2023
Ransomware hits IT service provider
Emergency plans have to be rehearsed, not filed away.
Reality Check · Municipal Utilities 2026
Power, heat, water: your mandate never takes a break, while NIS-2, cyberattacks, knowledge drain and the rebuild all roll in at the same time. Five wake-up calls, one honest self-assessment and one answer.













Five real incidents — and every time, exactly what we build was missing.
2023
Ransomware hits IT service provider
Emergency plans have to be rehearsed, not filed away.
2023
Price cap hits billing
Processes have to keep up with the pace of regulation.
2025
Attack on the utility network
Security belongs in everyday work, not in a binder.
2025
Municipal utilities under strain
Without effective controls there is no steering.
2026
Utility encrypted overnight
Documented separation kept the supply running.
Five triggers, one common denominator: processes · ISMS · BCM · internal controls. That is exactly our craft.
On the right you see no utility, but the IT provider for 72 municipalities. Yet it is exactly the IT your utility depends on too: billing, customer portal, market communication.
Stadtwerke Windsbach
07/2026 · prepared
Supply operations and office IT were separated — and documented
Supply pulse · never stopped
minutes of interruption to power & water
Südwestfalen-IT
10/2023 · unprepared
The IT operation behind 72 town halls, with the same systems as in any utility
Operations pulse · flatline
months until restart, 72 municipalities offline
The same attack hit both. The one that knew its Mission Critical processes kept the supply running. The one that did not stood still for 11 months.
The situation
Liability · NIS-2 & critical infrastructure
In the end it is not systems that are liable. It is you. Personally.
Cyber attacks
It does not only hit the big ones. Windsbach had 1,700 customers.
Mission Critical processes
Keep them safely under control today, reinvent them tomorrow. Both at once.
Transformation · energy transition
Rebuilding grid, heat and generation while the lights stay on at home.
Knowledge is leaving
The most important knowledge is in no binder. And it retires soon.
Financing & rating
The rebuild costs millions. Credit is only granted against provable order.
Six forces act at the same time. Your foundation holds, or it gives way.
No storm can be switched off. But a foundation of processes, knowledge, controls and evidence holds when everything arrives at once.
Three questions your board will ask
Executive management
You are personally liable. Can you prove you did everything you could?
§ 38 BSIG · cannot be delegated · D&O often does not cover cyber
Risk & Compliance
Would your internal control system survive a special audit, today?
Chains of Excel files are no evidence · § 111 AktG / § 52 GmbHG
Process management
How much of your grid exists only in one person's head?
The retirement dates are set. The documentation is not.
Wie es heute ist. Nicht, wie es sein sollte.
Jede Aussage zählt Punkte: Ja 2, Teilweise 1, Nein 0. Maximal erreichbar sind 12 Punkte.
Beantworten Sie alle sechs Aussagen, dann sehen Sie Ihre Auswertung.
Sehen Sie sich an, wie sich Prozesse, Nachweise und Verantwortlichkeiten an einer Stelle führen lassen. Unverbindlich testen oder live zeigen lassen.
Und das Wissen bleibt im Haus, auch wenn Menschen gehen.
Sechs Schritte, klare Sprache, jede Kraft aus dem Sturm bekommt ihre Antwort.
Das ganze Haus auf einen Blick: welche Prozesse es tragen, in welchem Zustand sie sind und wo es kritisch wird.
Aus dem Befund wird ein Plan: wer was bis wann tut, um das Kritische in den Griff zu bekommen.
Erfahrung wird Betriebsvermögen: Was in Köpfen steckt, steht in der Plattform und geht nicht mit in Rente.
Mit KI-Unterstützung und Referenzprozessen entsteht das Neue schneller, Photovoltaik startet nicht auf dem leeren Blatt.
Jedes kritische Asset im Blick, jede Maßnahme belegt: Ihre Sorgfalt ist jederzeit nachweisbar.
Wenn es passiert, übernimmt der Plan statt der Panik: Notfallpläne in der App, das Kritische zuerst zurück.
Jeder Nachweis auf Knopfdruck, für Banken, Rating und Aufsicht. Out of the box: das Stadtwerke-Branchenmodell mit Referenzprozessen.
Erst das ganze Bild. Dann das Kritische. Dann erfasst der Zwilling alles, und am Ende steht der Reifegrad.

