Hoofdpost

What is a hoofdpost?

A hoofdpost is the central SCADA environment of a telemetry network that receives, records and displays the measurements, statuses and alarms of dispersed outstations, and from which operators monitor and control those installations remotely. The Dutch term is common in the water and energy sectors of the Netherlands: a water board supervises hundreds of pumping stations, weirs and wastewater treatment plants from a single hoofdpost, each fitted with an RTU or PLC as its outstation (onderstation). Internationally the same concept is called a master station or control centre. Because one hoofdpost controls many assets at once, it determines availability, cybersecurity, safety and operational continuity.

🧠 What does a hoofdpost do?

The hoofdpost is the operational hub between the field sites and the organisation that manages them. Data arrives over Ethernet, fibre, VPN tunnels across mobile networks, radio or, still, serial links. Its core tasks:

• Data acquisition - polling or receiving measurements, statuses, faults and counter values from every outstation
• Visualisation - process graphics, overview maps and trends for the operator through the HMI
• Alarm handling - prioritising alarms, forwarding them to the on-call engineer outside office hours and recording them in line with alarm management
• Remote operation - changing setpoints, starting pumps or moving gates; the outstation executes the command locally
• Archiving - storing time series in a historian for reporting, analysis and accountability
• Integration - passing data to MES, ERP, asset management and hydrological models
• Recording - central logging and an audit trail of operator actions

You will find hoofdposten at water boards and drinking water companies, grid operators, tunnel and bridge control, rail and road authorities, pipelines, industrial process automation and large building complexes.

🔧 What are the components of a hoofdpost?

A hoofdpost is not a single device but a coherent architecture inside a segmented OT network.

🌐 How does the hoofdpost communicate with outstations?

The hoofdpost talks to the field using telecontrol protocols designed for slow or intermittent WAN links. Traditionally the hoofdpost asks each outstation for its values in turn (polling); modern protocols let the outstation report changes itself (report by exception). After a connection is established, a full interrogation usually follows, after which mainly changes come in.

The hoofdpost also often monitors its own network devices with SNMP. IEC 104 defines default time-outs such as t1 = 15 seconds and t3 = 20 seconds and a window of k = 12 unacknowledged messages; integrators tune these values for slow mobile links. If the outstations’ clocks are not synchronised, event timestamps drift apart and post-incident fault analysis becomes unreliable.

🔄 What is the difference between a hoofdpost, a subpost and an outstation?

Large organisations often work with several layers. The outstation (onderstation or buitenpost) sits at the installation itself, a subpost (sub-master station) sometimes bundles a region, and the hoofdpost provides the central overview.

A key design principle: the outstation must keep running autonomously and safely if the link to the hoofdpost drops. The hoofdpost supervises, but it does not perform real-time control.

🏗️ Where does the hoofdpost sit in the Purdue Model?

In the Purdue Model, the SCADA function of the hoofdpost belongs to level 2 (supervisory control). Historian, reporting and operations management sit at level 3, and the link to office systems runs through a DMZ.

What makes telemetry special is that level 1 may be kilometres away. The WAN link to the outstations is a conduit in the sense of the zones and conduits model of IEC 62443 and deserves its own protection.

⚡ How do you make a hoofdpost redundant?

If the hoofdpost fails, visibility of the entire service area disappears at once. Redundancy and high availability are therefore standard requirements:

• Redundant SCADA servers in hot standby, with the standby server already holding the current process state
• Dual network paths and, where possible, two different carriers to critical outstations (for example fibre plus 4G)
• A second control location at a different geographical site, for emergencies such as fire or high water
• Emergency power with a UPS and generator for the control room and communications
• Virtualisation of servers, with replication of historian data
• Buffering in outstations, so that timestamped events still arrive once the link is restored

These requirements are laid down in business continuity and disaster recovery plans, with an agreed RTO and RPO per function.

🔐 How do you secure a hoofdpost?

A compromised hoofdpost affects every connected installation at once, which makes it an attractive target in ICS environments. Typical risks are ransomware spreading laterally from IT, abuse of supplier access, stolen operator accounts, manipulated commands and loss of telemetry links. IEC 104 and Modbus offer no authentication or encryption of their own, so security has to come from the surrounding architecture.

Access is increasingly designed around Zero Trust principles: every session is explicitly verified, including inside the OT network.

A compromise of the hoofdpost can have a direct impact on multiple remote installations simultaneously.

