The Netherlands’ New Cybersecurity Strategy

Cyber threats are the new “scourge” of the digitalised world, and attacks such as data breaches and ransomware, which increase every day, threaten not only individuals, companies and organisations but also the security of countries. Billions of dollars are already being spent worldwide to prevent, detect and neutralise cyberattacks and to repair the damage they cause. Even so, the digital infrastructure of the people, institutions and companies targeted by attacks is still not secure enough.

Individuals, as well as legal entities such as companies and organisations, that want to make their digital assets more secure against cyberattacks have to strengthen their infrastructure and take the necessary measures against malicious hackers. And of course it is no different for states!

Attacks that keep changing and diversifying are now high on the agenda of many countries. The Netherlands has also entered a new phase in this area, and its new “Cybersecurity Strategy”, covering 2022–2028, was published on 10 October 2022^[1]. The strategy contains an action plan of concrete steps to secure the Netherlands digitally.

Dilan Yeşilgöz-Zegerius, then Minister of Justice and Security, said the issue had long been on the government’s agenda and that rapidly growing digital threats were endangering Dutch interests. The Netherlands’ budget plans in recent years had also shown a visible increase in cybersecurity investment under the headings of “defence” and “justice and security”.^[2]

So what does this new strategy mean? Better sharing of information about cyber threats, better information for victims, better protection for businesses and better security for digital data, together with the tasks this places on the Dutch government, are among the most important aims of the new plan.

The Netherlands’ new Cybersecurity Strategy 2022–2028 essentially covers the following points.

• Improving the detection of cyber threats and increasing digital resilience:

The aim is to take the necessary measures to detect threats better by focusing on their sources and targets, and to gain more insight in order to increase digital resilience against cyberattacks.

On the way to this goal, the central government will cooperate more with international organisations and contribute more to public–private cooperation.

At the time, the existing NIS1 framework covered sectors including energy, transport, healthcare, drinking water and digital infrastructure. The proposed NIS2 Directive^[3] would extend cybersecurity obligations to additional sectors such as wastewater, space, food, manufacturing, and postal and courier services.

The government also plans to step up measures to increase the digital resilience of certain sectors. For example, additional standards will be introduced for the health and education sectors, the cabinet will offer various tools to help organisations comply, the Ministry of the Interior and Kingdom Relations will open various support programmes, and finally the government will pay more attention not only to the digital resilience of IT systems but also to the resilience of OT (operational technology).

The plan is to raise organisations’ level of knowledge and awareness of cyber incidents, threats and risks and how to deal with them, so that they can respond faster to cyber threats.

• Employing more cybersecurity experts.

Estimates voiced in 2022 suggested that about 3 million more cybersecurity workers would be needed worldwide by 2025, and of course this need applied to the Netherlands as well. Companies are struggling to find trained staff in this field. Under the new strategy, internal and external human resources are to be increased.

The government will work with educational institutions, the business world and other stakeholders to increase the number of cybersecurity experts. It will also invest more in higher vocational education in science and technology, including cybersecurity courses. Additional resources will be allocated to increasing enrolment, reducing dropout and course-switching rates, encouraging lateral entry, and supporting a smooth transition from education into employment.

• Government and the private sector taking more responsibility in this area.

The spread of cybercrime and the growing damage it causes naturally raise the authorities’ level of concern and situational awareness, and show that both the state and the private sector need to take on more responsibility. The responsibilities of companies and organisations will be widened further, not only because of the continuity of their own services but also because they affect customers, suppliers or dependent third parties and the digital security of the Netherlands.

The government will also contribute to the development and adoption of European cybersecurity certification schemes for ICT products, services and processes such as cloud services and 5G technology, and increase cooperation with private parties. By encouraging and facilitating the use of certification in this way, the aim is to ensure that consumers and organisations make secure choices.

To raise awareness of basic cybersecurity measures, the Dutch state will organise cybersecurity information campaigns and programmes tailored to various target groups.

• Making digital resilience part of the curriculum

Children are to learn from an early age how to use digital products and services safely. The Netherlands Institute for Curriculum Development (SLO) has been tasked, together with teachers, with developing concrete core skill targets for primary and secondary education, with digital literacy and digital security included in this work. In addition, a plan will be drawn up to ensure that teachers are equipped to teach this as well as possible.

• Better supervision and the development of the necessary legislation.

Under the new strategy, clear laws and regulations will be introduced to ensure that organisations take more measures. For example, it could be risky for a cybersecurity expert to research information security and publish on it, and conducting and publishing such research could sometimes be treated as a crime^[4]. The new approach seeks to reduce legal uncertainty for researchers who investigate and disclose vulnerabilities responsibly; compliance with ethical standards and coordinated vulnerability disclosure rules will be an important consideration in decisions on investigation or prosecution.  

The Cyber Resilience Act proposed by the European Commission in September 2022 already envisaged that security should be the starting point when developing digital products and services, but under the new strategy manufacturers and suppliers are also to be included in a duty of care throughout all stages of these products and services.

• “A Single National Cybersecurity Authority”

To this end, the “National Cyber Security Centre”, the “Digital Trust Center” and the “Computer Security Incident Response Team for Digital Service Providers” will be merged into a single national cybersecurity authority. This central authority will cooperate with public and private partners, provide information to organisations, governments and citizens, and thanks to the strengthening of the system cyber incidents will be tackled more effectively.

• Allocation of resources and investment.

Under the new strategy, 111 million euros in new structural funding will be allocated to cybersecurity, on top of the 95 million euros set aside by the previous government!

Over the next six years, in a first phase, major investments are planned in the AIVD (General Intelligence and Security Service), the MIVD (Military Intelligence and Security Service) and the NCSC (National Cyber Security Centre), along with strengthening the national cybersecurity cooperation network and increasing the digital resilience of critical sectors. 

*****

After Russia’s invasion of Ukraine, many countries began developing measures to protect themselves from the effects of a major cyberwar. For example, US President Joe Biden called in March for cyber defences to be “strengthened immediately”. Australia raised cybersecurity to “ministerial level”. The action plan the Netherlands has developed and the major steps it plans to take show that cybersecurity will become far more important in the years ahead.