What is NORA?
NORA (Nederlandse Overheid Referentie Architectuur, the Dutch Government Reference Architecture) is the national reference architecture that uses shared principles, quality goals, concepts, standards and building blocks to guide how Dutch government organisations set up their digital services, so that they can cooperate, exchange data and serve citizens and businesses reliably. NORA is not a system or a piece of software but a shared set of architecture agreements. ICTU maintains NORA on behalf of the Digital Government directorate of the Ministry of the Interior and Kingdom Relations (BZK), and the content has been publicly available as a wiki, NORA Online, since 2013.
NORA is the common starting point on which sector architectures such as GEMMA (municipalities), WILMA (water authorities), PETRA (provinces) and MARIJ (central government) build.
🧠 Why does NORA exist?
The Dutch government consists of hundreds of independent organisations: ministries, executive agencies, municipalities, provinces and water authorities. Without common agreements, each of them builds its own systems with its own concepts and interfaces. NORA prevents this with four aims:
- Create coherence - between government domains, chains, services and systems
- Encourage reuse - of solutions, standards and generic facilities
- Translate policy - from legislation and policy goals into organisational and technical requirements
- Promote interoperability - so that data can flow between organisations without custom work
NORA focuses explicitly on services to citizens and businesses. A citizen should not need to know which organisation is behind a service; the architecture is meant to make that invisible.
📜 How did NORA come about?
| Period | Milestone |
|---|---|
| 2006 | ICTU publishes early versions of NORA as an architecture for “electronic government”, aimed mainly at architects |
| 2007 | The BZK state secretary asks for a new, more widely applicable version |
| 2009 | NORA 3.0 is presented and made the leading reference for information architectures across the whole government domain |
| 2013 | NORA moves to a public wiki (NORA Online) that the NORA community maintains together |
| 2023 | From 1 January, core values, quality goals and 17 architecture principles replace the old basic and derived principles, following a NORA User Council decision in 2022 |
NORA has been aligned with the European Commission’s European Interoperability Framework (EIF). A 2016 European assessment rated the alignment as strong, with multilingualism as the main exception.
🧱 How is NORA structured?
The core of NORA consists of the Verbindende Architectuurafspraken (connecting architecture agreements) and an elaboration of the five-layer model (vijflaagsmodel). This model arranges architecture questions from legislation down to technology:
| Layer | What is it about? | Example |
|---|---|---|
| Foundation layer | Legislation, policy and administrative agreements | AVG, BIO, Digital Government Act (Wdo) |
| Organisational layer | Services, processes, roles and cooperation in chains | Who delivers which service to whom? |
| Information layer | Concepts, data and information models | Base registers such as BRP and BAG |
| Application layer | Applications, their functions and interfaces | Case management systems, data services |
| IT infrastructure layer | Networks, platforms and generic facilities | Diginetwerk, hosting, Logging |
The five-layer model maps neatly onto the familiar split into Business Architecture, Information Architecture, Application Architecture and Technical Architecture, and can be modelled in ArchiMate or placed within a TOGAF approach.
NORA also shares reference sets of concepts, standards and building blocks. A building block is a reusable component that can be used in different contexts. Examples include DigiD, eHerkenning, MijnOverheid, Digikoppeling, Digipoort, Diginetwerk and the base registers (BRP, BAG, BRK, BGT, BRO, Trade Register). Which building blocks belong to the Generic Digital Infrastructure (GDI) is decided by the GDI Programming Council.
🎯 Which principles and quality goals does NORA use?
NORA defines 17 architecture principles (NAP01 to NAP17). Each principle contributes to one or more of 20 quality goals, which derive from five core values: Trust, Secure, Future-oriented, Effective and Efficient.
| Principle | Name | Relevance for IT/OT |
|---|---|---|
| NAP06 | Reuse before buy before build | Generic facilities instead of bespoke integrations per installation |
| NAP07 | Build services modularly | Separate layers for data, analytics and control |
| NAP08 | Standardise where possible | Open standards such as OPC UA instead of proprietary protocols |
| NAP10 | Treat data as the foundation | Measurement data as a reliable, reusable source |
| NAP12 | Obtain information at the source | Fetch data from the measuring point, not from copies |
| NAP13 | Manage risks continuously | Ongoing risk assessment, including for OT assets |
| NAP14 | Always verify | Fits Zero Trust: no implicit trust |
| NAP16 | Avoid unnecessary complexity | Simple, auditable interfaces between IT and OT |
The core value Secure covers the quality goals available, integrity and confidential: the classic triad of information security. The principle names above are English renderings of the official Dutch names.
🔁 How does NORA relate to GEMMA, WILMA, PETRA and MARIJ?
