The Netherlands Already Requires a Cloud Exit. Can It Prove One Works?
Dutch cloud rules already require assessed exit plans and tested continuity procedures. The harder task is showing which essential services could survive a supplier's withdrawal.
A court in The Hague can be sanctioned by Washington without immediately losing every American software service on which it depends. The International Criminal Court (ICC) illustrates the distinction. A foreign government may acquire legal leverage over a supplier relationship long before anyone actually pulls the plug. Whether an institution could function if that relationship failed is a separate, practical question.
I expected to find a Dutch government alarmingly dependent on American technology suppliers and poorly prepared for a forced exit. The evidence pointed to a less dramatic, more complicated story. The Netherlands already has substantial cloud-exit and continuity requirements, and existing reviewers have sometimes exposed serious weaknesses. What remains uncertain is whether those requirements translate into essential services that could keep operating without a supplier’s cooperation, who should examine the evidence, and how much additional resilience is worth buying.
What the ICC sanctions actually show
On October 9, 2026, the US Treasury’s Office of Foreign Assets Control (OFAC) added the ICC itself to its sanctions list, following earlier sanctions against individuals associated with the Court. The designation took effect then. It did not wait for a six-month transition period, and it did not automatically terminate every service the Court might receive from an American company.
The accompanying licenses explain why. General License 13 authorizes defined transactions needed to maintain or wind down ICC operations and agreements until 12:01 a.m. Eastern daylight time on April 7, 2027, subject to exclusions concerning other blocked persons. General License 14 separately authorizes specified telecommunications, online communications, enterprise software, and related cloud services. It contains no matching April 7 expiration date. Two further licenses address particular pension transactions and the welfare of named detainees. None turns the ICC designation into a general exemption from US sanctions law; nor should the expiry of License 13 be assigned to the others.
In May 2025, Microsoft discussed the disconnection of an individually sanctioned official while denying that it had terminated services to the Court as an institution. That was the company’s account, not an independent audit. Reuters reported an end to the ICC’s relationship with insurer AXA effective October 1, before the institutional designation. Research checks through October 19 did not establish a newly verified, institution-wide shutdown of the ICC’s cloud, banking, or payroll following October 9. They cannot establish that every service continued uninterrupted either.
The Court is an international institution, not a Dutch ministry, and its sanctions exposure cannot be mapped mechanically onto Dutch government contracts. The technology may be working perfectly when the legal or commercial permission to use it becomes uncertain.
The government has already written the exit rules
An obvious response is to require every ministry to have a cloud exit plan. Yet the Netherlands has already done considerably more than that.
An official cloud implementation framework dated January 2023 required organizations to identify an alternative supplier or internal destination and plan and budget for urgent departure following a crisis or geopolitical development (Article 7). These were not ideas discovered after the ICC’s latest designation, although their presence did not establish that workable alternatives existed everywhere.
The revised central-government cloud policy adopted July 3, 2026, the Herziening rijksbreed cloudbeleid 2026, goes further. For materieel cloudgebruik, meaning cloud use significant enough to require the policy’s material-risk treatment, Section 3.2 requires a documented exit plan tested or assessed by the organization itself. It must address an orderly departure and an unexpected interruption. The organization must review whether the plan remains current every year. This is stronger than possessing a contractual right to export files, but the wording does not promise that each organization has completed a timed migration onto an independent provider.
For existing material cloud use, the policy generally allows 12 months to prepare the required exit plan. Its wider adjustment period is four years, with specified exceptions and extensions. Neither clock proves October 2026 compliance or excuses every other applicable continuity duty. It is a central-government framework with defined coverage and exclusions, not a statute binding every municipality, independent public body, international court, or private company. Its specific conditions for email and documents in public cloud are stricter than a general expression of caution about foreign providers.
The Baseline Informatiebeveiliging Overheid 2 (BIO2), the government’s information-security baseline published in March 2026, also imposes testing duties. Process owners must test continuity plans annually (measure 5.30.01), set risk-based maximum recovery times and acceptable data loss (8.13.02), and test restoration procedures at least annually or after a major change (8.13.04). These are substantive requirements, although testing a recovery procedure need not mean operating the whole service without the original supplier.
The Cyberbeveiligingsbesluit, in force since August 15, adds periodically tested recovery procedures and business-continuity plans under Article 9 for entities covered by the Cyberbeveiligingswet, the Dutch cybersecurity law implementing the EU’s NIS2 regime. Its explanatory memorandum explicitly contemplates a tabletop exercise, in which the response is rehearsed without a live cutover. Applicability depends on the entity and legal category; these statutory duties, BIO2, and the cabinet’s cloud framework should not be treated as one undifferentiated law.
The 2026 Besluit CIO-stelsel Rijksdienst sets out government IT governance. Under the July cloud policy, the central chief information officer, CIO Rijk, has a monitoring role; the central chief information security officer, CISO Rijk, can examine relevant risks and exit plans. The organization operating a service retains responsibility for its risks. The government has therefore specified plans, testing, alternative paths, and oversight. It has not thereby demonstrated that the most difficult exit scenarios have been survived.
