This article analyzes the attempts to construct global cybersecurity norms. It differs from much of the existing literature on norm-construction since it moves beyond the interstate level to examine subnational groups and private sector actors that function as norm entrepreneurs in this policy area.