Public authorities and municipalities

BSI IT-Grundschutz provides the methodology, ISO/IEC 27001 the ISMS framework, and EN 50600 the foundation for data Center design and engineering and operations. For cloud use cases, BSI C5 is recommended. For cities and towns, ministries, authorities, associations, municipal utilities, and educational institutions, it is essential to verify the binding requirements of the organization and the applicable procurement framework.

NIS2 governs security and reporting obligations for essential and important entities in defined sectors such as energy, water, waste, and transportation. Traditional municipal administrations are not directly addressed in the current German draft, and individual states may introduce their own rules. Municipal entities in NIS2 sectors may be in scope and must establish systematic security and incident reporting management. Depending on responsibilities, this may also include waste management and street cleaning, as well as public rescue services and control centers. A case-by-case assessment is required. We are happy to support you with this.

No. KRITIS applies to operators of critical facilities based on sectors and threshold criteria. Municipal entities may be affected-for example in water and wastewater, energy, or healthcare. Pure administrative IT is usually not KRITIS. Together, we assess scope boundaries and derive measures such as physical hardening, documentation, and compliance evidence for cities and towns, associations, and municipal utilities.

A risk-based roadmap using BSI IT-Grundschutz or ISO 27001 is recommended, along with structural and technical upgrades in line with EN 50600 for energy, cooling, cabling, and security, plus clean documentation for audit and procurement. A phased migration using a micro data center or a container as an interim solution reduces downtime.

Funding often covers modernization of existing data centers, energy-efficient technologies, waste heat reuse, and replacement of outdated systems. We support program screening, cost-effectiveness assessments, and applications for cities and towns, municipal utilities, state authorities, schools, and universities.

Yes. Building and fire safety regulations as well as administrative requirements differ. State building codes and regulations for line systems must be observed, as must internal IT policies of the responsible authority. The Energy Efficiency Act is supplemented by state-specific requirements. A documented, site-specific review is necessary-for example for county administration buildings, university campuses, and district administrations-in coordination with state authorities.

The right mix depends on protection needs and availability requirements. Critical line-of-business applications and sensitive data often remain on-prem-for example in a DC IT Room or DC IT Safe. Scalable services are well suited for the cloud with C5 evidence and a clear exit strategy. DC IT Container complements hybrid scenarios, for example for temporary relocations, new-build phases, or peak loads in cities, towns, municipal utilities, universities, and municipalities. Services with very high protection requirements such as in federal and state police operations as well as fire departments are often operated locally.