The security story for Drupal is quite good from the government perspective. It is used by many serious organizations, so there are a lot people to find bugs and problems. The Drupal community have a formalized standing security committee who cover the core code and the most commonly used modules. They issue security patches on a predictable, regular schedule. And many of the core developers are employed by one company--Acquia--who sells enterprise software support subscriptions.

That checks a lot of boxes for enterprises in general, and governments in particular.

Plus it is a very powerful framework but is way cheaper than "traditional" license-based enterprise solutions like Oracle CMS. And it's open source, which is citizen-friendly and gives governments better long-term ownership of their technology.

Finally, although Drupal developers are their own sort of special flower (hopefully changing with Drupal 8), there are a lot of them and a lot of companies that provide Drupal development. So if you have to fire a vendor, you'll be able to find another one to step in without too much fuss.

All can't be right because at least the system of the German federal government "Government Site Builder" is based on CoreMedia 8, which is a Java CMS.

> All European government websites are also built on Drupal.

I know at least one that isn't: https://gov.uk/

They also open-source all their stuff: https://github.com/alphagov