Government cybersecurity requires action from many public and private actors. Both collective knowledge and collective priority are needed to ensure cybersecurity at a government level. This makes collective learning essential. There is a system of arrangements that includes all kinds of governmental organisations and private parties. How can learning be stimulated in this system? And what is the need for steering here? This article provides answers to these questions, based on the contributions in this special issue. We conclude that both central control and self-regulation are essential to cybersecurity, even if they are in conflict. We coin the term ‘complimentary self-regulation’. We also conclude that many arrangements have been developed or are under development, however, it is difficult to institutionalise the coherence between these initiatives. There is a long road ahead in terms of gaining a collective understanding. Cybersecurity and its organisation will probably not vanish from the administrative agenda any time soon.