From pen tests to shared reports, the Zeeland Norm shows how collaboration strengthens digital resilience. What began as an administrative agreement around security grew into a network involving all Zeeland governments, from municipalities to water boards and provinces. "The added value is in the mutual trust," says Marga Vermue, mayor of Sluis.
The Zeeland Standard originated in 2021, when drug crime moved from Brabant to Zeeland. Vermue: "We saw that you cannot solve such problems within your own borders. From that realization grew the idea to work together more broadly on resilience, including digitally. The then King's Commissioner Han Polman took the first step. Meanwhile, all 23 Zeeland organizations work together structurally within the Zeeland Norm Weerbare Overheid."
Within that cooperation, 9 theme groups are active, each with administrative and official leaders. One of the themes is digital security. Vermue: is its administrative leader: "We wanted to prevent every organization from reinventing the wheel. And we wanted knowledge not to get stuck, but really shared. The added value is in the mutual trust. People dare to say: I don't know, can you help?"
Official lead is Hans Quist, Chief Information Security Officer (CISO) of the province of Zeeland. "In some municipalities, 1 person does almost everything, information security, privacy, ICT. Then it's nice that the province or a larger municipality can help. A lot is also arranged practically. We have a joint app group for CISOs, a backup arrangement so we can replace each other in case of absence, and we share policy documents and formats. It sounds simple, but this saves time and gives confidence that we are all on track."
'You can have policies and protocols, but ultimately it's about trust and willingness to help each other.' Hans Quist, CISO province of Zeeland
The network meets physically twice a year in Yerseke, with working sessions, speakers and an informal closing. The connectedness is yielding results. "Administrators now report on digital threats in the same way," Vermue says. "We use the same language and icons. That provides clarity. Digital resilience is not just something about ICT, it's about continuity of service, about trust from residents. When administrators realize that, it becomes meaningful throughout the organization."
A key moment was the large-scale pen test that all Zeeland governments commissioned. "We asked a hacker collective to break in, inside and out," the CISO explains. "Things always come up that make you think: oops, there's room for improvement there. It was exciting, but no one was pointing at each other. It was really about improving together."
For the coming period, they are hoping for a large-scale exercise for all of Zeeland. Quist: "We want to run through a realistic scenario with all 23 organizations at the same time. Think of an attack that affects several municipalities at the same time. Then we can really test how we support each other and share information. That would be the ultimate test of our cooperation. Before that happens, we practiced Nov. 3 with the Government-wide Cyber Exercise. We had a separate table set up with people from the province and several Zeeland municipalities."
'The added value is in the mutual trust.' Mayor Marga Vermue
Both the mayor and CISO emphasize that the strength of the Zeeland Standard is not in technology, but in people. "You can have policies and protocols, but ultimately it's about trust and willingness to help each other," Quist says. Vermue continues: "We keep each other on our toes, but without competition. Everyone wants to move forward, and we do that together. And we usually end up with oysters, which also helps."
