Digital Strategy & Execution

Technology and Telecommunications

Whitepaper: FinOps - The Key to Cloud Cost Management

Whitepaper: FinOps

Aleks dahlberg p VATCBKLH8w unsplash 1

Organizations are struggling with rising cloud costs. FinOps* enables them to gain insight into costs and continuously optimize them, leading to more control and better decisions around cloud usage.
*The term FinOps has been around for a while, but in 2019 The FinOps Foundation set itself the goal of promoting best practices, training and standards around financial management of the cloud.

Netherlands

Organizational

The Psychology of Change in Digital Transformation #2

Change in Digital Transformation

Simon fitall 5ditm O9 ae0 unsplash

In the<a href="https://highberg.com/insights/the-psychology-of-change-in-digital-transformation"> first part</a> of the blog, we analysed various forms of resistance in digital transformation, ranging from passive inertia to strong reactance. In this second part, we will focus on interventions: specific actions organizations can implement to effectively address resistance. We will delve deeper into the world of behavioural economics and explore the interventions organizations can use to address inertia, scepticism, and reactance. Through practical examples, we will demonstrate how these interventions can be effectively applied for successful change management in digital transformation.

Kyra Koper

Digital

Risk, Resilience & Compliance

Top 5 trends in cybersecurity in 2025

"Turbulent times, unforeseen effects" was the title of the Cybersecurity Report Netherlands 2024, and it was not without reason. The past year has shown how vulnerable our digital world can be. A faulty software update led to the cancellation of over 4,200 flights worldwide, public transport came to a halt, and hospitals had to temporarily close their doors. Until that day, most people had never heard of Crowdstrike. Yet a small mistake in this software had a huge impact. 
Fortunately, progress has also been made in strengthening cyber resilience: from improved collaboration between public and private sectors to innovations in AI-driven security. A lot is bound to happen in the world of cybersecurity in 2025 as well. In this blog, I share my vision of the key trends that will shape cybersecurity in 2025.

Veroniek Binkhorst

Whitepaper: Cloudtransformation

Cloudtransformatie ENG

In recent years, cloud transformation has evolved from an emerging trend to a fundamental building block for modern IT strategies. Many organizations just struggle with maintaining control during and after transformation to the cloud. How do you maintain this control on the cloud during and after a transformation so that the intended benefits are actually achieved? And what do you need to take into account? In this whitepaper we describe the tools for a successful cloud transformation.

Data & AI

Part 3: When and where is AI ethics needed?

It's nice to know that AI ethics is a must when your organization is deploying AI to solve societal problems or better serve the public. Simply putting in the money won't take you very far. Making AI work for society is the work of people after all. But how to do it then? When and where should ethical reflection on AI be introduced in public organizations?  
In this final part of the introduction series on "AI ethics for public organizations," the separate phases of AI usage are distinguished. They are related to helpful ethical questions that are specific to those phases, and we share insights on where to situate the AI ethics capability in your organization.

Thomas Mollema

Mitigate risks and harness potential

Part 2: AI ethics

Part 2: AI ethics: mitigate risks and harness potential

If you want to apply AI to your organization's problems, where do you start? How do you do so in line with the public values you want to protect? Like all technologies, whether AI helps or harms depends on how you use it. But ignorant use of AI is more likely to do harm than do good. This means not reflecting on how AI relates to your organization's goals and values. 'Why is AI ethics necessary for every organization using AI systems?' is therefore the second question this series of introductions on "AI ethics for public organizations" addresses.

Part 1: The basics of AI ethics

‘What really is the ethics of AI?’ We often get this question from public organizations. Joining AI and ethics might seem strange at first glance, but raising ethical questions is essential to make AI work for your organization. No automating technology is a 'quick fix' for the difficult societal problems that public organizations deal with. Only AI systems that are <a href="https://highberg.com/insights/truly-valuable-services-are-sensible-from-the-initial-design" target="_blank" rel="noreferrer noopener">'sensible by design'</a>, well thought-out, and steer clear of ethical risks succeed in helping solve large, societal challenges. Think of making health care more effective, efficiently sharing information with stakeholders, and strengthening social security and well-being.  
The role of ethics in applying AI to societal challenges is therefore worth examining.