🏭 What does a hoofdpost look like in Dutch practice?

At Dutch water boards, the hoofdpost is the heart of operational water management. Objects such as pumping stations, weirs, fish passages and treatment plants are given an outstation that measures, controls and raises alarms locally and communicates with the hoofdpost. Water boards increasingly choose a single integrated hoofdpost for pumping stations, dike monitoring and wastewater treatment, which also feeds flood forecasting. Grid operators use a comparable set-up, with a control centre that communicates with hundreds of substations over IEC 104.

Three developments are forcing modernisation:

1. Disappearing links - analogue leased lines have been phased out (the Hunze en Aa’s water board had to replace around 130 outstations because its provider ended analogue lines after 2019), 3G has been switched off in the Netherlands and 2G will follow in the coming years. Outstations with old modems lose their connection as a result.
2. Regulation - since 15 August 2026 the Cyberbeveiligingswet and the Cyberbeveiligingsbesluit apply, the Dutch transposition of NIS2. Water managers and energy companies have a duty of care and a reporting obligation; for the water boards CERT-WM is the CSIRT, for most other sectors the NCSC. See also OT security in the water sector.
3. Vendor support - older outstation types and SCADA versions no longer receive updates, making patch management impossible.

A practical modernisation plan:

1. Record all outstations, protocols, links and firmware versions in an asset inventory.
2. Divide the environment into zones and conduits in line with IEC 62443 and choose a security level per zone.
3. Choose a future-proof carrier per object (fibre, 4G/5G or LoRaWAN for simple measuring points) and encrypt the traffic.
4. Check the alarm load: under ISA-18.2, an average of no more than one alarm per ten minutes per operator is considered very likely acceptable, and more than ten alarms in ten minutes counts as an alarm flood.
5. Test failover and recovery periodically, including the delivery of buffered events.

📈 Which developments are shaping the hoofdpost?

Hoofdposten are shifting from closed SCADA centres to data-driven platforms. Key trends are the Industrial Internet of Things and edge computing in outstations, cloud-based monitoring for non-critical functions, Industrial AI for forecasting, a digital twin of the water system and further OT convergence. At the same time, attention to cyber resilience and supply chain security is growing. Standards such as ISO 27001, NIST SP 800-82 and IEC 62443-3-3 provide the framework, and for critical infrastructure the bar is highest.

❓ Frequently asked questions

Is a hoofdpost the same as a SCADA system?

A hoofdpost is the central environment in which the SCADA system runs, including operator positions, historian, network and communications. SCADA is the software that processes the data; the hoofdpost is the whole in which that software, the operators and the outstations come together.

What is an outstation in telemetry?

An outstation is the RTU or PLC at a pumping station, weir or substation that collects measurements, controls locally and communicates with the hoofdpost or master station. The outstation keeps working autonomously if the link to the hoofdpost drops.

Which protocol does a hoofdpost use?

In the European energy sector a hoofdpost usually uses IEC 60870-5-104, while in North America DNP3 is the norm. Dutch water boards also use Modbus, vendor-specific telemetry protocols and, increasingly, MQTT or OPC UA.

Why is a hoofdpost an attractive target for attackers?

Through a hoofdpost an attacker can view and operate many installations at once, while classic telecontrol protocols have no authentication. Segmentation, encrypted links, MFA for remote access and monitoring of telemetry traffic are therefore essential for every hoofdpost.

What happens if the hoofdpost fails?

If the hoofdpost fails, the outstations continue to control locally according to their own programs, but the central overview and remote operation are lost. That is why a hoofdpost has redundant servers, a second control location and event buffering in the outstations.

Does a hoofdpost fall under the Dutch Cyberbeveiligingswet?

A hoofdpost falls under the Cyberbeveiligingswet when the organisation is an essential or important entity, such as a water board, drinking water company or grid operator. The duty of care then also covers the network and information systems of the hoofdpost, and significant incidents must be reported.

📌 In summary

A hoofdpost is the central SCADA environment where measurements, alarms and commands from dispersed outstations come together. It runs at levels 2 and 3 of the Purdue Model, communicates through protocols such as IEC 60870-5-104 and DNP3, and requires redundancy, segmentation and encrypted links. Disappearing analogue and mobile links and the Cyberbeveiligingswet make modernisation urgent for Dutch water boards and grid operators.

A hoofdpost is the nerve centre of a telemetry network: whoever keeps it available and secure protects every connected installation at once.