Gina Plat and Teun van der Vorm: Map Dependencies Before Pursuing Digital Sovereignty

Digital sovereignty starts with understanding dependency before deciding what to replace, according to Gina Plat, interim quartermaster of the Open Source Program Office at the Dutch Ministry of the Interior and Kingdom Relations, and Teun van der Vorm, general director of DICTU. In an interview supplied by Stichting Drupal Nederland for cross-publication, the two Dutch government technology leaders discuss how public organisations can assess lock-in, use procurement as leverage, build Open Source Program Offices and approach migration without treating open source as either a quick fix or a cost-free alternative.

The discussion comes ahead of the Government Summit at DrupalCon Rotterdam on 28 September 2026. Van der Vorm is scheduled to deliver the morning keynote on digital sovereignty in government, and both he and Plat are listed for a panel examining responsibility for sustaining the open-source ecosystems on which digital sovereignty may depend.

Start With a Dependency Map

What is the first practical step a government CIO or IT manager should take towards digital sovereignty?

Gina Plat: Start with insight. Create a dependency map of your most important services and answer three questions per service: who supplies this, what happens if that supplier doubles the price or withdraws the service tomorrow, and how much time and money does it cost to exit? That exercise takes a few weeks and sometimes produces an uncomfortable picture.

The second step is in procurement. As a CIO, you really have a lever to turn there. Include open standards, open source and data portability as requirements in the next tender. And then choose one service to replace with a digitally sovereign alternative, preferably open source and with European hosting. What you especially need to avoid is that it ends up in a strategy paper with a five-year horizon. Sovereignty grows with concrete steps.

Teun van der Vorm: Do not panic and keep thinking rationally. It is a multi-headed monster that cannot be easily solved in the short term. Map out the major risks and make a concrete plan to mitigate them. Then ensure tight execution.

Furthermore, you want to prevent new major risks from arising. When making new IT investments, carefully weigh which solution best fits. At DICTU, wherever reasonably possible, we choose open-source solutions and hosting in our own data centres or with European parties.

What an OSPO Changes

What is the main contribution an Open Source Program Office can make inside a government organisation?

Gina Plat: Perhaps the most important thing is that the OSPO makes working open source ordinary. The OSPO connects strategy and policy, such as “Open, unless”, with concrete implementation. It advises organisations on developing and purchasing open-source software and publishing source code. In addition, the OSPO connects a network that usually does not talk to each other often: developers, buyers, lawyers, security officers and executives.

You May Like

Article

TDT September Townhall Discusses Drupal Jobs, AI Visibility and Community Participation

Article

TDT September Townhall Discusses Drupal Jobs, AI Visibility and Community Participation

Teun van der Vorm: The OSPO must ensure that open-source philosophy is promoted within the organisation, that there is good collaboration with other OSPOs, and that practical barriers to working with open source are resolved.

Moving Executives From Principle to Practice

How do you move directors and executives towards open source when their priorities are broader than software itself?

Gina Plat: By speaking their language. A director rarely gets excited about software freedom. They care about security of supply, risk reduction and compliance with legislation and policy. Geopolitical developments in recent years have made that conversation much easier than it was in 2020. I rarely have to explain anymore why digital dependency is a risk to our sovereignty.

I would rather show a working platform than a presentation about the benefits. For example, when we showed the government-wide code platform code.overheid.nl and demonstrated that organisations could host their own repository on it, the conversation changed from “if” to “how”. The same goes for a proof of concept running within a few months. Ultimately, executives want to belong to something that works.

You have also looked at Schleswig-Holstein's open-source transition. What did you take from that experience?

Gina Plat: I think the main lesson I took away is that it is possible. And that it stands or falls with executive backing. In Schleswig-Holstein, there is a cabinet decision behind it and a minister who champions it personally. As a result, the project holds up when the first complaint comes in about a misaligned table. Because yes, getting used to different software takes time.

The second lesson is that they treat it as a change management challenge. The technology was rarely the problem. The gain was in guidance: training, good migration support and space to accept a period of friction. Anyone budgeting a migration without a solid budget for people is budgeting incorrectly.

In addition, Schleswig-Holstein emphasises that it is not necessarily about saving costs, but about gaining more control over IT. This is an important point for us to realise. They are transparent about costs: while it is a nice bonus that after a one-time migration investment of €9 million they now save €15 million annually on Microsoft licensing fees, the bottom line is that it is ultimately about digital sovereignty.

Sovereignty Is More Than Server Location

What misconceptions do you still encounter within central government around open source and digital sovereignty?

Gina Plat: I think the biggest misconception is that sovereignty is only about where servers are located. Data location is just one component. The bigger question is whether you can make decisions regarding data management and whether you can leave. Who decides when an update occurs? Who can change functionality without asking you? And how many years and euros does it cost you to switch if you want to?

You are not necessarily sovereign if you use a Dutch data centre where you do not know the source code and cannot extract your data. That is why open source is so attractive, because it structurally keeps that exit option open.

The idea also persists that open source is free. You save on licence costs, but you get another cost item in return: in-house expertise, management and contributing to the projects you rely on. That is a wise investment, as you purchase control with it. But whoever sells it to their board as a cost-cutting measure will be disappointed in two years and set the entire open-source movement back.

DICTU: Open Source as the Default Choice Where Possible

What does that approach look like inside DICTU?

Teun van der Vorm: Within DICTU, we believe open source is normal. And where there is a choice, open source is preferred over closed solutions. We also want to use open source as intended. That means DICTU contributes to the community under the motto “Public Money, Public Code”.

The choice for open source is based on several arguments. The first is sovereignty and independence: the risk of lock-in is significantly lower. The second is transparency and reliability: it is transparent and therefore more reliable because you can view and analyse the source code. The third is our labour-market position. The IT professionals DICTU targets like working with open source. They often consciously choose to work for government to contribute to society, and open source shares the same philosophy. The fourth argument is cost savings.

Contributing to the open-source community also improves the product. You get feedback on your code, which improves quality. Having thousands of professionals review your code inherently has a positive impact on your code quality.