“We design our process management from functional documentation to an instrument for overall process control. In doing so, we transform our document management system into a lively, always up-to-date process management system and implement the regulatory requirements in Aeneis in a legally secure and digital manner. A core element of this is, for example, the connection of the policy structure with a customer and value-added oriented process structure. ”


“It is particularly valuable for us that Aeneis optimally supports TRILUX's Simplify philosophy: Our employees have easy access to all relevant processes, which results in significantly improved collaboration.
In addition, we can effectively map all touchpoints with our customers and their dependencies in order to align our processes even better with customer needs. ”


“Before implementing Aeneis, there was no uniform process model in our company. Our goal was to create a central port for all business areas and management systems, supported by a uniform process model. By using Aeneis as BPM and GRC software, we can digitize our processes in a validated environment and integrate them into a central platform. This enables us to consolidate our global business processes and management systems and laid the foundation for merging the process-supporting application structure. ”


In the past, data maintenance was cumbersome and paper-based. With Aeneis, we have significantly reduced effort, simplified complexity and can now fully concentrate on our actual profession again. Aeneis combines all the important functions we need: process descriptions, risk management, audits, error reporting systems, and much more. The big advantage is that we can adapt it exactly to our structures and needs, which is often not possible with other solutions.


“Until 12 years ago, we had not documented any processes, just a few work instructions and a few organizational guidelines. Then we got to know Aeneis through an external consultant. With Aeneis as BPM software, we have now mapped our key business processes and organizational structure and integrated everything into a central quality management system down to employee level. This is fully accessible to all our employees and integrated into our existing intranet. The GoToMarket process, which is very important to us, forms the core of documenting our process organization and the organizational chart, which is very conveniently structured in Aeneis, provides guidance about our organizational structure. ”


Leading experts from the industry — including in-house consulting managers, quality management representatives, process managers, organizational development managers and risk management experts — presented their valuable experiences and successes with Aeneis at the BPM|Symposium. They shared exciting insights into integrated management systems, process-oriented organizations in critical infrastructures, and interesting best practices. In this video, you can see brief statements about their experiences with Aeneis in everyday business. Have fun watching!

“We didn't have any process documentation before, just a few instructions and forms. But then, as part of further training, we got to know another company that had already successfully used the system. With Aeneis as BPM and GRC software, we have now documented our processes and integrated them together with our documents, instructions and forms into a central management system. This led to improved knowledge of processes and cooperation and thus to fewer frictional losses and extra work. ”

.webp)
“In the Infraserv Höchst Group, I worked for over 15 years as a responsible coordinator for process management and as a management representative responsible for the PRISMA integrated management system (software Aeneis) and the associated certifications. Aeneis has given us the flexibility to successfully implement the many requirements with an integrated management system and to be 'compliant'. The modules offered or our own customizing provided us with very good support.”


“Since 1990, SHD has developed into one of the market-leading companies in the areas of IT infrastructure and process digitization.
Among other things, we recommend ISMS @Aeneis to our customers so that they can master ISO 27001 and NIS2, take their risk management to a new level and to protect them in emergencies (business continuity management). The innovative power is unwavering, so with Aeneis we are looking forward to implementing our clients' great ideas.”

“As an official service partner of intellior, we offer you a first-class solution for GoBD-compliant process documentation with GoBD@aeneis. This platform not only serves as a basis for tax compliance, but also enables precise monitoring and management of tax risks. By comprehensively documenting IT systems and interfaces, Aeneis maximizes application acceptance and effectively supports you in optimizing your tax processes and preparing for tax audits — everything is fully integrated and automated. With Aeneis, you can rely on efficiency, compliance and future security for your business processes. ”
A major bonus of our ISO certifications: We were able to carry them out using our in-house apps for audit management and ISMS, thereby putting our own solutions to the ultimate test. This further ensures that we provide our clients with the highest quality solutions.

In 2019, we achieved certification for ISO 9001, the most widely used quality management standard. This allows us to demonstrably guarantee our clients a high level of sustainable quality, as we regularly work on our processes to continuously evolve and improve.

In 2023, we also achieved certification for the information security standard, ISO 27001. This allows our clients to trust that their data is in safe hands with us.


