Why Government-related organisations (provinces, water boards) are extra vulnerable to data loss
What makes government-related organisations (provinces, water boards) data a high-value target — and what happens when it's gone
Government-related organisations (provinces, water boards) store some of the most sensitive data in their field — including policy documents | public administration records | environmental data. This combination of confidential records, long statutory retention obligations, and day-to-day reliance on software like Zaaksysteem (ZGW) makes them a prime target for cybercriminals.
Ransomware groups increasingly target organisations that cannot afford downtime — and government-related organisations (provinces, water boards) fit that profile exactly. A firm that loses access to its policy documents cannot operate. Deadlines are missed, regulatory obligations are breached, and clients lose trust. Under Archiefwet, data must be retained for 10–75 years depending on document type — meaning a data loss event does not just disrupt operations today, it creates legal liability that extends years into the future.
The risk is not abstract. Loss of public administration records, ransomware on citizen-facing systems, non-compliance with archiefwet audit is the leading threat for this sector. Files with characteristics like mix of structured (databases) and unstructured (documents, gis layers) | public transparency obligations are difficult or impossible to reconstruct from memory once lost. Every day without a verified, offsite backup is a day of unnecessary exposure.
- Government-related organisations (provinces, water boards)
- Policy documents
- BIO
The misconception that costs many government-related organisations (provinces, water boards) dearly
"Government data is stored centrally by the national government — local backups are not our responsibility."
It is easy to understand why many government-related organisations (provinces, water boards) believe this. Zaaksysteem (ZGW) is marketed as a professional-grade platform, and vendors naturally emphasise uptime and reliability. But there is a critical difference between redundancy and recovery. A system can be highly available and still offer you zero protection the moment ransomware encrypts your files or an administrator accidentally deletes a directory.
Synchronisation tools — including those built into Zaaksysteem (ZGW) — propagate changes in near real-time. When ransomware encrypts a file, that encrypted version immediately overwrites your 'backed up' copy. By the time the attack is discovered, every sync destination contains the same unusable data. This is not a backup. It is a perfectly synchronised disaster.
The practical consequence: without an independent, immutable backup, government-related organisations (provinces, water boards) facing a ransomware attack have two options — pay the ransom or start over. Neither is acceptable when Archiefwet requires you to demonstrate full data integrity to regulators.
Zaaksysteem (ZGW) does not protect your policy documents. A proper backup does.
What do I need to back up if I use Zaaksysteem (ZGW)?
The data government-related organisations (provinces, water boards) typically overlook when using Zaaksysteem (ZGW)
Zaaksysteem (ZGW) manages your day-to-day workflow, but its built-in data protection typically covers only what happens within the application itself. It does not automatically back up your entire data environment — and there are several categories of data that fall outside its scope entirely.
For government-related organisations (provinces, water boards) using Zaaksysteem (ZGW), the following should be included in any proper backup: policy documents, public administration records, environmental data, citizen communication. If you also use OpenZaak, any data in those systems must be covered separately.
Pay particular attention to mix of structured (databases) and unstructured (documents, gis layers) | public transparency obligations. These file types are either difficult to reconstruct or subject to strict legal retention requirements. A backup strategy that does not explicitly cover them is incomplete — and potentially non-compliant.
- Government-related organisations (provinces, water boards)
- Policy documents
- Zaaksysteem (ZGW)
What a proper backup actually does
The 3-2-1 rule — and why it matters for government-related organisations (provinces, water boards)
The 3-2-1 rule is the baseline standard for data resilience: keep at least 3 copies of your data, on 2 different types of storage media, with 1 copy stored offsite. For government-related organisations (provinces, water boards), this is not just best practice — it is increasingly a regulatory expectation under frameworks like Archiefwet.
In practice: your primary production data counts as copy 1. A local backup (on a NAS or secondary server) is copy 2, enabling fast recovery without waiting for a cloud download. Copy 3 is stored in an offsite data centre — physically and logically separated from your main environment, so a fire, flood, or ransomware attack cannot reach all three copies simultaneously.
Mindtime extends this to a 4-copy model, with an additional snapshot stored in a second Dutch data centre. For government-related organisations (provinces, water boards) managing policy documents, this means your data is always recoverable — from a clean, pre-attack restore point — regardless of what happens on-site.
A backup sitting in the same office as the server it protects is not a backup. It's a false sense of security.
How do government-related organisations (provinces, water boards) protect themselves against ransomware?
