Digital Strategy & Execution

Technology and Telecommunications

Whitepaper: Cloudtransformation

Cloudtransformatie ENG

In recent years, cloud transformation has evolved from an emerging trend to a fundamental building block for modern IT strategies. Many organizations just struggle with maintaining control during and after transformation to the cloud. How do you maintain this control on the cloud during and after a transformation so that the intended benefits are actually achieved? And what do you need to take into account? In this whitepaper we describe the tools for a successful cloud transformation.

Netherlands

Digital

Data & AI

Mitigate risks and harness potential

Part 2: AI ethics

Part 2: AI ethics: mitigate risks and harness potential

If you want to apply AI to your organization's problems, where do you start? How do you do so in line with the public values you want to protect? Like all technologies, whether AI helps or harms depends on how you use it. But ignorant use of AI is more likely to do harm than do good. This means not reflecting on how AI relates to your organization's goals and values. 'Why is AI ethics necessary for every organization using AI systems?' is therefore the second question this series of introductions on "AI ethics for public organizations" addresses.

Thomas Mollema

Part 1: The basics of AI ethics

‘What really is the ethics of AI?’ We often get this question from public organizations. Joining AI and ethics might seem strange at first glance, but raising ethical questions is essential to make AI work for your organization. No automating technology is a 'quick fix' for the difficult societal problems that public organizations deal with. Only AI systems that are <a href="https://highberg.com/insights/truly-valuable-services-are-sensible-from-the-initial-design" target="_blank" rel="noreferrer noopener">'sensible by design'</a>, well thought-out, and steer clear of ethical risks succeed in helping solve large, societal challenges. Think of making health care more effective, efficiently sharing information with stakeholders, and strengthening social security and well-being.  
The role of ethics in applying AI to societal challenges is therefore worth examining.

Pride Comes Before a Fall

Is Generative AI the Digital Tower of Babel?

Imagine a mysterious disease ravaging a remote tribe in Papua New Guinea. The brains of those affected degenerate rapidly, and scientists soon discover the cause—a ritual in which the dead are consumed. This disease, later known as Kuru, spreads as the tribe literally ate themselves.
Now, decades later, we see a similar phenomenon in the world of artificial intelligence (AI). No, our computers haven’t started eating each other (thank goodness!), but something disturbing is happening: Generative AI systems (hereinafter simply AI for readability) are increasingly “consuming” their own output, with potentially disastrous consequences.
Welcome to the world of 'model collapse' and 'shitification' - two-dollar words for a multi-billion dollar problem.

Erik de Ruiter

Is Generative AI the Digital Tower of Babel? Pride Comes Before a Fall

Government and Public Sector

Leveraging the Enterprise Architecture Lens in the Quest for Business Agility

Whitepaper: Enterprise Architecture Agility

Whitepaper: Leveraging the Enterprise Architecture Lens in the Quest for Business Agility

Today's organizations need a strong vision and a long-term strategy to transform their business operations, ensuring they remain competitive and sustain high performance. In the fast-paced, digitally connected world, it is crucial for organizations to adapt continuously. This quest for adaptability is central to the concept of business agility, which is the ability of a company to effectively sense and respond to fast changing requirements. Achieving this requires a transformation across organizational structure, processes, products and services, and IT systems. Taking the Enterprise Architecture lens for a more holistic approach in your transformation could foster more aligned changes and decisions in the organizational, product/service and Data and IT layer. Many organizations face obstacles due to isolated or partial transformations and therefore, misaligned strategies. In this whitepaper we will examine and describe these challenges and offer an important perspective to address them effectively.

Device-independent development

Construction principles 11

Construction principles for the IT architect (11) Device-independent development

In this series of blogs, I will reflect on the still valid information science construction principles that guarantee better "information structures". This 11th blog in the series continues with the second informatics principle (see my <a href="https://highberg.com/insights/construction-principles-for-the-information-professional">starting blog</a> for the distinction<a href="https://www.vka.nl/publicaties/constructieprincipes-voor-de-informatiekundige/"></a>). Why and when to develop device independently? It's always so nice in the architecture principles at company level or in a policy document "Our employees can work independently of time, place and device". But the impact of the desire to be able to work device-independent on the design of the IT landscape and the software to be developed is not small.