Pride Comes Before a Fall

Is Generative AI the Digital Tower of Babel?

Imagine a mysterious disease ravaging a remote tribe in Papua New Guinea. The brains of those affected degenerate rapidly, and scientists soon discover the cause—a ritual in which the dead are consumed. This disease, later known as Kuru, spreads as the tribe literally ate themselves.
Now, decades later, we see a similar phenomenon in the world of artificial intelligence (AI). No, our computers haven’t started eating each other (thank goodness!), but something disturbing is happening: Generative AI systems (hereinafter simply AI for readability) are increasingly “consuming” their own output, with potentially disastrous consequences.
Welcome to the world of 'model collapse' and 'shitification' - two-dollar words for a multi-billion dollar problem.

Erik de Ruiter

Is Generative AI the Digital Tower of Babel? Pride Comes Before a Fall

How do I know I’m safe enough?

A Safe IT Environment

How do I know I’m safe enough?  Anyone concerned with making their IT environment secure will at some point ask themselves, am I on the right track? Am I doing enough about information security? Is my most important information (crown jewels) secure? What is good enough? 
Implementing a security framework (such as the BIO or the ISO27001 and NEN7510, for example), combined with a risk assessment is often the most commonly followed path. Implementing a framework does not directly answer the questions above. The use of a structured approach will help. Also, in the future, with new threats, this approach can easily be gone through again, to efficiently determine where additional measures are needed. So that one always knows that they are safe enough.

Edward Matray

Striking a balance between security and privacy

Ethics and Zero Trust

Ethics and Zero Trust: Striking a balance between security and privacy

In the modern digital world, organisations are increasingly dependent on technology to protect their data and systems from increasingly sophisticated threats. To deal with this threat, an approach has been developed that has received a lot of attention in recent years: Zero Trust. This approach to information security is based on the principle that organisations do not automatically trust any part of the network, or the user. While Zero Trust can be an effective way to protect organisations, it also raises ethical questions regarding privacy and trust. In this article, we will explore the ethical implications of Zero Trust and how to strike a balance between security and privacy.

Martijn Hunsche

A Highberg customer story: New view on network and telecom infrastructure of Schiphol

Schiphol network and telecom infrastructure

Schiphol Telematics (ST) is the independent telecom operator mainly for Aviation companies at and around Schiphol Airport. ST manages an extensive network of cables and connections. The network consists of over 102,000 cables and 1,700,000 splices, connected via 224,000 pieces of equipment, spread over more than 8,200 locations at Schiphol.

Gregor Hendrikse

New view on network and telecom infrastructure of Schiphol

Strategy & Change

The challenge for Philips is to involve all employees in the execution of commitments

The Philips Sustainability Challenge​

The philips sustainability challenge

In 2020, Philips announced its ESG commitments for 2025: a comprehensive set of key commitments and ambitious targets across all the Environmental, Social and Corporate Governance (ESG) dimensions. ​Currently, the main challenge for Philips is to involve all employees in the execution of these commitments. This requires employees to become aware of the ESG commitments and ambitions, understand how they can contribute from their own role and context, and requires them to adopt and execute new behaviors. ​

Jody Pietersz

The Philips sustainability challenge​

Sustainability

We guided Ctac in their organizational transformation

Organizational transformation with CTAC

organizational-transformation-with-ctac

We guided Ctac in their organizational transformation focusing on the axes of processes, governance, behavior, and leadership, with the goal of achieving higher returns, increased employee satisfaction, and enhanced customer satisfaction.

Manouk Hertogs

What does Wegiz mean for healthcare providers?

