Reality Check · Municipal Utilities 2026

It all hits at once.
Will your foundation hold?

Power, heat, water: your mandate never takes a break, while NIS-2, cyberattacks, knowledge drain and the rebuild all roll in at the same time. Five wake-up calls, one honest self-assessment and one answer.

NIS-2 CYBER KNOW-HOW REBUILD UTILITY
Be part
of intellior

Three years. Five wake-up calls. One pattern.

Five real incidents — and every time, exactly what we build was missing.

2023

Ransomware hits IT service provider

Impact: 72 municipalities offline, 11 months
BCM · Emergency drills

Emergency plans have to be rehearsed, not filed away.

2023

Price cap hits billing

Impact: Delayed nationwide, courts: inadmissible
Process management

Processes have to keep up with the pace of regulation.

2025

Attack on the utility network

Impact: Schwerte: portal down, data on the darknet
ISMS · NIS-2

Security belongs in everyday work, not in a binder.

2025

Municipal utilities under strain

Impact: Existential crises since the energy crisis
Risk & internal controls

Without effective controls there is no steering.

2026

Utility encrypted overnight

Impact: Windsbach: IBAN & SEPA data gone
The proof · Mission critical

Documented separation kept the supply running.

Five triggers, one common denominator: processes · ISMS · BCM · internal controls. That is exactly our craft.

Same attack. Two outcomes.

On the right you see no utility, but the IT provider for 72 municipalities. Yet it is exactly the IT your utility depends on too: billing, customer portal, market communication.

One identical ransomware attack

Stadtwerke Windsbach

07/2026 · prepared

Supply operations and office IT were separated — and documented

Supply pulse · never stopped

0

minutes of interruption to power & water

Grid technology cleanly separated, the supply simply kept running ISMS · NIS-2
What mattered was clear: protect supply first, that is what the plan said Mission Critical
Everyone knew what to do: reporting, forensics, customer notice within 72 h Emergency plan
Office IT encrypted, customer data (IBAN) affected

Südwestfalen-IT

10/2023 · unprepared

The IT operation behind 72 town halls, with the same systems as in any utility

Operations pulse · flatline

0

months until restart, 72 municipalities offline

Crisis team, providers, budget: money is no substitute for practice
Never rehearsed what to do in an emergency, the restart was improvised BCM · Drills
Nobody knew what had to come back first, everything stalled at once BIA
Attack11 months

The same attack hit both. The one that knew its Mission Critical processes kept the supply running. The one that did not stood still for 11 months.

The situation

The perfect storm: six forces acting at once.

Liability · NIS-2 & critical infrastructure

In the end it is not systems that are liable. It is you. Personally.

Cyber attacks

It does not only hit the big ones. Windsbach had 1,700 customers.

Mission Critical processes

Keep them safely under control today, reinvent them tomorrow. Both at once.

Transformation · energy transition

Rebuilding grid, heat and generation while the lights stay on at home.

Knowledge is leaving

The most important knowledge is in no binder. And it retires soon.

Financing & rating

The rebuild costs millions. Credit is only granted against provable order.

UTILITY
Your foundation: processes · knowledge · controls · evidence

Six forces act at the same time. Your foundation holds, or it gives way.

No storm can be switched off. But a foundation of processes, knowledge, controls and evidence holds when everything arrives at once.

Three questions your board will ask

Executive management

You are personally liable. Can you prove you did everything you could?

§ 38 BSIG · cannot be delegated · D&O often does not cover cyber

Risk & Compliance

Would your internal control system survive a special audit, today?

Chains of Excel files are no evidence · § 111 AktG / § 52 GmbHG

Process management

How much of your grid exists only in one person's head?

The retirement dates are set. The documentation is not.

Selbsttest

Sechs Aussagen. Sechzig Sekunden. Ehrlich.

Wie es heute ist. Nicht, wie es sein sollte.

Jede Aussage zählt Punkte: Ja 2, Teilweise 1, Nein 0. Maximal erreichbar sind 12 Punkte.

Einen NIS-2-Sorgfaltsnachweis könnten wir jederzeit lückenlos vorlegen.
Stünden morgen unsere Systeme, hätten wir einen erprobten Wiederanlaufplan.
Geht ein erfahrener Kollege in Rente, bleibt sein Prozesswissen im Haus.
Neue Vorgaben setzen wir um, ohne dass Abrechnung oder Betrieb ins Rutschen kommen.
Ändert sich ein Prozess, sehen wir sofort, was alles betroffen ist.
Compliance ist bei uns Dauerzustand, kein Endspurt vor dem Audit.
0 von 6 beantwortet Readiness-Score 0/ 12

Beantworten Sie alle sechs Aussagen, dann sehen Sie Ihre Auswertung.

