## 3 Results
### Analysis of Interviews  
This sub-section presents briefly results from the secondary analysis of transcripts of the interviews with stakeholders (fuller description is provided in [41]). It starts with the responses along the 16 governance issues included in the questionnaire, then presents an analysis of the responses to the open-ended invitation to address additional governance issues, and concludes by ranking the governance issues based on the stakeholders' views.  
_Profit Orientation_  
The first question was whether profit or non-profit arrangements are preferable for a cybersecurity network. All interviewees considered both options possible. Two of them gave some preference to non-profit arrangements citing as reasons that it would be easier to reach an agreement between member organisations and to exercise public oversight. Another two of the interviewees would prefer for-profit arrangements that would provide better opportunities for investing in CNO capabilities and infrastructure. A fifth interviewee combined the two types of arguments, stating that non-profit organisations may be selected for some funding streams, while for-profit arrangements might be preferable in terms of sustainability of the network.  
This is interpreted as de facto agreement that, while the profit orientation is important for the CNO business model and the respective governance model, it is not a governance issue per se and was not included in further considerations as such.  
(1) Geographical Representation or Exclusion  
One interviewee noted that the composition of the network depends on its purpose, and this is reflected in all responses. Two focused on national representation; one of them stating that \"national arrangements are preferred for strategic sectors [as cybersecurity]\". Most interviewees stated that balanced, EU-wide representation is necessary or even crucial. One emphasised the need to achieve cohesion by providing support to less developed regions, e.g., by a strategy of smart specialization; another interviewee stressed that EU cohesion is important to guarantee \"European cyber sovereignty\". Two of the responses addressed local representation as beneficial, but not mandatory in one case, and as advantageous in competing on target (local) markets in the other. One interviewee stated that an EU-centred network should be flexible to include partners also from both EU-associated and NATO countries. Two of the respondents stated that EU-centred networks cannot be open to partners from \"Eastern countries\".  
(2) Supply Chain Security  
The question of involving non-EU partners relates to supply chain security concerns. The majority of the respondents shared these concerns, while the provision of skills (both basic and advanced) and of R&D capacity, in particular R&D in academia, was noted. The views on supply chain security measures differed widely--from preference for a completely national management of cybersecurity services or at least a requirement for national security accreditation through the need for complete tracking of the supply chain (understanding that \"advanced social engineering and the chain of supplies are extraordinarily good tools to violate a system\") to a view that having in place legally binding agreements is sufficient.