Skip to content
info@rootsektor.de
24/7 emergency: +49 2932 465265-0 Request a pentest quote Report an emergency
Emergency

Contact

Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.de

Mon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline

Request a pentest quote Report an emergency

Industries

Public Sector Cybersecurity for Government and Education

Keeping administration and teaching up and running

Public administrations, schools, universities, and research institutions process data about citizens, students, and employees – and must remain open and accessible at the same time. A penetration test from Rootsektor makes public sector cybersecurity measurable for municipalities, government agencies, and universities: it shows where attackers could break in and delivers prioritized measures that fit your resources.

  • Fixed price after scoping
  • Free retest
  • Quote within 24 hours
Request a pentest quote Schedule a consultation

Challenges

Public sector cybersecurity: the challenges

  • Challenge 1

    Open, heterogeneous IT landscapes

    Specialized administrative applications, citizen portals, e-file systems, and school, guest, and research networks are operated by in-house IT, municipal IT service providers, school authorities, and data centers. Unclear responsibilities and flat networks make it easier for attackers to work their way from the first compromised account to sensitive applications.

  • Challenge 2

    Sensitive data on many people

    Resident registration, social welfare, tax, and personnel data, student records, exam results, and research data are equally attractive for extortion, identity theft, and espionage. Research institutions are also targeted by state-sponsored groups.

  • Challenge 3

    Ransomware and phishing

    Attacks on municipal administrations, municipal IT service providers, and universities have shown how long citizen services, teaching, and exams can be disrupted. Attackers often get in via phishing, stolen credentials, or unpatched systems that are reachable from the internet.

How resilient is your administration?

We discuss which processes and access points carry the greatest risk in your organization. Our fixed-price quote after scoping makes budget planning and procurement easier.

Schedule a consultation

Benefits

Benefits of penetration testing for government agencies, municipalities, and education

Tight budgets and limited staff call for clear priorities. A pentest shows which vulnerabilities can actually be exploited – and where your resources will have the greatest impact.

  • Identify exploitable vulnerabilities

    From the citizen portal to the school network, we show which gaps an attacker could use to get in and how far they would get.

  • Protect personal data

    Resident registers, personnel files, student data, research results – we show which of these data sets an attacker could reach and where access rights, encryption, or logging should be improved.

  • Maintain your ability to act

    Ransomware needs a path to central systems and backups. If you close these paths, you reduce the risk of citizen services, classes, or exams being unavailable for days or weeks.

  • Evidence for leadership and committees

    The report and test certificate give administrative leadership, information security officers and data protection officers, public auditors, and funding bodies a solid basis.

Services

Our services for government, schools, and universities

  • Web Applications

    Citizen and service portals, online request forms, learning platforms such as Moodle or ILIAS, and admissions and campus management systems.

  • Network & Infrastructure

    Administrative, school, guest, and research networks, the separation of instructional and administrative networks, and VPN and remote access.

  • Active Directory Assessment

    Central user management is a favorite target of ransomware groups. We uncover privilege chains and misconfigurations before they are exploited.

  • Microsoft 365 & Azure Review

    Microsoft 365 in administration and schools – MFA, Conditional Access, sharing, guest access, and privacy-relevant settings.

  • Security Awareness & Phishing Simulation

    Phishing simulations and training for administrative staff, teachers, and university staff – coordinated with the staff council and data protection officers.

  • Vulnerability Assessment

    Regular vulnerability scans of your systems – if you wish, with the open-source-based solution from our German partner Greenbone.

Regulations & standards

IT-Grundschutz, OZG, and data protection

Public bodies are subject to different requirements depending on the level of government and the federal state. What they have in common is the expectation that security measures are implemented in line with the state of the art and reviewed regularly.

  • Methodology

    BSI IT-Grundschutz

    Many administrations and universities work with BSI Standards 200-1 to 200-3 and the IT-Grundschutz Compendium – the baseline protection methodology of the BSI (Germany’s Federal Office for Information Security). For municipalities, the BSI offers a pragmatic starting point with the IT-Grundschutz profile Basis-Absicherung Kommunalverwaltung (basic protection for municipal administrations) and the Weg in die Basis-Absicherung (WiBA, “path to basic protection”).