Electronic Data Exchange in Healthcare Act

Wat betekent de Wet elektronische gegevensuitwisseling in de zorg Wegiz voor zorgaanbieders

The Electronic Data Exchange in Healthcare Act (the Wegiz) requires healthcare providers to exchange data electronically from now on. In this way, care is provided to the patient faster and more efficiently. On April 18, 2023, the bill for the Wegiz was unanimously passed by the Senate. Since the law will enter into force on July 1, 2023, the most important questions about the Wegiz will be answered below.

Justine de Boer

What does the Electronic Data Exchange in Healthcare Act (Wegiz) mean for healthcare providers?

The promising privacy standard

Five questions and answers about ISO 27701

Five questions and answers about ISO 27701 the promising privacy standard

In August 2019, ISO27701 was published. An international standard for privacy management. That sounds promising. Can we now finally get ourselves certified for the GDPR? Actually, the answer to that question is both "yes" and "no". That is not a clear answer, so that requires more explanation.

Martin Zinke

Five questions and answers about ISO 27701, the promising privacy standard

Six Things You Need to Know About the DPO under the PDA

What To Know About the DPO under the PDA

The Police Data Act (PDA). A privacy law, much like the GDPR, but with some distinct differences. The PDA also introduces the role of a Data Protection Officer (DPO), which, however, differs in certain aspects from the DPO role under the GDPR. In my work, I frequently encounter misunderstandings about this so-called PDA-DPO. Below, I discuss 6 key points you should know about the PDA-DPO.

Steven Kant

A solution for all your privacy issues!

Privacy by Design

Privacy by Design A Solution for All Your Privacy Issues

By consistently applying privacy by design, organizations enhance the quality of their data protection and reduce its associated costs. Additionally, employees will become more conscious in handling personal data, and as an organization, you can better justify your choices regarding personal data. In mid-April 2020, the CoronaMelder app was launched. The app, in short, informed people when they've been near someone who tested positive for COVID-19, aiming to address the at that point growing number of infections in the Netherlands.
Half of the Netherlands was concerned that the government might get access to information of citizens' whereabouts. Fortunately, the app's creators had thought this through: when designing the CoronaMelder app, it was essential that the app be privacy-friendly. With input from numerous privacy specialists, the CoronaMelder app was developed from the outset to offer the most privacy-friendly notification app. An excellent example of effectively applying the privacy by design principle.

Laura Natrop

Privacy by Design: a solution for all your privacy issues!

The Data Protection Officer (DPO) is surrounded by many misconceptions.

Five myths about the data protection officer

The Data Protection Officer (DPO), formerly referred to as the Functionaris Gegevensbescherming (FG), is surrounded by many misconceptions. To clarify matters, we have compiled a top five list of common myths that we will debunk right away.

One of the important "control mechanisms" for GDPR compliance is data subjects.

Data subject rights: are you an open book?

Data subject rights are you an open book

One of the important "control mechanisms" for GDPR compliance is the fact that data subjects can practice certain rights. These rights not only ensure that data subjects remain in control of their personal data, but they also act as an important check for your organization. Can you respond adequately to a data subject's request? Do you have a quick overview of the personal data the data subject requests? Do you know which systems contain these personal data? In short, it’s time to be an open book!

Courtney Don

Not infrequently, I see battles between data scientists and privacy professionals.

Data and privacy professionals: unite!

Data and privacy professionals unite

Not infrequently, I see battles between data scientists and privacy professionals within organizations. And in these conflicts, the struggle isn't over traditional causes like land, religion, or honor, but rather over data minimization (how much data is needed), storage (how long to retain data), and legal basis (is this even permissible). With heated discussions, smokescreens, and rear-guard debates, they engage in combat. But in battles, there are rarely winners. Not in this fight either.

Frank van Vonderen

It's natural to ask that one question: "Are we now 100% compliant?"

100% Privacy compliance is not possible

100 Privacy compliance is not possible

Many entrepreneurs and executives shudder at the thought of the fines and liabilities associated with GDPR. So, it's natural to ask that one question: "Are we now 100% compliant?"

