Municipal Digital Security Agenda: the emphasis is shifting to external dependencies

The Digital Security Agenda 2028 emphasizes that municipalities must not only protect their own systems, but also the resilience of their suppliers and partners. With RiskStudio, municipalities can identify and continuously monitor high-risk companies per theme, such as digital disruption or getting their own house in order.

Digital Security Agenda 2028

Improving the digital security of municipal services and the digital resilience of residents and entrepreneurs. That is the goal of the Digital Security Agenda 2028.

With the Digital Security Agenda 2028: ‘Digital security is the (behavioral) norm in our municipalities’ (pdf, 130 kB), the VNG (Association of Netherlands Municipalities) makes clear what is needed to help municipalities move towards a future-proof digital society.

Important themes

To address the challenges in the field of digital security, the VNG, together with municipalities, will continue to work on three main themes in the coming years:

• Preparation for digital disruption
• Resilient residents and entrepreneurs
• Getting our own house in order: robust information security

These main themes encompass various pillars, including:

• Preparation for European and national laws and regulations (such as NIS2 and BIO)
• Leadership and professionalization of digital security at the local government level
• Coping with labor market shortages

This agenda marks an important step towards structural digital security. Municipalities are called upon to actively contribute, so that residents and entrepreneurs can count on reliable and secure digital services.

The growing dependence on external parties

Digital security within municipalities is increasingly determined by external factors. Every organization is part of a broader chain of suppliers, partners and social institutions. Within the three main themes of the Digital Security Agenda, this dependency becomes visible in various ways:

1. Preparation for digital disruption

This theme is about the continuity of vital processes and services. Municipalities are dependent on numerous external parties:

• Energy and utility facilities that are essential for the physical and digital infrastructure.
• Communication and IT suppliers that ensure accessibility, data traffic and information provision.
• Emergency services and social chains, such as healthcare, benefits and civil affairs, where cooperation is crucial for social stability.

A disruption at one of these parties can lead to serious disruption. It is therefore essential to identify and monitor these external risks.

2. Resilient residents and entrepreneurs

Municipalities are increasingly setting up partnerships to help residents and local businesses become digitally resilient. Consider regional cyber alliances, information campaigns or initiatives with local educational institutions.
External organizations also play an important role here: partners that offer training, companies that manage local infrastructures or platforms that share information. Municipalities must be able to rely on the digital security of these collaborations.

3. Getting our own house in order

The third theme touches on the internal digital resilience of the municipality itself. But here too, the following applies: virtually all municipal processes rely on suppliers and service providers. Consider:

• Software suppliers for civil affairs, taxes or social domain
• Hosting and cloud providers
• IT managers and security service providers
• External advice and support parties

This chain of suppliers forms the digital backbone of the municipal organization. Insight into their safety is essential for their own resilience.

How RiskStudio helps municipalities gain control of their agenda

RiskStudio offers municipalities a smart way to monitor and manage their external dependencies, without complicated questionnaires or lengthy processes.

An important strength of RiskStudio is that municipalities can translate the three main themes of the Digital Security Agenda 2028: digital disruption, resilient residents and entrepreneurs, and getting their own house in order, into crown jewels within their own organization.

Themes as crown jewels

Municipalities can designate each theme as a digital crown jewel, a crucial area of attention in which continuity and security are central. For example:

• Digital disruption: social continuity, energy supply, communication and emergency services.
• Resilient residents and entrepreneurs: collaborations with regional partners, local initiatives or educational institutions.
• Getting our own house in order: internal services and suppliers that contribute to daily municipal processes.

Mapping risks and relationships

Within each crown jewel, municipalities can then define sub-themes, such as specific processes, systems or partnerships. They link the companies and suppliers that play a role in the implementation or support of these sub-themes.

RiskStudio makes it possible to:

• Visually structure dependencies per theme or service.
• Automatically identify high-risk companies, for example when a data leak, ransomware incident or sanction is detected.
• Assign responsibilities to internal employees or departments, so that it is clear who is supervising which parts of the chain.

Compliance and overview

Thanks to this thematic approach, RiskStudio seamlessly aligns with the requirements of the BIO, NIS2 and the broader Digital Security Agenda. Municipalities can demonstrably show:

• Where their largest digital dependencies lie.
• Which suppliers or partners pose risks.
• Which control measures or improvement actions are planned.

In this way, RiskStudio helps municipalities not only to monitor incidents, but to structurally organize their digital security around the themes that really matter.

Conclusion

The Digital Security Agenda 2028 rightly emphasizes that digital security extends beyond the walls of the town hall. The actual resilience of a municipality depends on its partners, suppliers and collaborations.

RiskStudio makes it possible to make that chain visible and manageable — automated, up-to-date and transparent. In this way, municipalities can confidently work towards a safe digital future for residents and entrepreneurs.