BSI WiBA: The path to basic protection for municipalities

What is WiBA? The BSI's path to basic protection

WiBA stands for „Weg in die Basis-Absicherung“ (path to basic protection) and is an offering of the Federal Office for Information Security for institutions that do not yet have a structured information security process. At its core are 19 checklists that an administration can work through without prior knowledge; the BSI FAQ mentions around 250 check questions and estimates about two days for the initial survey. According to the same source, WiBA was developed for municipalities, in particular small municipalities. The checklists were published on October 20, 2023; the WiBA 2.0 core documents are dated April 10, 2024.

The purpose is deliberately narrow: WiBA is meant to make the first step possible, not the last. It answers the question of where an administration stands today and which gaps should be closed first — not the question of what a complete management system looks like.

How the checklists are structured

Each checklist follows the same pattern: it names the underlying modules, an objective, a general note, and then the check questions. Each check question is answered with yes, no, or "not relevant"; in addition, there are aids, an effort estimate in four categories, and a notes field. WiBA 2.0 builds on the IT-Grundschutz profile „Basis-Absicherung Kommunalverwaltung“ in version 4.0 of November 23, 2023.

The recommended processing order arranges the 19 checklists into four priority levels. Priority 1 comprises five topics: backup, IT administration, organization and personnel, roles and authorizations including authentication, and preparation for security incidents. Priority 2 follows with seven topics ranging from office software and networks to the server room, priority 3 with five more, and finally priority 4 with printers and telephony. The BSI justifies priority 1 by stating that these checklists form the basis for the others and reduce the greatest cyber risks for municipalities. The order is not binding: it may be adapted to local circumstances, and priority 1 does not have to be completed in full before other checklists are started.

There is a separate document for the management level: the Management Summary describes what lies with management itself: it always bears overall responsibility, sets the strategy and security objectives, and provides for responsibilities and resources.

Where WiBA stands in IT-Grundschutz — and what it is not

In the procedure document, the BSI expressly places WiBA "below basic protection" and below the IT-Grundschutz profile „Basis-Absicherung Kommunalverwaltung“. It is thus the stage before the actual entry, not an alternative to it. The BSI itself names three distinctions:

• WiBA is not a standard for information security and does not replace the implementation of recognized standards.
• WiBA is not an ISMS. A management system for information security requires measures beyond WiBA; WiBA works without a methodology such as ISO 27001.
• WiBA covers neither data protection nor classified information protection and is not suitable for institutions that are legally classified as KRITIS (critical infrastructure).

Certification under WiBA is currently not possible, and according to the BSI, genuine certification is not intended either. However, the BSI is working on a way to have the implementation of WiBA confirmed on the basis of a self-declaration. The next step is the profile „Basis-Absicherung Kommunalverwaltung“, followed by standard protection.

Do municipalities have to implement WiBA?

Not nationwide. The procedure document makes clear that implementing WiBA — according to the document status of April 10, 2024 — is not mandatory but an offering; nor can the BSI prescribe it for municipalities. Individual federal states can, however, make WiBA binding for their municipalities — that is state law and must be checked in each individual case.

The NIS-2 implementation does not change this either, and this is where a widespread misunderstanding persists. The BSI Act (BSIG) as amended by the NIS2 implementation act has been in force since December 6, 2025, but in principle does not cover the core municipal administration: according to the BSI, it was decided not to make use of the option of extending the scope to public administration at the local level; implementation in separate state legislation remains unaffected. According to the same account, legislative competence for the cybersecurity of the states and municipalities lies with the states and municipalities themselves. For companies, things are different — anyone who wants to know who NIS-2 actually covers will find the distinction there.

Two qualifications apply. First, municipal enterprises and holdings may well fall under the BSIG if they provide services for a fee in a covered type of entity and exceed the thresholds; this depends on the individual case. Second, the states regulate the information security of their municipalities themselves, and they do so inconsistently. Saxony, for example, has its own framework with the Sächsisches Informationssicherheitsgesetz (Saxon information security act, version valid from August 16, 2025): as non-state bodies, municipalities there must take appropriate organizational and technical precautions; the BSI standards and the IT-Grundschutz Compendium are recommended to them for application, while the standards of the IT Planning Council must be complied with. Information security officers should be appointed — they must be appointed on a full-time basis only at certain state bodies such as the state ministries, not at municipalities. In addition, there is a reporting obligation for bodies connected to the administrative network or the municipal data network. There is no official, consolidated overview of the situation in all sixteen states — looking into your own state law is unavoidable.

How a municipality proceeds

The procedure has two stages. First, the implementation status is recorded for each check question; then the open requirements are collected and prioritized. The BSI does not specify a fixed time frame for implementation. In practice, the following sequence has proven effective:

• Assign responsibility: one lead person, ideally the information security officer.
• Define the information domain: WiBA looks at the core administration; municipal enterprises can be included but require adjustments.
• Priority 1 first: backup, IT administration, organization and personnel, roles and authorizations, preparation for security incidents.
• Involve service providers: anyone who operates parts of the IT fills in the checklists for their area — this belongs in the contract.
• Involve management: according to the Management Summary, overall responsibility, security objectives, and resources remain the task of management.
• Prioritize gaps and set deadlines instead of tackling everything at once.