    • Verification that implemented measures are effective
    • Insights for your security concept and internal audit
    • Approach based on the BSI’s penetration testing guide (Durchführungskonzept für Penetrationstests)

  • Legal framework

    OZG & NIS2

    Online services under the German Online Access Act (OZG) can be reached directly from the internet and process application data; for IT components in the federal and state portal network, the IT Security Ordinance for the Portal Network (IT-Sicherheitsverordnung Portalverbund) specifies the requirements on the basis of IT-Grundschutz. In Germany, NIS2 mainly covers the federal administration – whether and how state and municipal administrations are included is up to the federal states. Municipal companies such as municipal utilities, on the other hand, can fall directly under NIS2.

    • Security testing for portals and online application processes
    • Evidence for entities subject to NIS2

  • Data protection

    GDPR & state law

    In addition to the GDPR, state and municipal authorities are subject to the state data protection acts, and schools are additionally subject to the school law of their federal state. Art. 32 GDPR requires appropriate technical and organizational measures and a process for regularly testing their effectiveness.

    • Evidence of effectiveness testing under Art. 32
    • Documentation for data protection officers

How a penetration test for public institutions works

We take responsibilities, employee co-determination, and procurement into account from the outset – so the test doesn’t fail because of formalities. The methodology itself is the same across all industries.

Initial consultation & needs assessment

We clarify goals, systems, and responsibilities – in-house IT, municipal IT service provider, school authority, or university computing center.

Scoping & approvals

Coordination with leadership, information security and data protection officers, the service providers involved, and – for phishing simulations – the staff council.

Fixed-price quote

Within 24 hours of scoping (on business days), you receive a fixed-price quote with a clearly defined scope – a solid basis for budgeting and procurement.

Testing

Tests based on the BSI’s penetration testing guide and the OWASP guides, scheduled outside critical periods for your organization.

Report & debrief

An executive summary for leadership and committees, a technical section for your IT, and prioritized remediation recommendations – if you wish, we present the results in a final debrief.

Retest & test certificate

After remediation, we retest free of charge and issue a test certificate.

FAQ

Frequently asked questions about penetration testing in the public sector

Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.

Can you submit a quote as part of public procurement?

Yes. After scoping, you receive a fixed-price quote with a clearly described scope, methodology, and services. This makes price inquiries, tenders, and budget planning easier.

Who needs to approve a penetration test?

Approval usually has to come from the head of the agency or institution – for schools, together with the school authority – and from IT service providers, insofar as they operate the systems concerned. You should involve your information security and data protection officers early on; for phishing simulations and social engineering tests, the staff council usually has to be involved as well. We support you with a clear description of scope and methods.

Our IT is run by a municipal IT service provider – is a test still possible?

Yes. For systems that the service provider operates, we need its approval; we’re happy to coordinate with the provider directly. The test often focuses on your own components – workstations, local networks, school networks, web applications – and on the interfaces to the service provider.

Will the test disrupt citizen services or classes?

We set the schedule together and avoid sensitive periods – such as elections, exam periods, grading conferences, or the start of the semester. We only perform tests that could noticeably strain systems after explicit approval and, if you wish, outside opening and school hours.

Do you also test school networks and instructional networks?

Yes. In particular, we test the separation between the instructional network and the administrative network, Wi-Fi access, mobile device management, and the accounts of teachers and students. We only access students’ personal data if it is strictly necessary for the evidence.

Does the pentest replace an IT-Grundschutz audit?

No. A penetration test specifically checks whether technical measures withstand a realistic attack; an IT-Grundschutz audit assesses your entire information security management. The two complement each other – the pentest results feed into your security concept, internal audit, and risk assessment.

Talk to us about your institution

Whether you’re a city hall, a county administration, a school authority, or a university: tell us about your situation. We’ll propose a scope that fits your risks, responsibilities, and budget.

Fields marked with * are required.

For questions or a callback

We will get in touch and, if you wish, sign the non-disclosure agreement before our first conversation – including on the basis of your own template.

We use your information solely to process your request. For more information, see our privacy policy. Please do not send passwords or login credentials through this form.