Specific measures for government-related organisations (provinces, water boards) — beyond antivirus
Ransomware attacks on government-related organisations (provinces, water boards) typically follow a predictable pattern: initial access via a phishing email or compromised credential, lateral movement to identify high-value data, and then encryption of everything — including network shares and connected backup drives.
The single most effective defensive measure is an immutable offsite backup — one that ransomware cannot reach. Beyond backup, government-related organisations (provinces, water boards) should implement: multi-factor authentication on all systems (particularly Zaaksysteem (ZGW)), regular software updates and patch management, network segmentation to limit lateral movement, and staff awareness training on phishing recognitions.
Critically, a backup is only useful if it has been tested. Many organisations discover during a recovery that their backup is incomplete, out of date, or corrupted. Mindtime performs automated integrity checks on every backup and alerts you if a backup fails — so you know your data is recoverable before you need it, not during a crisis.
How do I create a backup if I use Zaaksysteem (ZGW)?
A practical guide for government-related organisations (provinces, water boards) using Zaaksysteem (ZGW)
Setting up a proper backup for government-related organisations (provinces, water boards) using Zaaksysteem (ZGW) (and OpenZaak if applicable) involves more than activating the export function in your software. Here is the practical approach:
First, identify all data that must be retained under Archiefwet — including policy documents | public administration records | environmental data. Map every location where this data lives: within Zaaksysteem (ZGW), on local drives, on shared network folders, and in any integrated third-party tools.
Second, configure Mindtime's agent on each endpoint and server that holds government-related organisations (provinces, water boards) data. The agent performs incremental backups continuously, so you are never more than a few minutes behind your last recovery point. Backup frequency, retention periods, and encryption settings are all configured to meet your specific regulatory requirements.
Third, run a test restore within the first week. Verify that policy documents and other critical data types can be recovered fully and within your acceptable downtime window. Document the process so your team knows exactly what to do if an incident occurs.
Data retention and compliance obligations for government-related organisations (provinces, water boards)
Archiefwet and what it means for your backup strategy
Government-related organisations (provinces, water boards) operate under some of the most specific data retention obligations in their field. The primary framework is Archiefwet, which sets clear requirements for how long policy documents must be kept, in what format, and with what level of accessibility.
Key retention requirements for government-related organisations (provinces, water boards):
— 10–75 years depending on document type (Archiefwet)
— Permanent for some policy categories
Beyond retention duration, these regulations also require that data remains accessible and verifiable throughout the retention period. A backup that cannot be searched, exported, or audited does not satisfy the requirement. Mindtime's backup platform includes point-in-time restore, meaning you can retrieve any version of a file at any point within the retention window — exactly what regulators require during an audit.
Certification under BIO demonstrates that your data protection processes meet a recognised standard — which regulators and clients increasingly expect.
10–75 years depending on document type — the minimum retention period for policy documents under Archiefwet. Your backup must last at least that long.
- Government-related organisations (provinces, water boards)
- Archiefwet
- BIO
Five steps to get this sorted
A practical checklist for government-related organisations (provinces, water boards) implementing a proper backup strategy
Map all data locations
List every location where government-related organisations (provinces, water boards) data lives — Zaaksysteem (ZGW), local drives, shared folders, integrated tools. Do not assume any single system covers everything.
Define retention requirements
Check your obligations under Archiefwet. Identify which data types need to be kept for how long, and make sure your backup configuration reflects those requirements explicitly.
Configure automated backup
Install Mindtime on every relevant endpoint and server. Set backup frequency, retention windows, and encryption. Confirm that policy documents
Run a test restore
public administration records are all covered.
Document and review quarterly
Within the first week, perform a full test restore of your most critical data. Verify it opens, is complete, and matches the original. This is the only way to confirm your backup actually works.
Your questions answered
Frequently asked questions about backup for government-related organisations (provinces, water boards)
Zaaksysteem (ZGW) offers file synchronisation and some redundancy, but this is not a backup. If files are encrypted by ransomware or deleted, that change is synced immediately — meaning your 'backup' copy is equally affected. An independent, immutable backup is essential.
Under Archiefwet, the minimum retention period is 10–75 years depending on document type. Mindtime handles this automatically with configurable retention policies per data type.
With a proper 3-2-1 backup, you restore from a clean pre-attack snapshot — typically within 2-4 hours with Mindtime's hybrid approach. Without a proper backup, your only options are paying the ransom or starting from scratch.
Yes. Mindtime is ISO 27001 certified and stores all data exclusively on Dutch servers, ensuring compliance with GDPR/AVG and Archiefwet.
Most organisations using Mindtime's hybrid backup (local + cloud) can restore critical data within 2-4 hours, depending on data volume.