What a successful exit would have to survive
Consider a service whose data are backed up on schedule and whose restoration drill succeeds while its cloud provider remains available. That is valuable evidence for an ordinary outage. It tells us less about what happens if the provider suspends the account, withholds privileged support, or can no longer supply the software needed to run the restored data.
Data files are only one component of a working service. The operating team may need access to the cloud provider’s management system, the accounts used to authenticate administrators and citizens, encryption keys, application configurations, licenses, security updates, domain services, interfaces to other agencies, and people who understand how to put the system back together. Some dependencies may lie with subcontractors. Moving information to servers in Europe does not by itself place every one of those dependencies under European operational control; neither does an American parent company prove identical risk across every technical arrangement.
In a 2024 evaluation of the earlier central-government public-cloud policy, the Auditdienst Rijk (ADR), the government’s internal audit service, examined three selected cloud services. None had a fully developed exit strategy focused on business continuity. One Dutch software supplier depended on an underlying American cloud provider whose failure had not been properly accommodated in the arrangement. The sample was small and nonrandom, and it preceded the 2026 reforms. It identifies a failure mechanism, not a national failure rate today.
The Algemene Rekenkamer, the Netherlands Court of Audit, found a different set of problems in its January 2025 report. Ministries had reported 1,588 cloud services; the cloud type was unknown for 26%. Among 126 material public-cloud services in its assessment, 84 lacked the required strategic risk assessment. These were findings about the inventory and controls examined before the latest policy took effect. Neither number measures how many essential systems can now recover without supplier cooperation.
What would count as evidence depends on the threatened service and the failure being modeled. A tabletop can expose faulty decisions, missing contacts, or an impossible escalation chain. An isolated backup restore can establish that data are recoverable. An alternative-environment exercise can test whether the application, identities, keys, and necessary connections work without the original provider’s assistance. At the demanding end, operating a minimum service through a simulated supplier withdrawal can test the actual recovery time, data loss, and functionality experienced by users. Each answers a different question, at a different cost and risk.
Maximum tolerable recovery time and data loss are often expressed as the recovery-time objective and recovery-point objective (RTO and RPO). BIO2 already requires organizations to determine these through risk assessment. The important comparison is between the failure scenario an exercise claims to cover and the conditions it actually creates. A successful restore inside the same provider’s account should not be recorded as proof of independence from that account.
Demanding a live, supplier-free cutover from every office application would be mistaken. Testing can itself interrupt services, expose personal data, or create security vulnerabilities. For some functions, a controlled simulation is enough. For others, particularly where a prolonged outage would frustrate a statutory duty or deny access to essential benefits, an untested assumption about outside cooperation may be unacceptable. The evidence reviewed for this essay does not establish how Dutch agencies currently distribute their tests along that spectrum. Confidential exercises may already address the strongest scenarios.
Use the institutions and engineers that already exist
That uncertainty points to a narrower question: do the people who accept the risks receive evidence suited to the failures they claim to be able to manage?
Begin with the service owner, not a newly established certifier. An organization can identify which of its public functions cannot safely be interrupted, specify the relevant dependency chain, and define the minimum service it must maintain. For a high-consequence workload, the scenario might be loss of the cloud provider’s administrator access rather than a routine hardware outage. The organization can then decide whether a tabletop, restored backup, controlled alternate environment, or more demanding exercise produces decision-useful evidence. Someone outside the team that designed the plan should challenge an implausibly low risk classification or a test that quietly assumes the very supplier cooperation being questioned.
Departmental CIOs and security officers, operating teams, and shared-service organizations can perform and scrutinize the work. CIO Rijk’s monitoring and CISO Rijk’s review powers give central officials routes for identifying recurrent problems; ADR and existing independent security reviews can challenge selected cases within their actual remits. This is an argument about how to use available responsibilities, not a claim that one official may order any agency to conduct any particular technical drill. The most useful result of a failed test is an assigned repair, its cost, a decision on whether to fund it, and a date to retest.
Nor is the state waiting for someone to invent a domestic alternative. The Nederlandse Digitale Dienst (NLDD), an operating government digital-engineering initiative, publicly describes its Fundament sovereign-cloud project. Existing organizations such as SSC-ICT provide hosting and other services to ministries. The April 2026 STACKIT agreement adds a European procurement option without requiring agencies to buy a minimum amount. Projects and agreements create choices; they do not, by themselves, document an essential service restored under withdrawal of its former provider. The NLDD’s published remit does not establish a government-wide power to certify other organizations’ cloud exits simply because it is building useful components.
The Tax Administration’s experience shows why an American-supplier tally tells only part of the story. Its October 2025 Microsoft 365 decision concerned workplace software for about 46,000 employees across the tax, customs, and benefits organizations, not wholesale transfer of core tax-processing systems. Roughly 5,000 had received the new workplace before rollout was paused in early 2026. In June 2026, the agency called for more in-house management, data-center capacity, source rights, and selective self-development. The independent ICT Assessment Advisory Board (AcICT), in advice dated June 24 and published June 29, found no workable exit strategy for the proposed public-cloud workplace. The backup arrangement could not restore some encrypted attachments without Microsoft 365. AcICT recommended reversing the rollout. On July 9, the state secretary confirmed the pause while reconsidering an on-premises alternative.
