[{"data":1,"prerenderedAt":443},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/municipal-utilities-nis2-energy-microsoft-365-sovereign-alternative-2026-posts_en":51,"/en/blog/municipal-utilities-nis2-energy-microsoft-365-sovereign-alternative-2026-surround-posts_en":432},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":394,"description":395,"extension":396,"faq":397,"howto":407,"image":424,"meta":426,"navigation":427,"path":428,"seo":429,"stem":430,"__hash__":431},"posts_en/en/3.blog/27.municipal-utilities-nis2-energy-microsoft-365-sovereign-alternative-2026.md","What Municipal Utilities Show Us – Structured Security with Open Source",[55],{"name":56,"to":57,"avatar":58},"Michael Wolf","/en/about",{"src":59},"/michael.webp",{"label":61},"Guide",{"type":63,"value":64,"toc":382},"minimark",[65,69,73,78,86,114,129,133,136,204,208,211,238,261,265,272,276,302,306,309,326,329,333,336,368,372,375],[66,67,53],"h1",{"id":68},"what-municipal-utilities-show-us-structured-security-with-open-source",[70,71,72],"p",{},"Municipal utilities and energy suppliers carry a big responsibility: electricity, water and heat should flow reliably. That's why they take IT security especially seriously and work with clear structures. The exciting part: many of these ideas also work in a small business – and open source can be a practical helper.",[74,75,77],"h2",{"id":76},"how-energy-suppliers-approach-security","How energy suppliers approach security",[70,79,80,81,85],{},"Many utilities work with an ",[82,83,84],"strong",{},"information security management system (ISMS)",". It sounds technical, but at its core it's a simple cycle:",[87,88,89,96,102,108],"ol",{},[90,91,92,95],"li",{},[82,93,94],{},"Plan:"," Which systems and data are there, and what could go wrong?",[90,97,98,101],{},[82,99,100],{},"Do:"," Introduce suitable safeguards.",[90,103,104,107],{},[82,105,106],{},"Check:"," Regularly verify that everything works.",[90,109,110,113],{},[82,111,112],{},"Improve:"," Learn from experience and adjust.",[70,115,116,117,120,121,124,125,128],{},"The basis for this is often ",[82,118,119],{},"ISO 27001"," or the BSI's ",[82,122,123],{},"IT-Grundschutz",". Energy suppliers also have their own requirements, including from the implementation of the EU ",[82,126,127],{},"NIS2"," directive.",[74,130,132],{"id":131},"what-helps-on-a-small-scale","What helps on a small scale",[70,134,135],{},"You don't have to be a utility to benefit from this cycle:",[137,138,139,152],"table",{},[140,141,142],"thead",{},[143,144,145,149],"tr",{},[146,147,148],"th",{},"ISMS idea",[146,150,151],{},"What it looks like in a small business",[153,154,155,164,172,180,188,196],"tbody",{},[143,156,157,161],{},[158,159,160],"td",{},"Responsibility",[158,162,163],{},"One person takes care of it, ideally with external help",[143,165,166,169],{},[158,167,168],{},"Inventory",[158,170,171],{},"A list of all devices, programs and services",[143,173,174,177],{},[158,175,176],{},"Risk assessment",[158,178,179],{},"What would be most unpleasant in an outage?",[143,181,182,185],{},[158,183,184],{},"Safeguards",[158,186,187],{},"Backups, updates, two-factor login, password manager",[143,189,190,193],{},[158,191,192],{},"Emergency plan",[158,194,195],{},"One page: who does what if something fails?",[143,197,198,201],{},[158,199,200],{},"Review",[158,202,203],{},"Go through everything once a year",[74,205,207],{"id":206},"where-open-source-supports-you","Where open source supports you",[70,209,210],{},"Open-source software is used by many organisations with high security requirements. For small businesses, these advantages are especially interesting:",[212,213,214,220,226,232],"ul",{},[90,215,216,219],{},[82,217,218],{},"Choose your location:"," You know where your data is.",[90,221,222,225],{},[82,223,224],{},"Updates in your hands:"," You decide when and how things get updated.",[90,227,228,231],{},[82,229,230],{},"Traceable:"," Configurations are easy to document.",[90,233,234,237],{},[82,235,236],{},"Switchable:"," Open standards make you independent of individual providers.",[70,239,240,241,243,244,247,248,251,252,254,255,260],{},"Typical building blocks are ",[82,242,32],{}," for files, ",[82,245,246],{},"Element"," for communication, ",[82,249,250],{},"Vaultwarden"," for passwords and ",[82,253,48],{}," for logins. You'll find more under ",[256,257,259],"a",{"href":258},"/en/alternativen","Alternatives",".",[74,262,264],{"id":263},"a-relaxed-way-in","A relaxed way in",[70,266,267,268,260],{},"Just start small. An inventory, a few good habits and a short emergency plan already go a long way. If you'd like support: as an external information security officer, I also work with small businesses – more under ",[256,269,271],{"href":270},"/en/consulting","Consulting",[74,273,275],{"id":274},"a-few-terms-briefly-explained","A few terms, briefly explained",[212,277,278,284,290,296],{},[90,279,280,283],{},[82,281,282],{},"ISMS:"," Information security management system – the structured framework for security in an organisation.",[90,285,286,289],{},[82,287,288],{},"ISO 27001:"," An international standard for building and certifying an ISMS.",[90,291,292,295],{},[82,293,294],{},"Risk analysis:"," Assessing what could happen, how likely it is and how bad the consequences would be.",[90,297,298,301],{},[82,299,300],{},"Information security officer:"," A person who takes care of