2023
Ransomware paralyses a municipal IT service provider
Impact: Dozens of municipalities offline, months until recovery
BCM · emergency drills
Emergency plans need to be practised, not filed away.
Reality Check · Municipal Utilities 2026
Power, heat, water: your mandate never takes a break, while NIS-2, cyberattacks, knowledge drain and the rebuild all roll in at the same time. Five wake-up calls, one honest self-assessment and one answer.
Four incidents from the industry, and every time exactly what we build was missing.
All cases are based on publicly reported events and have been deliberately anonymised.
2023
Ransomware paralyses a municipal IT service provider
Emergency plans need to be practised, not filed away.
2023
Price cap hits billing
Processes have to keep up with the pace of regulation.
2025
Utilities under financial strain
Without effective controls there is no steering.
2026
A utility is encrypted overnight
Documented separation kept the supply running.
Four triggers, one denominator: processes · BCM · internal controls · mission critical. That is exactly our craft.
On the right is not a utility but a municipal IT service provider for many municipalities. Yet it is exactly the IT your utility depends on: billing, customer portal, market communication.
Both cases are based on publicly reported events and have been deliberately anonymised.
A small utility
2026 · prepared
Supply and office IT were documented as separate
Supply pulse · never stopped
minutes of interruption to power & water
A municipal IT service provider
2023 · unprepared
The IT operation behind many town halls, with the same systems any utility runs
Operations pulse · flatline
until restart, dozens of municipalities offline
The same attack hit both. The one that knew its mission critical processes kept the supply running. The other stood still for months.
The situation
Liability · NIS-2 & critical infrastructure
In the end it is not systems that are liable. It is you. Personally.
Cyber attacks
It does not only hit the big ones. Windsbach had 1,700 customers.
Mission Critical processes
Keep them safely under control today, reinvent them tomorrow. Both at once.
Transformation · energy transition
Rebuilding grid, heat and generation while the lights stay on at home.
Knowledge is leaving
The most important knowledge is in no binder. And it retires soon.
Financing & rating
The rebuild costs millions. Credit is only granted against provable order.
Six forces act at the same time. Your foundation holds, or it gives way.
No storm can be switched off. But a foundation of processes, knowledge, controls and evidence holds when everything arrives at once.
Three questions your board will ask
Executive management
You are personally liable. Can you prove you did everything you could?
§ 38 BSIG · cannot be delegated · D&O often does not cover cyber
Risk & Compliance
Would your internal control system survive a special audit, today?
Chains of Excel files are no evidence · § 111 AktG / § 52 GmbHG
Process management
How much of your grid exists only in one person's head?
The retirement dates are set. The documentation is not.
How it is today. Not how it should be.
Each statement scores points: Yes 2, Partly 1, No 0. The maximum is 12 points.
Answer all six statements to see your evaluation.
See how processes, evidence and responsibilities can be managed in one place. Try it without obligation, or have it shown to you live.
And the knowledge stays in the company, even when people leave.
Six steps, plain language, every force in the storm gets its answer.
The whole organisation at a glance: which processes carry it, what condition they are in and where it gets critical.
The findings become a plan: who does what by when to get the critical parts under control.
Experience becomes a company asset: what sits in people's heads is in the platform and does not retire with them.
With AI support and reference processes the new comes together faster, photovoltaics does not start from a blank page.
Every critical asset in view, every measure documented: your due diligence is provable at any time.
When it happens, the plan takes over instead of panic: emergency plans in the app, the critical things back first.
Every piece of evidence at the touch of a button, for banks, rating agencies and regulators. Out of the box: the utility industry model with reference processes.
First the whole picture. Then what is critical. Then the twin captures it all, and at the end you see the maturity level.
“We design our process management from functional documentation to an instrument for overall process control. In doing so, we transform our document management system into a lively, always up-to-date process management system and implement the regulatory requirements in Aeneis in a legally secure and digital manner. A core element of this is, for example, the connection of the policy structure with a customer and value-added oriented process structure. ”
“It is particularly valuable for us that Aeneis optimally supports TRILUX's Simplify philosophy: Our employees have easy access to all relevant processes, which results in significantly improved collaboration.