Rutger Gooszen

Highberg podcasts

Employer NPS 27

Highberg has various podcasts about Sustainability, Digitalization, Transformation, Europe and the Government. Curious about these topics? Listen to the podcasts via the links down below.

Sustainability

Organizational

Separating application function from data storage

Construction principles (10)

Construction principles for the IT architect: (10) Separating application function from data storage

In this series of blogs, I dwell on the still valid information science construction principles that guarantee better ‘information building’. This 10th blog in the series continues with the first informatics principle (for the distinction, see my <a href="https://highberg.com/insights/construction-principles-for-the-information-professional" target="_blank" rel="noreferrer noopener">starting blog</a>). This one is about the construction of data processing. 
We don't dwell on it but every screen we process information on hides an underlying construct that extracts data from a storage and allows us to access or modify this data or add new data. If the processing function and the data storage are separated, this has great advantages. In fact, this is the information science principle of decoupling but applied in computing.

The risks of IT visions

As Highberg, we create many different visions for our clients. These can be visions on topics such as: cloud, the digital workplace, data sharing, data-driven working, 5G, wireless connectivity, etc. Name any information technology (IT) related topic and you can create a vision for it. But what is the use of a vision if we don't act on it in practice? Or what use is a nicely formulated vision if it subsequently gets shelved. In this insight I elaborate on the different pitfalls in the creation and implementation of visions that I encounter with my clients.

Daan van Horssen

Two pager: sustainably implementing Data ethics

Two pager: Data ethics

Joshua sortino Lq Khn Dz SF 8 unsplash

In recent years, data ethics has become an important topic when utilizing data and data applications. Responsible data usage is often taken as a starting point. However, in practice, sustainably implementing data ethics within organizations proves to be challenging. Over the past few years, Highberg has undertaken various projects related to data ethics. Our experience has shown that data ethics is closely linked to organizational change. Read our two pager and let us know what you think!

Marlijn Mulder

Strategy & Change

Risk, Resilience & Compliance

Eight Things You Need to Know About NIS2

The European Union (EU) is deeply concerned about the cybersecurity of organizations within vital sectors. The EU has introduced the Network and Information Security 2 Directive (hereinafter: NIS2) to enhance the cyber resilience of these organizations. Organizations within vital sectors are obligated to comply with NIS2 from October 18, 2024. Organizations belong to the vital sector when their service provision (temporarily) disrupts and has a significant impact on the economy and society.
In this Insight, you will read about the eight things you absolutely need to know about NIS2.

Nino van Leeuwen

Shankar Sahtie

Construction principles for the information professional: (8)

Construction principles

Construction principles for the information professional: (8) Separating data and metadata in storage and processing

Data is hot. Everyone wants to work data-driven and AI only works on big data. In short, data is the new gold! But what exactly is data? In the previous blog, I mentioned that there are different categories of data and that one was specifically about dealing with master data and transactional data. In this blog, I dwell on metadata and the need to distinguish that from the data itself and process it separately. Otherwise, a spaghetti is created in the system landscape and searching for specific data becomes the proverbial needle in the haystack.

Construction principles for the information scientist: (7)

Construction principles for the information scientist: (7) Single registration of master data

In this series of blogs, I reflect on the still-valid information engineering construction principles that guarantee better “information constructs.” They are sometimes, in the pace of advancing technology, a bit forgotten. Resulting in sometimes shaky or poorly maintainable and extensible “information constructs.” This time on the need for single-entry capture of master data and the challenges this presents with respect to usage. Is copying a problem?

Construction principles for the information scientist: (6)

Construction principles for the information scientist: (6) Disconnect “who you are” from “what you are allowed”

In this series of blogs, I reflect on the still-valid information engineering construction principles that guarantee better “information constructs.” They are sometimes, in the pace of advancing technology, a bit forgotten. Resulting in sometimes shaky or poorly maintainable and extensible “information constructs.” This time about the need to decouple identification/authentication (who you are) and authorization (what you are allowed to do). How many login combinations do you have in use? Probably more than 30. Still every day we struggle with login names and passwords for all those service providers we visit online. In theory, the solution is simple but in practice it is still laborious.