NORA is the national framework; domain architectures elaborate it for their own sector. Together they form the NORA Family, a community of architects and architectures in the public sector without a strict hierarchy.
| Architecture | Audience | Notes |
|---|---|---|
| GEMMA | Municipalities | Municipal model architecture, maintained by VNG Realisatie |
| WILMA | Water authorities | Reference architecture for the water authorities, with many OT touchpoints |
| PETRA | Provinces | Provincial enterprise and reference architecture |
| MARIJ | Central government | Government-wide model architecture from 2008; now marked as superseded on NORA Online |
NORA is often called the parent architecture. That is true in substance, but formally sector architectures build on NORA without a binding ranking.
🔐 How does NORA support information security?
NORA itself contains no security controls, but it links architecture to the applicable frameworks:
- BIO - the Baseline Informatiebeveiliging Overheid is the mandatory security baseline; NORA places it in the foundation layer
- Security by Design and Privacy by Design - principles such as Apply purpose limitation (NAP11) and Always verify (NAP14) enforce security and privacy at the design stage
- Standards - NORA refers to open standards such as Digikoppeling and PKIoverheid for secure data exchange and authentication
- Legislation - since 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet) and its implementing decree, the national transposition of NIS2, also apply to many public bodies
NORA explicitly sets out how public services can be offered securely, reliably and lawfully.
🏭 What does NORA mean for OT and IT/OT convergence?
NORA was written primarily for IT within government, but many public bodies also run OT: water authorities with pumping stations and treatment plants, Rijkswaterstaat with locks, bridges and tunnels, municipalities with traffic control systems and street lighting. This is exactly where OT convergence meets NORA.
Typical touchpoints:
- Smart city - sensors, traffic lights and cameras that feed data into municipal platforms
- Water management - Embedded controllers and SCADA systems whose measurement data must reach policy and information systems
- Asset data - linking OT asset information to base registers and geographic data
| Challenge | How NORA helps |
|---|---|
| OT security | The BIO as a baseline, supplemented by OT-specific measures such as segmentation based on the Purdue Model |
| IT/OT interoperability | The five-layer model to describe interfaces, data flows and responsibilities |
| Uniform data use | Shared concepts and information models, including for IoT data |
| One-way data flow | The principle Obtain information at the source combined with a data diode or an edge layer |
🛠 How do you apply NORA in an IT/OT project?
A practical approach for, say, a water authority that wants to unlock telemetry from its pumping stations:
- Record the foundations - which laws and frameworks apply? Think of the BIO, the AVG, the Cybersecurity Act and the sector architecture (WILMA).
- Describe the service and chain - who uses the data (water level management, policy, the public) and who owns it?
- Model concepts and data - use existing information models instead of your own definitions.
- Choose interfaces - open standards and building blocks over custom work (NAP06 and NAP08).
- Build security into the design - separate the control network from office IT, restrict traffic towards OT and manage access through IAM.
- Review and adjust - align with the architecture function and record deviations; NAP17 calls for cyclical quality management.
For the OT side itself, sector-specific security guidance and IEC 62443 remain leading; NORA makes sure those choices fit the wider government picture.
❓ Frequently asked questions
Is NORA mandatory for government organisations?
In 2009 the BZK state secretary made NORA the leading reference for information architectures across the whole Dutch government. In practice, government organisations apply NORA through their sector architecture, such as GEMMA or WILMA. Deviating is possible but has to be justified.
Who maintains NORA?
NORA is maintained by ICTU on behalf of the Digital Government directorate of the Ministry of the Interior and Kingdom Relations (BZK). The NORA User Council, with representatives from different tiers of government, steers its further development.
What is the difference between NORA and GEMMA?
NORA is the national reference architecture for the entire Dutch government. GEMMA is the municipal elaboration of it, with concrete process models, application functions and information models for municipalities.
How many architecture principles does NORA have?
NORA has 17 architecture principles, numbered NAP01 to NAP17, such as Reuse before buy before build and Always verify. Since 1 January 2023 they have replaced the earlier set of basic and derived principles, and they are linked to 20 quality goals.
Can NORA be used for operational technology?
NORA was written for IT and public services, but its principles apply just as well to the OT data that public bodies use. Securing the control systems themselves requires additional OT standards such as IEC 62443.
Where can you find the current version of NORA?
The current NORA is published as a public wiki, NORA Online, where the NORA community maintains principles, concepts, standards and building blocks. There is no longer a static document; the wiki is the source.
📌 In summary
NORA is the shared reference architecture of the Dutch government: 17 principles, 20 quality goals and a five-layer model that enable cooperation, reuse and secure data exchange.
Sector architectures such as GEMMA, WILMA and PETRA elaborate NORA for their own domain. Where public bodies operate OT, from pumping stations to traffic lights, NORA provides the framework to link IT and OT responsibly, within the administrative and legal context of government.