On October 5, 2026, the state secretary told Parliament that the three agencies had chosen an on-premises approach combined with open source. At an October 7 parliamentary committee debate, he clarified that the on-premises arrangement would still use Microsoft software. Expanded data-center capacity helped make that alternative feasible. Under the plan, email and calendars would run on agency-controlled servers in 2027, followed by European open-source personal storage and collaboration tools in 2027–28. Its detailed design remains unfinished, and officials aim to reuse existing licenses. Records-management functions previously expected from M365 present complications. AcICT’s findings show existing independent scrutiny at work, and the government says its recommendations are shaping the redesign. Neither the review nor the new plan establishes supplier-independent recovery or better resilience per euro.
A government-wide public percentage of systems with an approved exit plan would be easy to understand and easy to overinterpret. Even a reported pass rate is nearly useless without knowing the denominator, the importance of the systems, and whether ‘pass’ means a discussion, a backup restoration, or a genuinely independent minimum service. A more informative approach, if existing confidential monitoring does not already provide it, would be for current reviewers to sample the highest-consequence services, examine scenario coverage and serious unresolved gaps, and report suitably aggregated findings. Sensitive architecture, identities, vulnerabilities, and alternate operating locations must stay confidential. Public disclosure is not automatically better oversight.
There is no defensible promise that a more ambitious program will pay for itself. The July policy revision came with no additional funding allocation, although that does not mean agencies have no existing cyber or continuity budgets. Engineers maintaining tax processing, digital identity, or public-service access cannot spend unlimited time duplicating environments. Running two systems can require extra licenses, security maintenance, staff, privacy work, and accessible user testing. A failed migration can impose its largest costs on people who depend on uninterrupted services, including users with disabilities. Tests need authorized change control, protective limits, rollback arrangements, and explicit decisions to stop when the added risk exceeds the value of the evidence.
An organization should sometimes decide that it cannot economically maintain a fully independent alternative. In that case it should record what failure it can tolerate, what protections it has actually tested, who accepts the remaining exposure, and what would prompt reconsideration. The proposal here is to make those decisions more credible using present rules and institutions. There is no measured evidence in the research record that a new certification bureaucracy, a fixed number of pilots, or large-scale insourcing would improve Dutch resilience per euro.
Independence has limits, and they are worth recognizing
The strongest objection to this argument is that officials may already be doing precisely the right work. The 2026 rules have only recently been adopted, some deadlines have not passed, and security-sensitive exercises often do not appear in public reports. CIOs, auditors, and ministers may possess enough confidential evidence to judge risk and remediate deficiencies. In that case, demanding a new public metric would add paperwork and perhaps reveal vulnerabilities without changing a single recovery decision. The absence of a public list of passed supplier-denial tests is not evidence that no tests occur.
There is a second objection with more immediate consequences. An established American provider may deliver better security updates, availability, accessibility, and operating efficiency than a hurried substitute. Running an ill-maintained European replacement purely to change the nationality on a contract could actually make a public service less resilient. The rational objective is risk-appropriate continuity, not a requirement that every essential line of code be European. Some dependence can be reduced by contract rights, separate backups and keys, retained technical competence, and tested contingency procedures without switching the principal supplier today.
The legal tools favor that distinction. Under EU public-procurement rules and the Dutch Aanbestedingswet 2012, relevant, proportionate requirements for portability, continuity, accessibility, or support can be assessed as characteristics of the service being bought. A categorical exclusion based on an American corporate parent raises different questions under procurement coverage and equal-treatment obligations. The research does not clear any specific nationality, jurisdiction, or security-exception rule for an actual tender. And a European contractor using American identity, update, or hosting systems may merely hide a dependency one contract further upstream.
The ICC also reminds us that technology and finance are connected without being interchangeable. The euro area already has European settlement infrastructure, including the Eurosystem’s T2 and TIPS services. But payment infrastructure does not determine whether a bank is legally able or commercially willing to serve a particular sanctioned institution. The proposed digital euro had not been issued as of the October 19 verification cutoff and would not, by itself, erase sanctions exposure. Nor does the EU’s existing Blocking Statute automatically neutralize the ICC sanctions: the Commission’s description of the measures currently listed in its annex concerns specified Cuba- and Iran-related sanctions. These are EU-level legal and financial problems, not something a Dutch ministry can solve with a different cloud contract.
The Dutch government has already adopted a much more serious digital-continuity policy than the familiar calls for ‘an exit plan’ suggest. It deserves time to implement that policy, and scrutiny proportionate to the consequences of failure. Where existing monitoring can show that the most consequential services have faced the right scenarios, no new assurance machinery is needed. Where the evidence only shows that documents have been signed or ordinary recovery has been rehearsed, responsible officials should be required to explain the residual supplier risk and make a costed decision about it. Independence cannot mean never needing another country. For essential public services, it should mean knowing exactly which dependencies the state can survive, and which ones it has consciously chosen to carry.