Discuss your project

TOOLBOX · COMPLIANCE & NIS2

Maturity Check Municipalities.

How well is your municipal office protected? 13 questions based on the BSI profile for municipal administrations, IT-Grundschutz and the GDPR, with an immediate maturity level and a measure, reason and source for every gap.

13 Questions for Municipalities

0 of 13 answered

Stays in your browser: your answers are neither sent nor stored. They are gone when you close the page; print the report or save it as a PDF.

Answer Yes, Partially or No for each measure. Below each question it says what “Yes” means. If you do not know, choose No: a measure that nobody can confirm does not count as implemented.

  1. Question 1: Has the municipal leadership appointed a person to drive information security and given them time and resources for it?

    OrganizationImportant measure

    Yes means: the person is appointed, ideally in writing, knows their tasks, has time and resources for them and can report directly to the mayor or the head of administration when needed. The role may be combined with other tasks.

  2. Question 2: Has the municipality appointed a data protection officer, and is this person involved in security matters?

    OrganizationFoundation

    Yes means: appointed, contact details published and communicated to the Data Protection Authority, and the person is involved in new procedures, service providers and incidents. The officer can also be external or shared by several municipalities.

  3. Question 3: Is there an up-to-date overview of all locations, IT systems, specialist applications and service providers, from the municipal office to the building yard and the kindergarten?

    OrganizationFoundation

    Yes means: the overview is complete, names a responsible person and provider for each entry and is updated whenever something changes.

  4. Question 4: Are user accounts and permissions granted according to a fixed process and revoked immediately when a person changes roles or leaves?

    Accounts and AccessImportant measure

    Yes means: every account belongs to exactly one person, permissions follow the task, it is documented who has which permissions, and accounts and permissions no longer needed are removed promptly when someone changes roles or leaves.

  5. Question 5: Do administrators, including those of your IT service provider, use separate admin accounts that are not used for everyday email and internet?

    Accounts and AccessImportant measure

    Yes means: everyday work runs without administrator rights, admin IDs are separate from everyday IDs, and administration roles are defined.

  6. Question 6: Is sign-in with a second factor set up for email, cloud services and access from outside?

    Accounts and AccessKey measure

    Yes means: besides the password, all of this access requires a second factor, such as a confirmation in an app, a security key or a smart card.

  7. Question 7: Are operating systems, programs and network devices such as firewalls and routers updated promptly according to a defined process, with clear responsibility?

    Systems and NetworkKey measure

    Yes means: it is defined who assesses and installs updates, automatic updates are set deliberately, and devices without vendor support are replaced unless they can demonstrably still be operated securely.

  8. Question 8: Is up-to-date malware protection active on all workstations and servers that employees cannot switch off, and does everyone know whom to contact in case of suspicion?

    Systems and NetworkImportant measure

    Yes means: professionally managed malware protection on all devices, settings locked for users, a contact person for suspected cases known.

  9. Question 9: Is data backed up regularly according to a plan, is at least one backup stored separately and protected against overwriting, and do you test recovery?

    Data and BackupKey measure

    Yes means: there is a backup plan, one copy is stored at another location and cannot be overwritten intentionally or unintentionally, and recovery is tested regularly, most recently successfully.

  10. Question 10: Does all remote maintenance by service providers run through known, encrypted access, is it recorded and is it regulated by contract?

    Service ProvidersKey measure

    Yes means: all remote maintenance access is documented and limited to what is necessary, connections are disconnected after the session, sessions by third parties are recorded, and the contract regulates security.

  11. Question 11: For cloud services and outsourced IT, are the security requirements, a data processing agreement and an orderly exit regulated by contract?

    Service ProvidersImportant measure

    Yes means: for every service there is a contract with security requirements and audit rights, a data processing agreement where personal data is processed, and a rule for returning data and exiting.

  12. Question 12: Is it defined what counts as a security incident, who then decides, who must be informed and how operations are restored securely?

    Incidents and EmergenciesImportant measure

    Yes means: a short policy known to everyone names those responsible and current contacts and also covers notification of the Data Protection Authority.

  13. Question 13: Are the municipal leadership and employees regularly made aware of and trained in information security, for example on phishing and passwords?

    PeopleImportant measure

    Yes means: new employees receive an introduction, everyone is trained on an ongoing basis, and leadership visibly supports the training.

0 of 13 answered

HOW THE CHECK CALCULATES

Traceable
Instead of Gut Feeling.

13 questions, at most 28 points. The measures are based on the sources named, and individual implementation examples are recommendations by TOMORIS; weights and levels are an assessment by TOMORIS based on the effect of a measure.