Healthcare and Life Sciences

Financial Services

The Psychology of Change in Digital Transformation

The Psychology of Change

At Highberg Digital, we help our clients with their digital transformation journeys. Digital transformation can be seen as a journey that has an impact on the core of organizations and individuals. Each journey has its challenges and for digital transformation, it is the response of people to change. Some embrace the changes while others feel more comfortable with the well-known.

Kyra Koper

Digital Strategy & Architecture

Construction principles for the information professional

construction principles

Construction principles for the information professional (9): Apply standard patterns without deviations

In this series of blogs, I reflect on the still valid information science construction principles that guarantee better “information constructs.” This last blog in the series on information science principles is actually also a bridge to the continuation of this series with some computer science principles (for the distinction, see <a href="https://highberg.com/insights/construction-principles-for-the-information-professional" target="_blank" rel="noreferrer noopener">my starting blog</a>). Indeed, standard patterns exist in both information science and computer science.
The elegant thing about a standard pattern is ... that it is a standard. But in practice, there appears to be a reason to deviate a bit each time. The result is a user who no longer understands the user interface or a no longer interoperable concept, lower maintainability of a system and loss of time.

Drones in the Physical Environment

The Revolution of Data Acquisition

The Revolution of Data Acquisition: Drones in the Physical Environment

In a world where technological progress marks nearly every aspect of our daily lives, it's no surprise that the physical environment is exceptionally suited for innovative applications. We're witnessing the rise of smart sensors that monitor environmental quality, smart mobility solutions making city traffic more efficient, and the use of smart dust — minuscule sensors that collect detailed data about their surroundings. Moreover, the development of digital twins, where virtual replicas of physical environments are created for precise analysis and simulation, paves the way for the application of drones in the physical environment.

Irfan Ilahi

Three reasons why as a CIO and CSO you should hold each other's hands

Why should CIO and CSO hold hands?

In my daily work in the field of responsible digitization, I see that sustainability and digitization have a lot in common. Both strive for value creation, involve substantive complexity, and require a similar search for ownership.

Anne van Esch

Most important obligations in the AI Act: how to comply now?

Break through in regulation of AI: The AI Act

This text is translated from Dutch with the help of AI - On December 8, 2023, the European Union reached a preliminary political agreement on the Artificial Intelligence Regulation (hereafter referred to as the AI Act). The final text is formal approved by the European Parliament. 20 days after official publication the AI Act will enter into force. This landmark legislation marks the EU's first step towards regulating artificial intelligence, targeting developers, distributors, and users of AI systems, including those systems used for predictions, classifications, and analyses.
The potential impact on governments and businesses deploying AI systems is significant. In this insight, we'll walk you through the key obligations, how they affect your organization, and proactive steps you can take to ensure compliance.

Sabine Steenwinkel-den Daas

Germany

France

Responsible AI: how to achieve AI fairness with understanding and mitigation bias by AI

Bias in AI Explained

This text is translated from Dutch with the help of AI - "Tell me honestly, what's your biggest fear when it comes to algorithms and AI?" When I ask people this question, the response often is, "AI-systems discriminate!" And of course, discriminating is far from desirable. But how do we ensure that algorithms don't discriminate?
First and foremost, it's important to understand that algorithms themselves do not discriminate. However, algorithms can be developed in ways that lead to unwanted or undesired distinctions in representation of groups in the result. This is commonly referred to as "bias" in technical terms. 
Essentially, if you have control over the bias within the algorithm, you also minimalize discrimination. In this insight, I will explain how to achieve this. Let's start by answering the question: What is bias?

Control AI risks and make impact: top criteria for responsible deployment of AI systems

In control of your AI systems

This text is translated from Dutch with the help of AI - Have you ever heard or said within your organization, "We're working with data/algorithms/AI" or "We have plenty of data initiatives, but scaling within the organization is challenging"? These questions all boil down to one main question: How do you ensure that you apply the right algorithms in the right way?