4 tips to prevent discrimination by algorithms

Preventing discrimination by algorithms

No discussion about algorithms goes by without the word 'discrimination' being mentioned. Understandably so, as there are now numerous unfortunate examples where people suffer greatly from decisions made based on algorithms. And this harm sometimes goes so far as to disrupt or destroy lives. That is, of course, unacceptable – but how can you maintain control over discrimination by algorithms? 
The bad news: discrimination is inherently linked to algorithms. Why? The original meaning of discrimination comes from Latin. To discriminate means to 'distinguish.' Only later was another meaning added to the word 'discrimination,' namely that someone is treated unequally based on discrimination.

3 ways to get more out of your DPIA!

Your DPIA isn’t a tick box exercise

3 ways to get more out of your DPIA

The DPIA (Data Protection Impact Assessment) is unfortunately often regarded as a "tick box exercise": something you simply have to do. But once the DPIA is completed, it's done: there's a good chance the outcome will disappear into the proverbial (and sometimes even literal) dusty cabinet. 
As a DPIA enthusiast, I find that quite a pity, of course. The DPIA is, in fact, a wonderful instrument for managing privacy risks and making targeted improvements to your processes. How do you do this? There’s various ways. I'd like to provide three examples of how a DPIA can be used as an improvement instrument rather than being a mere paper tiger.

Your DPIA isn’t a tick box exercise: 3 ways to get more out of your DPIA!

Right of access includes the right to know the identity of recipients

Right of access and recipients identity

As a data subject you have the right to access the processing of your personal data based on the General Data Protection Regulation (GDPR). Part of this right to access includes the right to know to whom your data has been provided. In a recent ruling, the Court of Justice of the European Union ruled that in doing so, you are also entitled to know the identity of the recipients of your personal data.

Financial Services

Healthcare and Life Sciences

Energy and Utilities

Retail and Consumer Goods

(High Tech) Manufacturing and Logistics

Government and Public Sector

Media and entertainment

Tips for portfolio organization, the portfolio process and continuous improvement thereof.

Managing value with portfolio management – 3

Daniil silantev io Ywos PYC0 U unsplash

In the first part of this blog series I indicated that there can be several forms of development in an organization, but always with a common goal: realizing value. With portfolio management you find each other by continuously managing this in a coherent manner. In the follow-up blog I provided a set of concrete tools to continuously manage the highest value in a coherent manner. In this third and concluding part, I provide tips for portfolio organization, the portfolio process and continuous improvement thereof.

Managing value with portfolio management – Part 3

Guidelines for portfoliomanagement

Managing value with portfolio management – 2

In the first part of my blog series I indicated that in an organization with multiple development forms there is a common goal: realizing value. With portfolio management you achieve the highest value together by continuously managing this in a coherent manner. In this follow-up blog a set of handles.

Managing value with portfolio management – Part 2

People find it difficult to make choices and mainly driven by costs, not by value

Managing value with portfolio management

In organizations with many IT initiatives (development of front-end, ERP system, data platform, infrastructure, etc.) the following sometimes occurs: There is a lack of coherence between all these initiatives, people find it difficult to make choices and mainly driven by costs, not by value. Decision-making starts slowly and it takes a long time before initiatives are realized. All this does not benefit the working atmosphere, which may make it difficult to retain employees.

Managing value with portfolio management – Part 1

How to ensure that agile and devops teams realize the strategic organizational goals

SAFe portfolio management in practice

safe-portfolio-management-in-practice

How to ensure that agile and devops teams realize the strategic organizational goals?
Traditional portfolio management is based on multi-year and annual plans for projects and programs, with associated budgets and management. The portfolio is evaluated over the course of a financial year and priorities are recalibrated. Because the vast majority of technology is developed in an agile way, or even devops, this conflicts with the traditional portfolio cycle. Because agile teams do not commit to the long term; you don't have to expect any planning from these teams. Agile teams are accountable with reviews (demo) every two weeks; progress reporting as an accountability mechanism is a far cry. What is the guarantee worth to a portfolio manager that the capacity is properly allocated? How do you ensure that the realization of the agile teams is in line with the organizational strategy and therefore the portfolio?