  • 01

    Answers Become Points

    Yes counts 1, Partially 0.5 and No 0 points, each multiplied by the weight of the question. If you do not know, choose No.

  • 02

    Weight by Effect

    Key measure (3, here 4×): Directly protects against the most serious consequences of an attack or outage: data loss, standstill or the takeover of accounts and access. Important measure (2, here 7×): Makes an incident less likely or limits its extent and duration. Foundation (1, here 2×): Organizational prerequisite that works through the other measures, such as responsibility, overview or documentation.

  • 03

    Percentage and Level

    Points reached divided by possible points, rounded down to whole percent. Level 1 Getting Started: 0 to 39 percent. Level 2 Foundations: 40 to 69 percent. Level 3 Advanced: 70 to 89 percent. Level 4 Established: from 90 percent.

  • 04

    Key Measures Set a Limit

    If a key measure is answered with No, the maturity level stays at level 2 at most, even if the percentage is higher. The report lists the open measures sorted by weight.

BASIS

What the
Questions Are Based On.

Under Section 24(3) NISG 2026, municipalities and associations of municipalities are not entities in the public administration sector. Whoever supplies drinking water or collects, disposes of or treats wastewater in the municipality, whether the municipality itself, a municipal company or an association, may still be covered as an entity of another sector; check this separately with the NIS2 check.

The GDPR applies to every municipality: appropriate technical and organizational measures under Article 32 and, as a public body, a data protection officer under Article 37.

The questions follow the IT-Grundschutz profile “Basic protection for municipal administration”, version 4.0 of 13 November 2023. It was developed by the working group on basic municipal protection (AG koBA) with the support of the German Association of Cities, the German County Association and the German Association of Towns and Municipalities, is published by the German Federal Office for Information Security (BSI) and describes minimum measures as a starting point. It is not a legal obligation in Austria, but a model that transfers well.

More on the Municipalities industry · NIS2 Applicability Check (German) · All Downloads

QUESTIONS

Good to Know.

How is the maturity level calculated?

Each answer gives points: Yes 1, Partially 0.5, No 0, multiplied by the weight of the question (key measure 3, important measure 2, foundation 1). This checklist has 13 questions and at most 28 points. The points reached give a percentage, rounded down, which determines the level: level 1 Getting Started 0 to 39 percent, level 2 Foundations 40 to 69 percent, level 3 Advanced 70 to 89 percent, level 4 Established from 90 percent. If a key measure is answered with No, the maturity level stays at level 2 at most.

Where do the questions come from?

From the IT-Grundschutz profile “Basic protection for municipal administration”, version 4.0 of 13 November 2023, developed by the working group on basic municipal protection (AG koBA) with the support of the German municipal umbrella associations and published by the German Federal Office for Information Security (BSI), supplemented by the IT-Grundschutz Compendium, Edition 2023, the BSI recommendation on two-factor authentication and the GDPR. The profile is German and not a legal obligation in Austria, but describes minimum measures that transfer well. Every question names its citation.

Does NIS2 apply to municipalities?

Not as an entity in the public administration sector: municipalities and associations of municipalities are exempt under Section 24(3) NISG 2026. Whoever supplies drinking water, collects, disposes of or treats wastewater, or collects or treats waste in the municipality, whether the municipality itself, a municipal company or an association, may however be covered as an entity of the type listed in Annex 1 or 2: as a rule from the size of a medium enterprise (Sections 24 and 25), regardless of size also after classification by the cybersecurity authority (Section 26) or as a critical entity. Not covered is anyone for whom wastewater disposal is only a non-essential part of their general activity or whose main activity is not waste management; this may apply precisely to the municipality itself. Whether your municipality or its operations are covered can be checked with the NIS2 applicability check.

Is the result proof or legal advice?

No. The check is a self-assessment based on your answers. It does not replace an audit or legal advice and does not prove that legal or professional requirements are met. The weights and levels are an assessment by TOMORIS; the measures are based on the sources named, and individual implementation examples are recommendations by TOMORIS.

Are my answers transmitted or stored?

No. The questionnaire and evaluation run entirely in your browser; your answers are neither transmitted to TOMORIS nor to third parties and are not stored, not even on your device. Only when you choose “Discuss the Result” does the contact form take over industry and maturity level as the topic, not your individual answers.

How do I save the report as a PDF?

In the report, choose “Print or Save as PDF” and select “Save as PDF” or “Microsoft Print to PDF” as the printer in the print dialog. Only the report is printed, in light colors even in dark mode.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result