Sie wollen es genau wissen?

Sehen Sie sich an, wie sich Prozesse, Nachweise und Verantwortlichkeiten an einer Stelle führen lassen. Unverbindlich testen oder live zeigen lassen.

Insel Doku. Excel Ketten. Audit Hektik.
Prozesse, die das alles tragen, sind Mission Critical. Behandeln Sie sie so.
Jede Änderung kennt ihre Folgen.
Jedes Risiko kennt seine Kontrolle.
Jeder Nachweis kennt seinen Ort.

Und das Wissen bleibt im Haus, auch wenn Menschen gehen.

intellior Section 06 Vorschau
Die Antwort
Wir führen Ihr Stadtwerk durch den Sturm.

Sechs Schritte, klare Sprache, jede Kraft aus dem Sturm bekommt ihre Antwort.

Ihr Stadtwerk
· steht
01 · Mission Critical · heute
Wir schaffen Übersicht.

Das ganze Haus auf einen Blick: welche Prozesse es tragen, in welchem Zustand sie sind und wo es kritisch wird.

02 · Transformation · Energiewende
Wir bringen Ordnung rein.

Aus dem Befund wird ein Plan: wer was bis wann tut, um das Kritische in den Griff zu bekommen.

03 · Wissen geht
Wir sichern das Wissen.

Erfahrung wird Betriebsvermögen: Was in Köpfen steckt, steht in der Plattform und geht nicht mit in Rente.

04 · Mission Critical · morgen
Wir bauen, was morgen zählt.

Mit KI-Unterstützung und Referenzprozessen entsteht das Neue schneller, Photovoltaik startet nicht auf dem leeren Blatt.

05 · Haftung · NIS-2 & KRITIS
Wir senken das Risiko. Messbar.

Jedes kritische Asset im Blick, jede Maßnahme belegt: Ihre Sorgfalt ist jederzeit nachweisbar.

06 · Cyberangriffe
Wir machen ihn beherrschbar.

Wenn es passiert, übernimmt der Plan statt der Panik: Notfallpläne in der App, das Kritische zuerst zurück.

Am Ziel

Jeder Nachweis auf Knopfdruck, für Banken, Rating und Aufsicht. Out of the box: das Stadtwerke-Branchenmodell mit Referenzprozessen.

Finanzierung & Rating
Das Prinzip · Aeneis

Vom ganzen Unternehmen zum lebenden Zwilling

Erst das ganze Bild. Dann das Kritische. Dann erfasst der Zwilling alles, und am Ende steht der Reifegrad.

Ihr Unternehmen · die operative Prozesswelt
Mitarbeitende informiert
Verständnis bestätigt
Prozess verankert, im Alltag gelebt
Der Zwilling wirkt in der echten Welt, gelebte Prozesse statt Papier.
Licht an: 5 von 18 Prozessen sind mission-critical
Digitaler
ZwillingNetzanschluss
Strategie
Ziele & Kennzahlen, direkt am Prozess
Bus-Faktor behoben
Organisation
Rollen & Verantwortliche je Prozessschritt
Kritische Assets bewertet
IT
Systeme & Schnittstellen je Prozessschritt
Notfallplan etabliert
GRC
Risiken, Kontrollen & Nachweise, verknüpft
Verbesserung
Maßnahmen mit wer · was · bis wann
Reifegrad · Netzanschluss
Prozess beschrieben
Kennzahlen definiert
Notfallplan etabliert
Kritische Assets bewertet
Bus-Faktor behoben
0,0/ 5
Schritt 00 / 11

“We design our process management from functional documentation to an instrument for overall process control. In doing so, we transform our document management system into a lively, always up-to-date process management system and implement the regulatory requirements in Aeneis in a legally secure and digital manner. A core element of this is, for example, the connection of the policy structure with a customer and value-added oriented process structure. ”

#be part of the process
Portrait von Tobias Hehn von der Deka-Bank

“It is particularly valuable for us that Aeneis optimally supports TRILUX's Simplify philosophy: Our employees have easy access to all relevant processes, which results in significantly improved collaboration.
In addition, we can effectively map all touchpoints with our customers and their dependencies in order to align our processes even better with customer needs. ”

