What if a ransomware attack unexpectedly disrupts essential operations? At the BQ Cybersecurity Convention on Bonaire, executives and professionals rehearsed this exact situation. The tabletop exercise was specifically designed for the Caribbean context. “That’s when practical questions come to the table,” says Tim Muller, director of the Rijksdienst Caribisch Nederland.
Muller: “Who do you call during a cyber incident? Which systems take priority? And how do you communicate about it with residents?” According to him, such exercises are necessary, but digital resilience begins with how the government organises its daily services.
Reliable public services
The National Office for the Caribbean Netherlands (Rijksdienst Caribisch Nederland or RCN) is the largest employer representing the Dutch government on Bonaire, Saba, and Sint Eustatius, and supports all local ministries. In addition to police, fire services, and prisons, RCN oversees front-office functions for agencies such as the Immigration and Naturalisation Service (IND), the Ministry of Social Affairs and Employment (SZW), and the Caribbean Netherlands Tax Administration (BCN). “Because so many connections within the RCN are centred here, any disruption quickly affects multiple government services and erodes residents’ trust,” says Muller. “Digital resilience is therefore essential for good governance and dependable public services. People must trust that their government manages their data and systems securely and responsibly.”
Cyber resilience starts with behaviour
“Within RCN, digital security starts with our own staff. Cyber resilience isn’t just about firewalls and systems; it’s primarily about behaviour. We support employees in working securely digitally and in being aware of risks. RCN operates within the frameworks set by the ministries in The Hague, but translates these into practical measures for the islands. National guidelines are converted into concrete agreements, procedures, and service levels, with attention to local circumstances and operational capacity.”
Bridge between the islands and The Hague
As a former island secretary of Saba, Muller understands firsthand how disruptive system failures can be in a small community: “Digital issues strike at the heart of daily life here. In a ministry, work is organised within programmes. Here on the islands, the public bodies operate with small teams that have to do everything at once. We have regular consultations with the island secretaries. And we’ve established a CN Academy that organises training. Everything we do at RCN regarding cyber resilience also applies to the public entities. Through the ministries, we often have faster access to knowledge and resources, which we must share. This way, we can gradually work towards a comparable baseline.”
Include Caribbean Netherlands
Increasing geopolitical tensions in the Caribbean region are attracting more strategic attention. In this context, Muller considers RCN’s small scale a strength. “Every month, I meet with all the department heads of the individual ministries. Inviting people to a session is as simple as sending an email to a few individuals, not through multiple layers. The lines of communication are short, and decision-making is quick.” The same applies to partners on the islands: “We have short lines with our stakeholders.” His message to The Hague: “Always include the Caribbean Netherlands in cyber resilience plans, but don’t simply copy the Dutch blueprint. Keep the goal in mind but adapt implementation to local realities.”
Help at the kitchen table
With the introduction of the Citizen Service Number (BSN) and DigiD, along with the growth of online services, digital resilience is becoming increasingly vital. “To ensure digitalisation doesn’t exclude anyone, government communication in the Caribbean Netherlands is typically multilingual: Dutch, English, Papiamentu, and often Spanish. We also leverage our small scale to deliver services directly to the people,” says Muller. “Recently, RCN staff personally visited seniors in Rincon to check if they know which government benefits they are entitled to and to assist them with applications. Digital resilience isn’t just about secure systems; it’s also about ensuring people can keep pace with an increasingly digital government. That’s why we help residents personally, if needed, at their kitchen tables. This way, they know where to go and what support the government offers.”
Keep practising together
RCN, along with ministries, public entities, and vital organisations, is building a strong Cyber Resilience community. Practice is crucial. “We want to apply the same crisis management approach to cyber incidents that we already use for physical crises like hurricanes,” says Muller. “With clear roles and preparation, a structured response phase, and thorough evaluation. Practising builds competence. And that’s where real strengthening happens.”
Getting started with Crisis Management and Cyber Resilience
1 RCN and shared responsibility
Within RCN, the CIO Office and the Shared Service Organisation (SSO CN) collaborate under the banner of ‘1 RCN’. Together, they develop joint standards for secure and reliable operations, such as rules for access (authorisations), passwords, and incident reporting. SSO CN is the central support organisation within RCN for operational services, including ICT, HR, and facilities, for all government agencies on Bonaire, Saba, and Sint Eustatius. Due to this central role, cyber resilience is no longer just an ICT issue but increasingly a shared responsibility across all involved parties.
To connect staff from the public entities across the 3 islands, RCN has organised meetings where employees and partners exchanged experiences, discussed concerns, current situations, and incidents, and learned together about topics such as AI and digital security.