When is transparancy on AI sufficient? Comply to the AI Act with an algorithm registry?

Transparency with algorithm registry?

This article has been translated from Dutch with the help of AI: In an era where algorithms exert increasing influence on our daily lives, maintaining control over the latest developments and being transparent about them is more important than ever. This leads us to a crucial question: when is the openness and transparency surrounding these algorithms sufficient? The answer is not simple, because transparency goes beyond just registering the algorithm. In this article, we delve deeper into the steps needed to start working on transparent and responsible use of algorithms at 5 maturity levels.

Highberg's strategy against rising cybersecurity threats in industrial automation

ICS Security: setting new standards

Cybersecurity threats industrial automation (ICS/SCADA)

The world of Industrial Automation (IA) is increasingly facing cybersecurity threats. Not only foreign nuclear power plants have already been hacked, but also the first objects of our vital infrastructure. VKA has therefore developed a multidisciplinary approach to take IA to the desired higher level.

Huub Koninkx

Focus decision-making outside the boundaries of the program organization

Innovation in chains

Innovation in chains: focus decision-making outside the boundaries of the program organization

This past year I had the pleasure of being program manager for an ambitious "bottom up" initiative for exchange and reuse of soil data (chain computerization) of government and network operators. Many parties were involved such as municipalities and provinces but also dozens of (semi)private companies. At the time of writing this post, the program has temporarily stopped: the principals are looking for a way to regain funding and participation. In this blog, I briefly reflect on events and how additional measures can help this program - and other similar programs.

Ruud Boot

IT department, are you still there?

I Stock 1048358188

The world is changing rapidly, and with the advent of technological advancements, many organizations are being driven by digitization.
Within information provision (IT), also known as the IT department, it's no different. Think of the arrival of technologies like GenAI and Data Management. The business departments of an organization want to anticipate these changes.
To facilitate this, IT departments are facing increasingly greater challenges. They are often very busy ensuring the basics of their services are in order, passing audits, and meeting the year's forecasts. Due to this focus, there is often insufficient time to truly respond to all developments.
It's time to pull the handbrake, look around, and collaborate closely with the business.
Because I see more and more in practice that the business is following its own IV path. A path without the IT department. In this blog I describe in broad terms what you can do to make an active contribution to this as an IT department.

Jessica Drake Wetsteijn

An integrated architectural approach for robust ICS/SCADA security

Working in architecture

Pexels dominika roseclay 1239460

Last year showed how vulnerable our infrastructure sometimes is as a result of cyber attacks. For example, PETYA caused non-functioning cranes at Maersk's container terminal, and non-functioning sorting machines at TNT. Also recently, some banks have proved inaccessible due to a DDos attack. Until now, mostly technical and related organizational measures have been taken to deal with such cybersecurity threats. However, it is slowly dawning on us that reactive measures will not be sufficient in the future if we want to guarantee the continuity of such infrastructure. So how do we really get our Operational Technology (OT/ICS/SCADA) properly secured?

Stop muddling through and start working under architecture

Battling invisible cyber threats in our digital realm

That other pandemic...

Pexels tyler lastovich 396947

The Corona crisis has once again made us aware of the vulnerability of our (open) society. Yet we have known for much longer that vulnerability to viruses also lurks in an entirely different world; our digital society.

IT and I(I)OT are converging, now what, evolution or revolution?

IT and OT Fusion: managing change

IT and OT converging, how do we keep a grip on this (r) evolution?

IT and I(I)OT are converging, developments are accelerating, now what, evolution or revolution? 
Actually, there are 3 major developments happening simultaneously in the world of operational technology (OT). First, the number of business and management processes that require both office automation (IT) and OT to be available is growing; with or without interfaces between them. Applications are growing, but information security is not automatically growing with them. This makes a second development even more important, that of growing external threats, with most in the news ransomware, such as previously at Maersk, recently at the Gelderland security region. Last but not least, there is a new player in this domain, dubbed by someone the "IoT virus. It often starts with 'sensors,' but eventually it involves large data streams, which need to be controlled. Lots of potential but immature in terms of security, thus vulnerable. What should enterprise management do with this? Adapt quickly to these new developments, at the risk of making mistakes because of this speed? Opt for evolution or revolution? Our answer is 'both', but according to a controlled change approach, in which IT and OT are aligned, with a stepped Architecture process and appropriate Communication at each stakeholder level.