In addition, we can effectively map all touchpoints with our customers and their dependencies in order to align our processes even better with customer needs. ”
“Before implementing Aeneis, there was no uniform process model in our company. Our goal was to create a central port for all business areas and management systems, supported by a uniform process model. By using Aeneis as BPM and GRC software, we can digitize our processes in a validated environment and integrate them into a central platform. This enables us to consolidate our global business processes and management systems and laid the foundation for merging the process-supporting application structure. ”
In the past, data maintenance was cumbersome and paper-based. With Aeneis, we have significantly reduced effort, simplified complexity and can now fully concentrate on our actual profession again. Aeneis combines all the important functions we need: process descriptions, risk management, audits, error reporting systems, and much more. The big advantage is that we can adapt it exactly to our structures and needs, which is often not possible with other solutions.
“Until 12 years ago, we had not documented any processes, just a few work instructions and a few organizational guidelines. Then we got to know Aeneis through an external consultant. With Aeneis as BPM software, we have now mapped our key business processes and organizational structure and integrated everything into a central quality management system down to employee level. This is fully accessible to all our employees and integrated into our existing intranet. The GoToMarket process, which is very important to us, forms the core of documenting our process organization and the organizational chart, which is very conveniently structured in Aeneis, provides guidance about our organizational structure. ”
Leading experts from the industry — including in-house consulting managers, quality management representatives, process managers, organizational development managers and risk management experts — presented their valuable experiences and successes with Aeneis at the BPM|Symposium. They shared exciting insights into integrated management systems, process-oriented organizations in critical infrastructures, and interesting best practices. In this video, you can see brief statements about their experiences with Aeneis in everyday business. Have fun watching!
“We didn't have any process documentation before, just a few instructions and forms. But then, as part of further training, we got to know another company that had already successfully used the system. With Aeneis as BPM and GRC software, we have now documented our processes and integrated them together with our documents, instructions and forms into a central management system. This led to improved knowledge of processes and cooperation and thus to fewer frictional losses and extra work. ”
.webp)
“In the Infraserv Höchst Group, I worked for over 15 years as a responsible coordinator for process management and as a management representative responsible for the PRISMA integrated management system (software Aeneis) and the associated certifications. Aeneis has given us the flexibility to successfully implement the many requirements with an integrated management system and to be 'compliant'. The modules offered or our own customizing provided us with very good support.”
“Since 1990, SHD has developed into one of the market-leading companies in the areas of IT infrastructure and process digitization.
Among other things, we recommend ISMS @Aeneis to our customers so that they can master ISO 27001 and NIS2, take their risk management to a new level and to protect them in emergencies (business continuity management). The innovative power is unwavering, so with Aeneis we are looking forward to implementing our clients' great ideas.”
“As an official service partner of intellior, we offer you a first-class solution for GoBD-compliant process documentation with GoBD@aeneis. This platform not only serves as a basis for tax compliance, but also enables precise monitoring and management of tax risks. By comprehensively documenting IT systems and interfaces, Aeneis maximizes application acceptance and effectively supports you in optimizing your tax processes and preparing for tax audits — everything is fully integrated and automated. With Aeneis, you can rely on efficiency, compliance and future security for your business processes. ”
A major bonus of our ISO certifications: We were able to carry them out using our in-house apps for audit management and ISMS, thereby putting our own solutions to the ultimate test. This further ensures that we provide our clients with the highest quality solutions.
In 2019, we achieved certification for ISO 9001, the most widely used quality management standard. This allows us to demonstrably guarantee our clients a high level of sustainable quality, as we regularly work on our processes to continuously evolve and improve.
In 2023, we also achieved certification for the information security standard, ISO 27001. This allows our clients to trust that their data is in safe hands with us.
