Digitale weerbaarheid van Nederlandse organisaties: Mogelijkheden en uitdagingen voor de meetbaarheid

Note: This report is in Dutch. An English-language summary is available.

Governments increasingly acknowledge that not all incidents can be prevented, shifting their emphasis from prevention to resilience — the ability of systems to continue functioning despite disruptions. In the digital domain, this concept is referred to as digital resilience or cyber resilience, which is essential as societies and organisations grow more dependent on technology. This study, commissioned by the Research and Data centre of the Dutch Ministry of Justice and Security on request of the National Coordinator for Security and Counterterrorism (NCTV), explores whether and how the digital resilience of Dutch organisations can be measured in a broadly applicable way. It combines a literature review, expert interviews, and internal workshops to assess existing approaches for measuring resilience. Eighteen methods were identified and analysed, covering various technical, procedural and organisational aspects. Most focus on qualitative indicators and lack empirical evidence of validity or reliability. None offer a complete, data-driven picture of organisations' resilience levels, nor are such methods currently used by governments for measurement purposes. Nevertheless, several existing frameworks — such as Cyber Essentials, NIST, ISO, and domain-specific models — provide useful starting points for designing future measurement tools. Given the conceptual and practical challenges, the study recommends that the NCTV proceeds incrementally, starting with comparable benchmarks for specific components of resilience. As formal reporting obligations are limited, voluntary and legally aligned data collection should be pursued, leveraging frameworks such as the Dutch Cybersecurity Act (implementing NIS2). Such efforts can gradually improve insight into the digital resilience of organisations and support effective policy development.