the topic, gives advice and keeps the overview – internally or externally.",[74,303,305],{"id":304},"an-example-from-a-small-business","An example from a small business",[70,307,308],{},"An engineering firm with ten people works for clients in the energy sector. These clients increasingly ask how the firm handles information security. So the firm sets up a small, lean security management:",[87,310,311,314,317,320,323],{},[90,312,313],{},"One person takes responsibility, supported by an external information security officer.",[90,315,316],{},"A list of all systems and services is created.",[90,318,319],{},"Measures are defined for the main risks – such as backups, updates and two-factor login.",[90,321,322],{},"A one-page emergency plan hangs in the office.",[90,324,325],{},"Once a year, all points are reviewed together.",[70,327,328],{},"Now, when a client asks about the security concept, the firm can hand over a clear, short overview. That builds trust – on both sides.",[74,330,332],{"id":331},"small-habits-with-a-big-impact","Small habits with a big impact",[70,334,335],{},"Not everything needs a project. A few habits already go a long way day to day:",[212,337,338,344,350,356,362],{},[90,339,340,343],{},[82,341,342],{},"Lock your screen"," when you leave your desk.",[90,345,346,349],{},[82,347,348],{},"Report suspicious emails"," instead of just deleting them – that way everyone is warned.",[90,351,352,355],{},[82,353,354],{},"Don't postpone updates","; ideally install them right away.",[90,357,358,361],{},[82,359,360],{},"Clean up accounts"," when someone leaves the business.",[90,363,364,367],{},[82,365,366],{},"Don't plug in USB sticks"," of unknown origin.",[74,369,371],{"id":370},"conclusion","Conclusion",[70,373,374],{},"Municipal utilities show how well a clear structure for information security works. The same ideas help in a small office too – and with open source, you keep control over your data.",[70,376,377,378,260],{},"If you'd like to give it a try, I'm happy to help – ",[256,379,381],{"href":380},"/en/contact","just drop me a line",{"title":383,"searchDepth":384,"depth":384,"links":385},"",2,[386,387,388,389,390,391,392,393],{"id":76,"depth":384,"text":77},{"id":131,"depth":384,"text":132},{"id":206,"depth":384,"text":207},{"id":263,"depth":384,"text":264},{"id":274,"depth":384,"text":275},{"id":304,"depth":384,"text":305},{"id":331,"depth":384,"text":332},{"id":370,"depth":384,"text":371},"2026-09-01T00:00:00.000Z","Energy suppliers take IT security especially seriously. The ideas behind it and how small businesses can put them into practice with open source.","md",[398,401,404],{"q":399,"a":400},"Why is IT security so important for municipal utilities?","Municipal utilities supply many people with electricity, water or heat. For that to work reliably, the IT behind it has to be well protected too. That's why many energy suppliers are subject to special requirements, for example from NIS2 implementation.",{"q":402,"a":403},"What is an information security management system (ISMS)?","An ISMS is a structured framework an organisation uses to plan, implement, review and improve its information security. Well-known foundations for it are ISO 27001 and the BSI's IT-Grundschutz.",{"q":405,"a":406},"Do I need an ISMS as a small business?","A full ISMS usually isn't necessary for small businesses. But a few of its basic ideas – overview, responsibilities, regular review – help everyone.",{"name":408,"description":409,"totalTime":410,"steps":411},"A mini ISMS for small businesses","The basic ideas of security management in four simple steps.","P4W",[412,415,418,421],{"name":413,"text":414},"Clarify responsibility","Decide who takes care of IT security in the business, internally or with external support.",{"name":416,"text":417},"Assess risks","Think about which outages or data losses would be especially unpleasant.",{"name":419,"text":420},"Implement measures","Introduce suitable measures such as backups, updates, two-factor login and an emergency plan.",{"name":422,"text":423},"Review regularly","Once a year, check whether everything still fits and improve where needed.",{"src":425},"/img/blog/photo-1473341304170-971dccb5ac1e.webp",{},true,"/en/blog/municipal-utilities-nis2-energy-microsoft-365-sovereign-alternative-2026",{"title":53,"description":395},"en/3.blog/27.municipal-utilities-nis2-energy-microsoft-365-sovereign-alternative-2026","SfkSEipAMT4EBDHpucs9FGu2Ss1U62oMPz6JlqBy62k",[433,438],{"title":434,"path":435,"stem":436,"description":437,"children":-1},"Schleswig-Holstein Goes Open Source – What Small Businesses Can Learn","/en/blog/schleswig-holstein-blueprint-libreoffice-migration-states-municipalities-2026","en/3.blog/26.schleswig-holstein-blueprint-libreoffice-migration-states-municipalities-2026","The German state of Schleswig-Holstein is moving its administration to open source step by step. A great example small businesses can learn a lot from.",{"title":439,"path":440,"stem":441,"description":442,"children":-1},"Cloud and AI in Law Firms – What Matters for Professional Secrecy","/en/blog/microsoft-365-copilot-law-firms-tax-advisors-professional-secrecy-2026","en/3.blog/28.microsoft-365-copilot-law-firms-tax-advisors-professional-secrecy-2026","Law firms and tax offices handle especially confidential data. What matters when using cloud and AI, and how open source can help.",1792720367385]