Ron Mostert

Organisations have high hopes for their agile transformation. How to succeed?

How an agile transformation succeeds?

how-do-you-make-an-agile-transformation-succeed

Organisations have high hopes for their agile transformation. Yet after the initial successes, many organisations often find that their agile transformation gets stuck. The enthusiasm among employees, management and customers disappears. Improvement stalls or things even get worse. In this article, our experience of what often goes wrong and how to prevent it.

Geert Eggens

How do you make an agile transformation succeed?

Circumstances demand of every organization, that it be designed agile

Agile governance

agile-governance

Agile leadership 
Internal and external circumstances demand of every organization, that it be designed agile. The question is no longer whether you want to work agile, but how you set this up for your organization. And how you shape Agile leadership in doing so.

Transformative leadership in pursuit of sustainable practices

Shaping green futures

shaping-green-futures

In this episode we are talking to <a href="https://www.linkedin.com/in/riccardopicca/" target="_blank" rel="noreferrer noopener">Riccardo Picca</a>, an Italian seasoned senior executive with a rich portfolio of experiences in spearheading growth, profitability and sustainability performance.

David Sieweke

Arent van 't Spijker

Clients like to have an estimate even if the work is going to be done "agile".

How do I estimate my agile project?

Hoe begroot ik mijn agile project?

Clients like to have an estimate of functionality (still) to be built, even if the work is going to be done "agile". This seems perfectly justified to me. To estimate, two approaches are common in ICT: working with function points or working with story points. Function points have been around since the 1970s. Working with story points is relatively new and has grown in popularity, especially through agile working. It is sometimes claimed that one method works and the other does not. But this is a lot more subtle. 
When does what work best? Here are my insights on that question and my tips from practice.

Ed van Doorn

Empowering employees through gamification to meet ESG targets

The Philips sustainability challenge

The-Philips-Sustainability-Challenge

Philips’ question
In 2020, Philips announced its ESG commitments for 2025: a comprehensive set of key commitments and ambitious targets across all the Environmental, Social and Corporate Governance (ESG) dimensions. 
Currently, the main challenge for Philips is to involve all employees in the execution of these commitments. This requires employees to become aware of the ESG commitments and ambitions, understand how they can contribute from their own role and context, and requires them to adopt and execute new behaviors.

Purely in accordance with the letter of Scrum, is the Project Manager redundant?

Scrum challenges the role of Project Manager

Neom yx7 T Jle8 Lh M unsplash

Purely in accordance with the letter of Scrum as an Agile methodology, the collaboration between Product Owner and (scrum) team makes the need for the classic Project Manager redundant. 

A Scrum Master and Product Owner, together with the scrum team, ensure that this task – just like 'testing' for example – is tackled within the team. For this 'self-organizing group of people', direct interaction is central to their mutual cooperation and coordination with stakeholders in the immediate environment.

Aart-Jan Eenkhoorn

Does Scrum really make the Project Manager redundant?

An Agile annual plan requires more than a day of scrumming

Agile annual plan: one day of scrumming?

We willen ons jaarplan met de Scrum-aanpak schrijven, wil jij ons begeleiden?

The end of the year is in sight. This also means the annual moment of looking back and forward. Luckily the caller can't see my smile when he asks: 
'We want to write our annual plan with the Scrum approach, would you like to guide us?' 
The smile is of a farmer with a toothache. Because although facilitating an annual planning session is interesting, it generally has nothing to do with what scrum is intended for.

Report differently in Agile software development to maintain grip and control

Report differently in Agile development

Lukas blazek mc S Dtb WXUZU unsplash

In the software, past results do not guarantee future performance. Everyone knows examples of software developments that are stopped after so many years without results. Control mechanisms are therefore set up at every level. An important but often forgotten aspect of auditing is: how do you report when software is developed with Agile Working? Important because almost all software is developed with a form of Agile Working: Scrum, DevOps, SAFe, etc. Agile Working requires a different rhythm and different measuring instruments to maintain grip and control over software development.

