and serve customers over a period of time [33]. In the study's working definition of governance, the term is defined as _specification of rules, criteria for decision-making, responsibilities, and boundaries of actions and autonomy for the actors involved in the CNO_[34]. The study of governance of cybersecurity requires interdisciplinary research [30] drawing, among others, from governance theory, actor-network theory, and the study of sociotechnical regimes [35]. Research on Internet governance has already utilised actor-network theory and interpretative policy analysis to conceptualise multi-stakeholder arrangements engaging heterogeneous actors [36; 37]. The study of governance challenges and models in another one of the four pilot projects also utilises actor-network theory and is based primarily on interviews with stakeholders [38]. This study used four types of information sources: norms and regulations; existing networked organisations; academic publications; and interviews with stakeholders. It was organised in four phases: (1) Preparation; (2) Preliminary analysis; (3) Secondary analysis; and (4) Aggregation. In the _Preparation_ phase, based on analysis of the project documents, own experience and an online search, a core team of researchers prepared a list of governance issues, issues related to business and governance models of networked organisations and a list of existing organisations of possible interest, and distributed them among partners for feedback and amendment. An amended draft was discussed during a project meeting, leading to a final draft list and a template in Excel format to present the analysis of networked organisations. The template was piloted by six partner organisations, analysing 12 networks in total. The feedback received from piloting the template and the overall analysis process was used to prepare the final template. The list of governance issues in this final template served also to construct the questionnaire for interviews with stakeholders (which included an additional open question) and to orient the selection and analysis of normative documents and academic sources. In the second phase of the _Preliminary analysis_, partners analysed three types of sources in parallel:  
* Ninety-two existing network organisations of four kinds: networks dedicated to information/cybersecurity research and services; cybersecurity incubators/accelerators/tech parks/ecosystems; other research-intensive networks; and networked organisations providing (among others) information services related to cybersecurity (for the full list of the analysed network organisations see Supplementary S1);
* Fourteen regulations and other normative documents, related to the governance of networked organisations in the field of cybersecurity, including relevant EU norms and available governance documents of the four pilot projects;
* Sixty academic articles, books, book chapters and conference papers. In the identification of sources, an initial list of 543 publications was generated by a Scopus search for \"networked organizations\"/\"networked organisations\" AND \"collaborative\". A subset was selected by reviewing abstracts to identify sources discussing governance issues.