Discover the importance of data subject rights under the GDPR

Why the rights of data subjects are important

Waarom de rechten van betrokkenen onder de AVG zo belangrijk zijn

In today's digital world, personal data is everywhere. The General Data Protection Regulation (GDPR) grants individuals specific rights regarding their personal data. But why are these rights so important, even if people rarely actively use them?

Frank van Vonderen

Why the rights of data subjects under the GDPR are so important?

Discover the crucial privacy requirements to consider when selecting a SaaS provider

Privacy requirements for a SaaS supplier

Essentiële privacy eisen voor het kiezen van een Saa S leverancier

Choosing a SaaS provider is a decision that goes beyond just functionality and price. In a world where data is one of the most valuable assets of an organization, privacy and data protection are becoming increasingly important. But what are the key privacy requirements that a SaaS provider must meet?

Essential privacy requirements for choosing a SaaS supplier

Privacy by Design: protection at the heart of algorithms

Is Privacy by Design important in algorithms?

Privacy by Design: Protection at the heart of algorithms

What is Privacy by Design?

Privacy by Design is a strategy that focuses on integrating privacy protection into technological products and systems from the outset. This approach means that privacy is a fundamental part of the design process, rather than an addition or adjustment made afterwards.

How can organizations make privacy by design concrete and actionable?

Het concreet maken van Privacy by Design

Making Privacy by Design Concrete: Practical Steps for Implementation

In today's digital age, where data is ubiquitous and privacy concerns are at the forefront, incorporating privacy by design principles into the development of products and services is paramount. Privacy by design refers to the practice of considering privacy and data protection from the outset of the design process, rather than as an afterthought. But how can organizations make privacy by design concrete and actionable?

Learn how your organization must act in the event of a data breach, under the GDPR

Navigating a data breach: step-by-step

A data breach is like an unexpected storm in the world of data protection. It can happen to anyone, but rest assured: the GDPR offers an umbrella in this storm. This blog guides you step by step through the process of managing a data breach according to the GDPR, so your organization can quickly become dry and safe again.

Organizations are required to keep such a register, what are the benefits?

Benefits of register of processing operations

What is a Record of Processing Activities (RoPA)?

What is a Record of Processing Activities (RoPA)?


A Record of Processing Activities is a detailed overview in which organizations document how personal data is processed. This includes information about the types of data collected, the purpose of the processing, with whom the data is shared, and how it is secured. According to the GDPR (General Data Protection Regulation), organizations are required to maintain such a record.

Benefits of a register of processing operations under the GDPR

Are your actions complying with the GDPR? This guide will help you navigate the GDPR

How to know if it's allowed under the GDPR?

How to know if something is allowed under the GDPR

Since its introduction in 2018, the General Data Protection Regulation (GDPR) has brought about many changes in how companies handle personal data. However, understanding the GDPR can be challenging, and it is often not immediately clear whether certain actions are allowed. This blog post provides a clear explanation of how you can determine if your practices are in line with the GDPR.

How to know if something is allowed under the GDPR: a practical tool

Having a DPO is essential to comply with the General Data Protection Regulation (GDPR)

How to find a DPO that fits your organization

Hoe vind je een Functionaris Gegevensbescherming (FG) die perfect bij je organisatie past

In an era where data protection and privacy are becoming increasingly important, finding a suitable Data Protection Officer (DPO) becomes a crucial task for many organizations. Whether it's a large corporation, an SME, or a non-profit organization, having a competent DPO is essential to comply with the General Data Protection Regulation (GDPR). But how do you find a DPO who fits perfectly with the needs and culture of your organization? Here are some tips.

