One attack on your IT provider hits dozens of municipalities at once

Citizen portals, administrative software, town hall: pentests with a report that serves as a basis for NIS2 and ITSiV-PV.

  • Test reports following BSI specifications
  • Experience with municipal IT and administrative software
  • Free initial consultation
Real-world incident Night of 29 to 30 October 2023

Südwestfalen-IT: more than 100 municipalities in emergency mode for weeks

  1. 01VPN access compromised
  2. 02Spread through the network
  3. 03Central systems encrypted
  4. 04Emergency mode in 100+ municipalities

It did not hit a big city with its own IT, but the normal case: municipalities with a shared provider.

Based on public reporting (including heise online). Access Granted was not involved in this incident.

One provider, many municipalities, one shared attack surface

Remote access C Municipal IT provider C Town Town Town Town Town Town A Citizen portal B Admin software D Town hall
  • Entry point
  • shared infrastructure
  • connected municipalities

A single compromised access is enough for all of them. The letters show the points where we test.

Where we start
  1. A

    Citizen portals

    Online applications for ID cards, vehicles or housing benefit: directly attackable.

  2. B

    Administrative software

    Registration, social benefits, building authority: grown over years, hard to replace.

  3. C

    Connection to the IT provider

    VPN access and segmentation. That is where Südwestfalen-IT was hit.

  4. D

    Public foot traffic at the town hall

    Open service counters and contact with citizens make pretexting easier.

Two obligations, one topic

NIS2 / BSIG

Public administration under NIS2

Federal administration under section 29 BSIG, states and municipalities under state law.

OZG / ITSiV-PV

Mandatory penetration tests for online administrative services

The ITSiV-PV requires web checks and pentests before connection and at least every three years, by the BSI, state authorities or BSI-certified providers.

Both obligations apply regardless of whether a municipality runs its own IT or sources it from a provider.

Five points that are part of every offer to a municipality

Administrative processes and procurement law run differently than in the private sector. That is why you get a list of what you can firmly expect from us.

  1. 1

    Fixed-price quote with a scope of work

    A clear scope of work, a fixed price, a traceable cost breakdown. We define the scope together beforehand.

  2. 2

    Direct-award thresholds respected

    We tailor scope and offer so they can stay below the relevant thresholds, or we provide the documents as the basis for a formal tender.

  3. 3

    Report following BSI specifications, with management summary

    The report documents web checks and penetration test following the BSI specifications, as a basis for your ITSiV-PV and NIS2 evidence.

  4. 4

    Named contact for emergencies

    For the duration of the test, a contact person is named on both sides. Should a critical risk come to light, we inform you immediately.

  5. 5

    No interruption of citizen services

    Destructive tests are ruled out, we agree test windows with you in advance, and the ongoing services for citizens remain untouched.

What we test

  • Web App Pentest

    Citizen portals and application workflows.

  • Infrastructure Pentest

    Segmentation and VPN access.

  • Social Engineering

    Phishing and pretexting.

  • Physical Pentest

    Entry to town hall and server room.

Process

  1. 1

    Scoping

    What sits with you, and what with the provider? After that, a fixed-price quote.

  2. 2

    Testing

    Manual, within the agreed scope, test windows coordinated. Critical findings are reported immediately.

  3. 3

    Report

    Every finding is rated by severity and by the impact it has on citizen services.

What you get

  • Final report as a basis for ITSiV-PV and NIS2

  • Management summary for IT leadership, department heads and administrative leadership

  • Prioritised list of measures, separated by municipality and provider

  • Certificate with reference code, verifiable online

Frequently asked questions

Is a penetration test for municipalities prescribed by law?

For services delivered through the OZG portal network, the ITSiV-PV requires web checks and penetration tests. NIS2 comes on top: for the federal level via section 29 BSIG, for states via state law; whether municipalities are covered is up to each state.

How does the engagement work given procurement law?

Our offers are suitable for direct awards below the relevant thresholds as well as the basis for a formal tender: a clear scope of work, a fixed price, a traceable cost breakdown.

Who is responsible if we source our IT from a shared provider?

We clarify that during scoping. In practice, part sits with the municipality (administrative software, endpoints, citizen office) and part with the provider (network, server operations, VPN). The test scope follows your actual responsibility, coordinated with the provider where needed.

We are a small municipality. Are we even a target?

The Südwestfalen-IT case shows the opposite: the target was the shared IT provider that more than 100 municipalities were connected to. If you run on shared infrastructure, you also share its attack surface.

Ready to test your municipality's IT security?

In 30 minutes we clarify your scope and what counts for NIS2 and ITSiV-PV. After that, a procurement-compliant fixed-price quote.

All details on the sector: access-granted.de/en/branchen/publicsector

Book a consultation Get in touch

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

© AccessGranted X GmbH Last updated: September 23, 2026