Municipalities that are expanding digital administrative services under the Online Access Act (OZG) at the same time would do well to think of both together: every new specialist application enlarges the information domain that WiBA queries.

Without trained employees, the checklist remains paper

"Organization and personnel" is in priority 1 in WiBA — and that is no coincidence. As a basic requirement of the IT-Grundschutz Compendium, the training requirement is formulated there in binding terms: the module ORP.3 „Sensibilisierung und Schulung zur Informationssicherheit“ requires, as a basic requirement, that the institution's management MUST be made sufficiently aware of security issues and that all employees and external users MUST be introduced to and made aware of the secure handling of IT, ICS, and IoT components, insofar as this is relevant to their work. A target-group-oriented awareness and training program is added as a standard requirement.

The guidance from the BSI and BBK on municipal IT crises also names trained employees as a prerequisite for the rapid and successful implementation of immediate measures. How an administration sets this up in practice is described in the article on security awareness in public authorities; where artificial intelligence is used in-house, the rules for it belong in a separate AI policy.

Why the effort pays off — and what comes next

The situation remains tense. For the reporting period from July 1, 2024, to June 30, 2025, the BSI situation report 2025 counts an average of 119 new vulnerabilities per day, around 24 percent more than in the previous reporting period — partly due to a changed reporting policy, according to the BSI. Specifically for municipalities, a study by the BBSR and Fraunhofer IESE from July 2025, based on the BSI situation reports 2023 and 2024, cites an average of two municipalities or municipal enterprises affected by ransomware per month.

A look ahead is also part of this: under the name Grundschutz++, the BSI is working on a new version intended to replace the IT-Grundschutz Compendium. According to the milestone plan published there, as of March 26, 2026, the pilot phase runs until the end of September 2026, and certifiability is planned for early 2027. For WiBA users, the news is good: the BSI writes that the checklists tested with WiBA have proven themselves in practice and will become an integral part of Grundschutz++. Anyone who starts with WiBA today is therefore not working in a vacuum — and, along the way, lays the groundwork for operating their own e-file and the other specialist procedures on a solid foundation. For the accompanying mandatory topics in public administration, Bridgly brings together the fundamentals in compliance training for the public sector.

What does WiBA mean at the BSI?

WiBA stands for „Weg in die Basis-Absicherung“ (path to basic protection). It is a BSI offering with 19 checklists and around 250 check questions that institutions without a structured security process can use to assess their status. The BSI estimates about two days for the initial survey; the current document status is WiBA 2.0 of April 10, 2024.

Is WiBA mandatory for municipalities?

Not nationwide. The BSI procedure document expressly describes implementation as an offering, not an obligation, and the BSI cannot prescribe it for municipalities. Individual federal states can, however, make WiBA binding for their municipalities — that is state law and must be checked in each individual case.

Are municipalities covered by NIS-2?

The core municipal administration, in principle, is not. According to the BSI, it was decided not to extend the scope to the local administrative level; the states are responsible, and implementation in separate state legislation remains unaffected. Municipal enterprises and holdings, on the other hand, may be covered if they provide services for a fee in a covered type of entity and exceed the thresholds.

Can you obtain certification under WiBA?

No. According to the BSI FAQ, certification is currently not possible and genuine certification is not intended either; however, the BSI is working on a confirmation of WiBA implementation on the basis of a self-declaration. WiBA is neither a standard nor a management system for information security, but the stage below basic protection. The next step is the IT-Grundschutz profile „Basis-Absicherung Kommunalverwaltung“.

• BSI – WiBA: Weg in die Basis-Absicherung, topic page (accessed 4 Sep 2026)
• BSI – WiBA: Procedure (document status: 10 Apr 2024)
• BSI – WiBA: Recommended processing order (document status: 10 Apr 2024)
• BSI – WiBA: Management Summary (document status: 6 Oct 2023)
• BSI – Questions and answers on WiBA (accessed 4 Sep 2026)
• BSI – Enabling cybersecurity: BSI publishes checklists for municipalities (dated 20 Oct 2023)
• BSI – Grundschutz++, milestone plan (as of 26 Mar 2026)
• BSI – NIS-2 in state and municipal administration (accessed 4 Sep 2026)
• BSI Act (BSIG) as amended by the NIS2 implementation act (in force since 6 Dec 2025)
• BSI – IT-Grundschutz module ORP.3: Awareness raising and training on information security (Edition 2023)
• BSI and BBK – guidance „Kommunale IT-Krisen: Handlungsfähigkeit sichern“ (accessed 4 Sep 2026)
• BSI – The State of IT Security in Germany 2025 (dated 11 Nov 2025, reporting period 1 Jul 2024 to 30 Jun 2025)
• BBSR and Fraunhofer IESE – Information security in municipalities (as of July 2025)
• Sächsisches Informationssicherheitsgesetz (version valid from 16 Aug 2025)
• Image license: AI-generated image (Bridgly), labeled "Created with AI" as an overlay; prompt in the field „Bild-Prompt (KI-Bild)“.

All sources accessed on 4 Sep 2026 unless otherwise stated in the entry. Legal texts carry their legal status in the entry; statistics carry their reporting period.