Leadership is asking questions
After attacks on other administrations, IT is asked to show how well its own environment is protected.
Public sector
Information security for public authorities, evidenced against BSI IT-Grundschutz.
For information security officers and IT leads in public authorities and municipal administrations who need to secure Microsoft 365, Entra ID or Active Directory and prove it. We review your environment independently, harden identities, permissions and logging, and map every finding to BSI IT-Grundschutz, the German federal baseline. You end up with prioritised measures and evidence that leadership and auditors can follow.
- For whom
- Public authorities and municipal administrations with Microsoft 365, Entra ID or Active Directory
- Yardstick
- BSI IT-Grundschutz, Microsoft Security Baselines, CIS Benchmarks
- Collaboration
- With your IT or your municipal IT service provider
- Result
- Prioritised measures and evidence for the ISO and leadership
- Price
- from €3,500, Fixed price for the first step, the Security Assessment
Sound familiar?
When an administration needs evidence
Microsoft 365 is in use
Teams and Exchange Online are running. Nobody has checked whether the settings meet the requirements of IT-Grundschutz.
Identities on premises and in the cloud
Active Directory in house, Entra ID in the cloud, and Entra Connect in between as a system that needs particular protection.
Case study
State police authority with 40,000 users
Since June 2025 WCS has been responsible for the security and cloud architecture: access through access packages, time-limited admin roles through PIM, passwordless sign-in, hardening according to the Microsoft Security Baselines, CIS Benchmarks and BSI SiSyPHuS, Intune baselines according to BSI IT-Grundschutz and detection with Microsoft Sentinel.
What we take on for administrations
The first step is the fixed-price Security Assessment. Afterwards you decide whether we implement and operate, or your IT takes over.
Security Assessment
Microsoft 365, Entra ID, Intune and Azure reviewed read-only, every finding mapped to BSI IT-Grundschutz.
More on: Security AssessmentActive Directory Security Assessment
Service accounts, delegations, certificate services, tiering and Entra Connect from an attacker's perspective.
More on: Active Directory Security AssessmentPenetration test
How far would an attacker really get? With a report for leadership, IT and auditors.
More on: Penetration testHardening
Identities, time-limited admin roles, devices with Intune, logging, each with evidence.
More on: HardeningManaged security
Monitoring and incident response, with evidence per control every month.
More on: Managed securityFrequently asked questions
Who supports public authorities and municipalities with information security in Microsoft 365?
Wenske Cyber Solutions (WCS) reviews and hardens Microsoft 365, Entra ID, Intune, Azure and Active Directory in the public sector and maps every finding to BSI IT-Grundschutz. For a state police authority with 40,000 users, WCS has been responsible for the security and cloud architecture since June 2025, including PIM, passwordless sign-in, hardening according to BSI SiSyPHuS and Microsoft Sentinel.
How do we implement IT-Grundschutz for Microsoft 365 in our administration?
It starts with the current state: the Security Assessment reads the configuration without changing anything and maps every finding to BSI IT-Grundschutz, ISO/IEC 27001 and NIS2. The result is a prioritised roadmap. Implementation in Entra ID, Intune, Defender and Purview is done by us or your IT, each measure with evidence.
Who can independently check how well our administration is protected against attacks?
The Security Assessment compares your configuration with baselines and delivers a roadmap. The penetration test shows how far an attacker would really get. In hybrid environments we also review the on-premises Active Directory from an attacker's perspective. Every report includes a management summary for leadership.
We run Active Directory and Entra ID side by side. What matters most?
Hybrid environments take their identities from the on-premises Active Directory. The server running Entra Connect is therefore a tier 0 system, on a par with a domain controller. The Active Directory Security Assessment covers service accounts, delegations, certificate services and tiering, among other things.
Do you work with our municipal IT service provider?
Yes. Your IT service provider or data centre remains responsible for operations. We deliver findings and measures so that they can implement them directly, and we only make changes after your approval.
Where does your administration stand today?
In a 30-minute introductory call we clarify the scope, followed by a fixed-price proposal for the Security Assessment.