#be part of the process
Portrait von Stefan Köster von TRILUX

“Before implementing Aeneis, there was no uniform process model in our company. Our goal was to create a central port for all business areas and management systems, supported by a uniform process model. By using Aeneis as BPM and GRC software, we can digitize our processes in a validated environment and integrate them into a central platform. This enables us to consolidate our global business processes and management systems and laid the foundation for merging the process-supporting application structure. ”

#be part of the process
Portrait von Robin Schmalz von Ottobock

In the past, data maintenance was cumbersome and paper-based. With Aeneis, we have significantly reduced effort, simplified complexity and can now fully concentrate on our actual profession again. Aeneis combines all the important functions we need: process descriptions, risk management, audits, error reporting systems, and much more. The big advantage is that we can adapt it exactly to our structures and needs, which is often not possible with other solutions.

#be part of the process

“Until 12 years ago, we had not documented any processes, just a few work instructions and a few organizational guidelines. Then we got to know Aeneis through an external consultant. With Aeneis as BPM software, we have now mapped our key business processes and organizational structure and integrated everything into a central quality management system down to employee level. This is fully accessible to all our employees and integrated into our existing intranet. The GoToMarket process, which is very important to us, forms the core of documenting our process organization and the organizational chart, which is very conveniently structured in Aeneis, provides guidance about our organizational structure. ”

#be part of the process
Portrait von René Slavik von MHZ

Leading experts from the industry — including in-house consulting managers, quality management representatives, process managers, organizational development managers and risk management experts — presented their valuable experiences and successes with Aeneis at the BPM|Symposium. They shared exciting insights into integrated management systems, process-oriented organizations in critical infrastructures, and interesting best practices. In this video, you can see brief statements about their experiences with Aeneis in everyday business. Have fun watching!

#be part of the process

“We didn't have any process documentation before, just a few instructions and forms. But then, as part of further training, we got to know another company that had already successfully used the system. With Aeneis as BPM and GRC software, we have now documented our processes and integrated them together with our documents, instructions and forms into a central management system. This led to improved knowledge of processes and cooperation and thus to fewer frictional losses and extra work. ”

#be part of the process
Portrait von Nils Werner von ppg

“In the Infraserv Höchst Group, I worked for over 15 years as a responsible coordinator for process management and as a management representative responsible for the PRISMA integrated management system (software Aeneis) and the associated certifications. Aeneis has given us the flexibility to successfully implement the many requirements with an integrated management system and to be 'compliant'. The modules offered or our own customizing provided us with very good support.”

#be part of the process
Bernd Hientzsch von Infraserv Höchst

“Since 1990, SHD has developed into one of the market-leading companies in the areas of IT infrastructure and process digitization.
Among other things, we recommend ISMS @Aeneis to our customers so that they can master ISO 27001 and NIS2, take their risk management to a new level and to protect them in emergencies (business continuity management). The innovative power is unwavering, so with Aeneis we are looking forward to implementing our clients' great ideas.”

#be part of the process

“As an official service partner of intellior, we offer you a first-class solution for GoBD-compliant process documentation with GoBD@aeneis. This platform not only serves as a basis for tax compliance, but also enables precise monitoring and management of tax risks. By comprehensively documenting IT systems and interfaces, Aeneis maximizes application acceptance and effectively supports you in optimizing your tax processes and preparing for tax audits — everything is fully integrated and automated. With Aeneis, you can rely on efficiency, compliance and future security for your business processes. ”

#be part of the process

Our certifications, seals, and awards - for our shared success

A major bonus of our ISO certifications: We were able to carry them out using our in-house apps for audit management and ISMS, thereby putting our own solutions to the ultimate test. This further ensures that we provide our clients with the highest quality solutions.

In 2019, we achieved certification for ISO 9001, the most widely used quality management standard. This allows us to demonstrably guarantee our clients a high level of sustainable quality, as we regularly work on our processes to continuously evolve and improve.

In 2023, we also achieved certification for the information security standard, ISO 27001. This allows our clients to trust that their data is in safe hands with us.

Further seals and awards

Our clients are champions:
8 Process Solution Awards
GFO-Award 2022
Winner "Process Monitoring"
Tool Masters 2025
Optimize and secure mission-critical processes.
No obligation. Your contact person knows the energy sector.
Book a strategy session