Municipal Digital Security Agenda: Focus Shifts to External Dependencies

The Digital Security Agenda 2028 emphasizes that municipalities must protect not only their own systems but also the resilience of their suppliers and partners. With RiskStudio, municipalities can identify and continuously monitor high-risk companies per theme, such as digital disruption or internal house in order.

Digital Security Agenda 2028

Improving the digital security of municipal services and the digital resilience of residents and businesses. That is the goal of the Digital Security Agenda 2028.

With the Digital Security Agenda 2028: ‘Digital security is the (behavioral) norm in our municipalities’ (pdf, 130 kB), the VNG clarifies what is needed to help municipalities move towards a future-proof digital society.

Important Themes

To address the challenges in digital security, the VNG will continue to work with municipalities on three main themes in the coming years:

• Preparation for digital disruption
• Resilient residents and businesses
• Internal house in order: robust information security

Under these main themes are various pillars, including:

• Preparation for European and national laws and regulations (such as NIS2 and BIO)
• Leadership and professionalization of digital security in local government
• Addressing labor market shortages

This agenda marks an important step towards structural digital security. Municipalities are called upon to actively contribute so that residents and businesses can rely on trustworthy and secure digital services.

The Growing Dependence on External Parties

Digital security within municipalities is increasingly determined by external factors. Every organization is part of a broader chain of suppliers, partners, and social institutions. Within the three main themes of the Digital Security Agenda, this dependence becomes visible in various ways:

1. Preparation for digital disruption

This theme focuses on the continuity of vital processes and services. Municipalities depend on numerous external parties:

• Energy and utility providers that are essential for physical and digital infrastructure.
• Communication and IT suppliers who ensure accessibility, data traffic, and information provision.
• Emergency services and social chains, such as healthcare, benefits, and civil affairs, where cooperation is crucial for social stability.

A disruption at one of these parties can lead to serious disruption. It is therefore essential to identify and monitor these external risks.

2. Resilient residents and businesses

Municipalities are increasingly establishing collaborations to help residents and local businesses become digitally resilient. Examples include regional cyber alliances, awareness campaigns, or initiatives with local educational institutions.
External organizations also play an important role here: partners offering training, companies managing local infrastructures, or platforms sharing information. Municipalities must be able to rely on the digital security of these collaborations.

3. Internal house in order

The third theme concerns the internal digital resilience of the municipality itself. But here too, almost all municipal processes rely on suppliers and service providers. Consider:

• Software suppliers for civil affairs, taxes, or social domain
• Hosting and cloud providers
• IT administrators and security service providers
• External consulting and support parties

This chain of suppliers forms the digital backbone of the municipal organization. Insight into their security is indispensable for the municipality's own resilience.

How RiskStudio Helps Municipalities Get a Grip on Their Agenda

RiskStudio offers municipalities a smart way to monitor and manage their external dependencies, without complicated questionnaires or lengthy processes.

A key strength of RiskStudio is that municipalities can translate the three main themes of the Digital Security Agenda 2028—digital disruption, resilient residents and businesses, and internal house in order—into crown jewels within their own organization.

Themes as Crown Jewels

Municipalities can designate each theme as a digital crown jewel, a crucial area of focus where continuity and security are paramount. For example, consider:

• Digital disruption: societal continuity, energy supply, communication, and emergency services.
• Resilient residents and businesses: collaborations with regional partners, local initiatives, or educational institutions.
• Internal house in order: internal services and suppliers contributing to daily municipal processes.

Mapping Risks and Relationships

Within each crown jewel, municipalities can then define sub-themes, such as specific processes, systems, or collaborations. To these sub-themes, they link the companies and suppliers that play a role in their implementation or support.

RiskStudio makes it possible to:

• Visually structure dependencies by theme or service.
• Automatically identify high-risk companies, for example, when a data breach, ransomware incident, or sanction is detected.
• Assign responsibilities to internal employees or departments, making it clear who oversees which parts of the chain.

Compliance and Overview

Through this thematic approach, RiskStudio seamlessly aligns with the requirements of BIO, NIS2, and the broader Digital Security Agenda. Municipalities can demonstrably show:

• Where their greatest digital dependencies lie.
• Which suppliers or partners pose risks.
• Which control measures or improvement actions are planned.

In this way, RiskStudio helps municipalities not only to track incidents but also to structurally organize their digital security around the themes that truly matter.

Conclusion

The Digital Security Agenda 2028 rightly emphasizes that digital security extends beyond the walls of the town hall. The true resilience of a municipality depends on its partners, suppliers, and collaborations.

RiskStudio makes it possible to make this chain visible and manageable — automated, up-to-date, and transparent. This way, municipalities can confidently work towards a secure digital future for residents and businesses.

Frequently Asked Questions

What is the Digital Security Agenda 2028?

A multi-year program by the VNG that supports municipalities in strengthening their digital security and resilience, with an emphasis on cooperation and continuity.

What does ‘preparation for digital disruption’ specifically mean?

It refers to preparing for disruptions in vital processes, such as energy, communication, and social services.

Why should municipalities also monitor external parties?

Because incidents involving suppliers or partners can have direct consequences for municipal services and citizen privacy.

How does RiskStudio help with this?

RiskStudio offers automated monitoring of suppliers and partners, allowing municipalities to identify risks faster and comply with BIO and NIS2 requirements.