Public sector software: A comprehensive guide to safety requirements

The public sector in Germany is undergoing profound digital transformation. From electronic file management to complex specialist applications – software has become the backbone of modern administration.

With increasing digitalization, however, the needs for IT security are also increasing.

In specific, the public sector software is subject to strict regulations and high goals of the protection of sensitive civil and administrative data.

In this article we illuminate the central security needs and show what is important in the development and rollout of secure software for authorities.

Legal and regulatory framework

The public sector in Germany is undergoing profound digital transformation.

For Public sector software: A complete guide to safety needs, Industry: Public administration outlines how we support rollout and delivery.

The development of public sector software does not move in the air empty space. A variety of laws, regulations and standards provide the framework for IT security.

Among the most important are:

• BSI Act (BSIG): The Federal Office for Security in Information Technology (BSI) is the legal basis for IT security in the federal administration.
• IT basic protection of BSI: The basic IT protection provides a practical approach to implementing IT security measures. It contains detailed building blocks and procedures that apply as a de facto standard for public administration.
• NIS-2-Directive: The European Network and Information Security Directive (NIS-2) reinforces cyber security needs for operators of critical infrastructures, including parts of public administration.
• General Data Protection Regulation (GDPR): The GDPR places high demands on the protection of personal data that are central to the development of administrative software.

These needs define not only technical minimum standards, but also establish processes for the management of information security that must be taken into account in software development.

Central security requirements for software in the public sector

In addition to complying with legal needs, concrete technical and organisational measures must be introduced in the development of software for public administration.

These can be divided into different areas:

Confidentiality, integrity and availability

The classic protection goals of information security are also core for public sector software:

• Confidence: Sensitive data such as social or health data must be protected from unauthorized access. This requires solid rights and role management as well as continuous encryption of data – both during transmission and storage. *Integ

  Sources: Public-sector security goals (Germany): BSI. Statistics: Federal Statistical Office of Germany. Funding: KfW, BAFA.

References and further reading

The following separate references complement the topics in this article:

• Bitkom – German digital industry association.
• German Federal Office for Information Security (BSI).
• European Commission – Digital strategy.
• MDN Web Docs (Mozilla)
• W3C – World Wide Web Consortium.

"Mobile apps need clear offline and security models alongside UX—trust collapses without both."

— Björn Groenewold, Managing Director, Groenewold IT Solutions

Frequently Asked Questions (FAQ)

What is this article about: “Public sector software: A comprehensive guide to safety requirements”?

This post explores Public sector software. A complete guide to safety needs from the perspective of needs, typical pitfalls. And sensible next steps.

In short: The public sector in Germany is undergoing profound digital transformation.

Who benefits most from the content described here?

Useful for project leads and product owners in Software development who must choose between standard software, custom development, and integration.

How does this topic fit into an IT or digital strategy?

Technically and organizationally, alignment with experienced partners pays off — from requirements to operations; start with the [services overview](/en/services/software-development). For multi-system landscapes, [IT consulting and architecture](/en/services/it-consulting) helps align vendors and internal teams.

What are sensible next steps if we need support?

A practical next step: book a consultation and clarify which MVP or pilot fits your team and landscape.