Agile working or agile software development is not new. Four praticle tips how to manage.

Four practical tips for Agile management

Benjamin child G We0dl VD9e0 unsplash

Agile working or agile software development is not new. Many types and forms of Agile software development have been used over the past 25 years. Each of these types brought a certain focus. Such as Rapid Application Development (RAD) in the 1990s with the bringing together of design and development and Extreme Programming with, among other things, the four eyes principle. Since the millennium, Scrum as an Agile approach has increased in popularity. Scrum is a form of incremental work in which working software is always delivered in small teams in a short time. A working piece of software then takes precedence over producing (a lot of) documentation.

Is Agile Programme Management the solution for 'getting a grip' on changes?

Agile MSP: getting a grip on change

Jo szczepanska 5ai Rb5f464 A unsplash

Darwin observed this 200 years ago: not the strongest or the smartest but the most agile survives. In times of disruptive technologies and changing business models, complex -and long-term- change requires a more agile kind of management.   

So is Agile Programme Management the solution for 'getting a grip' on these changes?

Does Agile working make sense with fixed requirements?

Agile working with fixed requirements?

Suzanne d williams VMKBFR6r jg unsplash

If the requirements for a system are known in advance and will therefore not change during the process, does agile working make sense? Because, as is often the reasoning I hear, agility or exploratory work is not necessary. In my opinion, this is only a half-truth and in this blog I would like to share my view on why the agile way of working can be very productive, even with fixed requirements.

Since the introduction of the GDPR, privacy has never been so prominent.

Agile working and privacy go hand in hand

Xavier von erlach Sg A90 Vd EF Fk unsplash

Since the introduction of the GDPR, privacy has never been so prominent. The GDPR requires by law that privacy has been considered in advance when realizing new services, processes and systems. This is called “Privacy by Design” (hereinafter PbD). Agile working, such as scrum, is delivered per sprint of 2-4 weeks, with a focus on rapid implementation of new functions. Privacy is often still regarded as a side issue or final element. I also repeatedly hear talk about the “privacy ballast” that would hinder Agile working and would also be contradictory to Agile principles. With this blog I want to emphasize that “Privacy by Design” fits perfectly into Agile working and that the two even reinforce each other.

Mastering IaaS costs: Strategies for efficient cloud infrastructure management

Cloud infrastructure: Who watches the costs?

cloud-infrastructure-who-is-watching-the-costs

We are well taken care of. The management of the infrastructure is outsourced. There is no longer ownership of the infrastructure; we use Infrastructure as a Service (IaaS) from the cloud (Azure, AWS, or Google), possibly supplemented with IaaS from our management party. This provides us with flexible capacity, and we no longer have investments, but pay based on usage. Never again paying too much, right? That last part is questionable. In fact, without targeted management, that's usually not the case.

Cleo van Engelen

Cloud infrastructure: Who is watching the costs?

Decentralized cloud governance: Embracing cloud technology across the organization

Preferably no cloud competence center

The opportunities that the cloud offers to organizations have a tremendous appeal. However, implementing this new technology is not straightforward and requires clear governance. To fulfill this governance, various frameworks have been devised by AWS, Google, and OACA. Highberg has also developed a cloud governance framework. Often, these frameworks are implemented in a cloud competence center or under the fancier name of cloud center of excellence. But is that an effective solution for cloud adoption? 

Cloud adoption is challenging. Uncertainty about and thus resistance to the cloud exists at every level. Is it safe and compliant with laws and regulations? Will my job be taken away? Are we underestimating the complexity of our landscape? Will we be able to control costs when everyone can create virtual servers? And then there's the knowledge issue. Because which of our administrators has sufficient knowledge?

Technology

Technology

Related Insights