Cybersecurity in the public sector
Cybersecurity is not just a set of technical measures, but also the organisation’s consistent activity aimed at protecting information systems, networks, user accounts and data from unauthorised access, loss, modification or disruption of operations. For municipalities, schools, museums, libraries and other public bodies, this is especially important, because the systems they manage often process residents’, pupils’, staff members’ or visitors’ personal data, as well as information needed to provide public services.
In practice, cybersecurity covers three main areas: prevention, threat detection and incident response. Prevention helps reduce risk before a breach occurs, detection makes it possible to notice suspicious activity in time, and response ensures that the consequences of an incident are brought under control as quickly as possible. For public bodies, it is important to understand that even a minor disruption can affect service availability for residents, document management or internal work processes.
Why is this relevant for the public sector in the EU?
Public-sector organisations in the EU are increasingly digitalising services: residents register online, submit applications, obtain certificates, use library catalogues or school electronic diaries. The more services move into the digital space, the more important it becomes to ensure that systems are reliable, secure and accessible. Cyber incidents can not only disrupt operations, but also harm the organisation’s reputation and residents’ trust.
For example, if a municipality’s document management system is disrupted, the processing of residents’ requests may be delayed. If user accounts at a school are compromised, pupils’ or staff members’ data may become accessible. If a museum or library loses access to digital resources, both internal work and visitor services are affected. Therefore, cybersecurity should be seen as an integral part of service quality and business continuity.
Main cybersecurity measures
- Regular system updates. Updates to software, content management systems, plugins and servers help patch known security vulnerabilities. For public bodies, it is important to have a clear update process so that critical fixes are deployed on time and do not create unnecessary risk.
- Strong passwords and additional account protection. A password alone is often not enough, so it is worth using multi-factor authentication for administrators’ and staff accounts. This is especially relevant for systems that process personal data, documents or internal correspondence.
- Staff training. Some incidents start not from a technical vulnerability, but from human error – an unrecognised fraudulent email, an unsafe file or a misused account. Regular training helps staff recognise risks and handle information responsibly in day-to-day work.
- Backups. Data backups make it possible to restore operations faster after a technical failure, malicious software or accidental data loss. It is important not only to make backups, but also to check periodically whether they can actually be restored successfully.
- Access management. Staff should have only the rights necessary to perform their duties. This principle reduces the risk that a misused account will provide access to an excessive amount of sensitive information.
- Incident management plan. The organisation should know in advance what to do when a security incident occurs: who is responsible, how the problem is isolated, how managers are informed and, if necessary, how data subjects are informed. A clear plan helps you act quickly and reduce chaos in a critical situation.
Compliance with legislation and GDPR
Public bodies in the EU must comply with applicable cybersecurity requirements and organise the protection of information resources responsibly. GDPR compliance is just as important when personal data are processed. This means that security measures must be selected according to the nature of the data processed, the risk and the organisation’s actual processes.
If an organisation’s website has contact forms, registration systems, newsletter subscriptions or self-service functions, it is necessary to ensure secure data transmission, a clear legal basis for data processing and proper access control. It is also important to have internal procedures for dealing with a possible personal data breach. Cybersecurity and personal data protection are closely linked here – technical measures alone are not enough if there is no clear responsibility and no processes in place.
Accessibility and security must work together
When developing or maintaining public-sector websites and digital systems, it is important to balance accessibility and security. Security solutions should not place unreasonable barriers in the way of people with disabilities, older residents or users with fewer digital skills. For example, login, form-filling or identity-verification processes must not only be secure, but also clear, understandable and technically accessible.
Good practice is to define security requirements when planning the website or system, rather than only after launch. This makes it easier to ensure that the solution meets both the organisation’s needs and the requirements of legislation and users’ expectations. In the public sector, this is especially important because digital services must be reliable for all residents.
A continuous process, not a one-off action
Cybersecurity is not a one-off project or only the responsibility of the IT department. It is an ongoing process that covers technology, internal rules, staff habits and management attention. Even a well-protected system faces new threats over time, so it is necessary to review risks regularly, update measures and test incident readiness.
For public bodies, it is worth seeing cybersecurity as a long-term investment in service continuity, residents’ trust and responsible data processing. Properly maintained systems, clear processes and trained staff help reduce risk and ensure that digital services operate safely, stably and reliably.
Are you developing or updating a public-sector website? Tobalt provides website development services and ensures cybersecurity and protection for public bodies.