How to find a Data Protection Officer (DPO) that fits your organization perfectly

Creating a data transfer impact assessment: a step-by-step guide

The importance of a DTIA

Hoe voer je een DTIA uit

In the era of globalization and digital expansion, data is continuously sent around the world. As a result, a Data Transfer Impact Assessment (DTIA) has become essential. This assessment helps organizations evaluate the risks and compliance requirements associated with transferring personal data across borders. In this blog, we will take you step by step through the process of creating an effective DTIA.

How do you conduct a DTIA?

How policymakers can make ethical and measurable trade-offs when using AI and algorithms

The Importance of an Ethical Framework

Welcome to the Dynamic World of AI and Algorithms! These technologies are transforming our lives, but they also bring ethical challenges. How do we ensure that AI is fair, transparent, and accountable? We focus on establishing an ethical framework for policymakers and the general public, with steps and criteria for ethical considerations in the world of AI.

The question is not whether there will be casualties as a result of a cyberattack but when

Vulnerability SCADA to Cybersecurity Attacks

Vulnerability of SCADA Systems to Cybersecurity Attacks

Many different organizations and companies use SCADA/ICS (Supervisory Control and Data Acquisition/Industrial Control Systems) systems in various ways in their primary (production) processes or products. This includes manufacturing companies, control of bridges and locks, electric cars, equipment in intensive care units, as well as pacemakers and wireless insulin pumps. IoT (Internet of Things) is also playing an increasingly significant role in this context.

Koos van der Spek

Is a new trend emerging in the world of hackers: data leaks as a business model?

Data Leaks as a Business Model?

Cyber Extortion: Data Leaks as a Business Model?

Is a new trend emerging in the world of hackers: data leaks as a business model? With the worst of the GDPR (General Data Protection Regulation) storm settling down and the era of "can't do it, it's against GDPR" hopefully behind us, hackers are discovering a new source of income: fear of fines.

Bart Giesbers

Where lies the Ownership of Risks and Measures in Information Security?

Ownership of Risks in Information Security

Information security is everyone's responsibility! Most people who have ever been an audience member for a presentation on this subject have heard the above statement at some point. It's a true statement but one that remains somewhat cryptic in practice for many.

Steven Debets

Other organizations have realized that it would have been handy if there had been a BCP.

Questions Your BCP Should Answer

Over the past few weeks, many organizations have been able to put their business continuity plans (BCP) into practice. Other organizations have realized that it would have been handy if there had been a BCP. Which category does your organization fall into? In any case, we've all been busy brainstorming scenarios and gathering data to gain control over the things coming our way.

Cyber incidents are having an increasingly significant impact: Reduce this response time.

Cyber Crisis Management: Joint Responsibility

Cyber Crisis Management: A Joint Responsibility

In two-thirds of organizations, it takes a minimum of two hours to take action after discovering a cyber incident. For one-fifth of organizations, it takes more than four hours. This information comes from the international study Cyber Resilience 2016 by the Business Continuity Institute. Considering that cyber incidents are having an increasingly significant impact, it's essential to reduce this response time. But what causes so much time to be lost?

Increasingly concrete threats posed by the digitally interconnected world.

Cloud Strategy & Security: Collaboration?

Cloud Strategy and Security: Seeking Collaboration

Cybersecurity is the central theme of this year's Business Continuity Awareness Week, and it's no wonder. Individuals and businesses are feeling more vulnerable than ever due to the increasingly concrete threats posed by the digitally interconnected world.

Part 2 addresses the disadvantages, risks, and possible next steps.

Digital Euro: A Blessing or a Curse? Part 2

The Digital Euro: A Blessing or a Curse? Part 2 – Disadvantages, Dangers, and Next Steps

This is Part 2 of a two-part series of articles on the digital euro. Part 1 discussed the background and emergence of the digital euro and its potential advantages (you can read Part 1 here). Part 2 addresses the disadvantages, risks, and possible next steps.

Paul Helmich

This part covers the background and rise of the digital euro and its potential benefits.

The Digital Euro: Blessing or Curse? Part 1

This is Part 1 in a series of 2 articles about the digital euro. This part covers the background and rise of the digital euro and its potential benefits. Part 2 discusses the drawbacks, risks, and possible next steps (you can read Part 2 here).

Digital transformation

“Improving customer value by digitalization of business models and processes”

Related insights