What Municipal Utilities Show Us – Structured Security with Open Source

Municipal utilities and energy suppliers carry a big responsibility: electricity, water and heat should flow reliably. That's why they take IT security especially seriously and work with clear structures. The exciting part: many of these ideas also work in a small business – and open source can be a practical helper.

How energy suppliers approach security

Many utilities work with an information security management system (ISMS). It sounds technical, but at its core it's a simple cycle:

1. Plan: Which systems and data are there, and what could go wrong?
2. Do: Introduce suitable safeguards.
3. Check: Regularly verify that everything works.
4. Improve: Learn from experience and adjust.

The basis for this is often ISO 27001 or the BSI's IT-Grundschutz. Energy suppliers also have their own requirements, including from the implementation of the EU NIS2 directive.

What helps on a small scale

You don't have to be a utility to benefit from this cycle:

Where open source supports you

Open-source software is used by many organisations with high security requirements. For small businesses, these advantages are especially interesting:

• Choose your location: You know where your data is.
• Updates in your hands: You decide when and how things get updated.
• Traceable: Configurations are easy to document.
• Switchable: Open standards make you independent of individual providers.

Typical building blocks are Nextcloud for files, Element for communication, Vaultwarden for passwords and Keycloak for logins. You'll find more under Alternatives.

A relaxed way in

Just start small. An inventory, a few good habits and a short emergency plan already go a long way. If you'd like support: as an external information security officer, I also work with small businesses – more under Consulting.

A few terms, briefly explained

• ISMS: Information security management system – the structured framework for security in an organisation.
• ISO 27001: An international standard for building and certifying an ISMS.
• Risk analysis: Assessing what could happen, how likely it is and how bad the consequences would be.
• Information security officer: A person who takes care of the topic, gives advice and keeps the overview – internally or externally.

An example from a small business

An engineering firm with ten people works for clients in the energy sector. These clients increasingly ask how the firm handles information security. So the firm sets up a small, lean security management:

1. One person takes responsibility, supported by an external information security officer.
2. A list of all systems and services is created.
3. Measures are defined for the main risks – such as backups, updates and two-factor login.
4. A one-page emergency plan hangs in the office.
5. Once a year, all points are reviewed together.

Now, when a client asks about the security concept, the firm can hand over a clear, short overview. That builds trust – on both sides.

Small habits with a big impact

Not everything needs a project. A few habits already go a long way day to day:

• Lock your screen when you leave your desk.
• Report suspicious emails instead of just deleting them – that way everyone is warned.
• Don't postpone updates; ideally install them right away.
• Clean up accounts when someone leaves the business.
• Don't plug in USB sticks of unknown origin.

Conclusion

Municipal utilities show how well a clear structure for information security works. The same ideas help in a small office too – and with open source, you keep control over your data.

If you'd like to give it a try, I'm happy to help – just drop me a line.