TOOLBOX · DOWNLOAD
A securemunicipaloffice.
Municipal offices process citizens’ personal data every day, often with little in-house IT staff and many external service providers. This checklist brings together basic protection for municipalities: who is responsible, what overview is needed, how accounts, updates, malware protection and data backup should be managed, what to look out for with remote maintenance, cloud and outsourcing, and whom to contact in an incident. It is based on the Austrian Information Security Handbook, the BSI profile Basis-Absicherung Kommunalverwaltung (basic protection for municipal administration) and the GDPR, and explains the role the NISG 2026 plays for municipalities.
Free PDF · Checklist
Information Security in the Municipality: Checklist for Basic Protection
- Format
- PDF, A4
- Length
- 8 pages
- Size
- 108 KB
- Updated
- Oct 25, 2026
- Sources
- 10
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
Responsibility, overview, accounts, updates, data backup, service providers and reporting points, based on the BSI municipal profile and the Austrian Information Security Handbook.
- Mayors who bear the responsibility
- Municipal office directors who organize procedures and responsibilities in the municipal office
- Municipal IT and IT service providers for municipalities
- Municipal associations and small public institutions
8 SECTIONS
What Is
Inside.
- 01
Starting point for municipalities
What applies legally and which guides help
- 02
Responsibility and organization
Who is responsible, even when one person has several roles
- 03
Overview of systems, procedures and partners
What you need to know before you can protect it
- 04
Accounts, updates, malware, data backup
Technical basic protection according to the BSI modules
- 05
Remote maintenance, cloud and external service providers
Responsibility remains with the municipal office
- 06
Security incidents and reporting points
Whom to notify and how you are prepared
- 07
Involving employees
Awareness, onboarding, offboarding and working from home
- 08
Roadmap in five steps
From getting started to ongoing security management, TOMORIS recommendation
EXCERPT
Accounts, updates, malware, data backup
| Area | What should be in place | Module |
|---|---|---|
| Accounts and rights | Set up and delete users in a controlled manner, grant, change, revoke and document permissions, separate functions, regulate password use and login; everyone instructed in the login procedures | ORP.4.A1 to A9, A22, A23, A19 |
| Administration | Controlled administration, separate roles for application and system administration; external administrators also implement the module | OPS.1.1.2 |
| Updates | Concept for patches and changes, responsibilities, handling of automatic updates, regular updating | OPS.1.1.3.A1 to A3, A15 |
| Malware | Antivirus protection that users cannot disable; employees know the contact person in case of suspicion | OPS.1.1.4 |
| Data backup | Identify influencing factors, define procedures and plans, back up regularly, protect and securely store backups, test regularly; take local hazards such as flooding into account for the storage location | CON.3.A1, A2, A4, A5, A12, A14, A15 |
| Encryption and deletion | Cryptographic concept for personal data and communication; controlled deletion and destruction | CON.1, CON.6 |
Check your data backup with a copy that is separated from attacks and disruptions in the municipal office, and test the restore. The TOMORIS backup checklist 3-2-1-1-0 contains details on the procedure.
SOURCES
Supported
by Sources.
- NISG 2026, BGBl. I No. 94/2025, current version in the RIS (opens in a new tab)§ 8 para. 4, § 24 para. 3, § 46, accessed October 25, 2026
- Directive (EU) 2022/2555 (NIS 2 Directive), German version on EUR-Lex (opens in a new tab)Art. 2(5)(a), accessed October 25, 2026
- Regulation (EU) 2016/679 (GDPR), German version on EUR-Lex (opens in a new tab)Art. 28, 32, 33 and 37, accessed October 25, 2026
- Austrian Data Protection Authority: data breach notification (opens in a new tab)Reporting channels and form, accessed October 25, 2026
- Austrian Information Security Handbook, version 4.4.0 (November 6, 2023), Federal Chancellery and A-SIT (opens in a new tab)Introduction and management summary, accessed October 25, 2026
- BSI: IT-Grundschutz profile Basis-Absicherung Kommunalverwaltung, version 4.0 (November 13, 2023) (opens in a new tab)Sections 5, 6 and 9.1, accessed October 25, 2026
- BSI IT-Grundschutz-Kompendium, module DER.2.1 Handling Security Incidents (Edition 2023) (opens in a new tab)Basic requirements A1 to A6, accessed October 25, 2026
- GovCERT Austria: home page, reporting of other incidents, participation and services (opens in a new tab)Mission, reporting address, participation in information exchange, accessed October 25, 2026
- CERT.at: About us (opens in a new tab)Role as national CERT, contact, accessed October 25, 2026
- Federal Criminal Police Office: Cybercrime Competence Center and reporting point against cybercrime (opens in a new tab)Reporting point for cybercrime, accessed October 25, 2026
This checklist is a TOMORIS recommendation and does not replace legal advice. The BSI profile comes from Germany and serves as a model. The GDPR, the NISG 2026 and the state and federal law applicable to your municipality in their current versions are decisive; whether municipally owned entities fall under the NISG 2026 must be reviewed case by case.
TOOLBOX
Explore
Further.
- Kostenlos
NIS2 applicability check (German)
Am I affected? In 3 minutes
Check Now IT for municipalities
Support for municipal IT for the municipal office, building yard, school and kindergarten by TOMORIS.
Learn MoreBackup checklist 3-2-1-1-0
Data backup according to the 3-2-1-1-0 rule with offline copy and restore test.
Learn MoreIT emergency manual
Template with outline, contact lists, recovery order and exercise plan to fill in.
Learn More
MUNICIPALITIES & PUBLIC SECTOR
More on
This Topic.
- PDF
NIS2 and Municipalities
Municipalities and municipal associations are excluded from the public administration sector. When their operations still fall under the NISG 2026 and what applies anyway, with legal references.
View - PDF
Accessible Municipal Website
Which provincial law applies to your municipal website, what the accessibility statement must contain, which content is exempt, and what you check on the website.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.