Innovative strategies for the in-house operation of security-critical IT infrastructures in the public sector

Organisations responsible for operations in the public sector face a wide range of challenges that have a significant impact on their day-to-day operations and long-term strategies. The need to ensure the highest levels of security and data protection is further exacerbated by advancing digitalisation and a shortage of skilled staff. Efficiency in the management and operation of critical IT infrastructures is no longer merely a goal, but an essential prerequisite for meeting current and future requirements.
The pressure to meet these requirements is further intensified by the increasing complexity of modern IT landscapes. Security threats are constantly evolving, making it difficult for organisations to keep pace with the latest developments whilst simultaneously fulfilling legal and organisational obligations. The multitude of tasks and responsibilities requires not only technological expertise but also a strategic approach to the management of resources and processes.

The operation of security-critical IT infrastructures in the public sector is characterised by a wide range of complex challenges.

• Skills shortage: A projected shortage of over one million IT specialists by 2030 is making it difficult to operate and maintain complex IT systems.
• Digitalisation: Continuous adaptation to new technologies and processes, integration of old and new systems, and staff training.
• Security situation: The rise in cyberattacks and data breaches calls for robust security measures such as regular audits, firewalls and VPNs.
• Digital sovereignty and data sovereignty: Increased demands to ensure control over one’s own data whilst achieving maximum resilience.
• Complexity: Expanding IT environments comprising a wide variety of systems and applications increase the likelihood of errors and inefficiency.
• Cost pressures: The high costs associated with the purchase, operation and maintenance of new technologies call for the efficient use of resources and cost-saving measures.

Traditional in-house operating methods are increasingly reaching their limits when it comes to meeting these growing demands. The public sector must rise to this challenge and proactively seek solutions for the operation of its IT infrastructure.

The Classified Management Platform (CMP) offers a comprehensive solution to precisely these challenges. It has been developed to meet not only operational requirements but also the high standards of data protection, security, confidentiality and availability. It enables the seamless integration of the operation of various networks (SDx, WAN and LAN networks) and the monitoring and management of infrastructure and IT systems on a centralised platform. 

The CMP is characterised by a unified tool and process framework that has been specifically developed to simplify and standardise complex IT landscapes. This framework enables the monitoring and management of infrastructures and IT systems on a centralised platform, thereby significantly improving transparency and control. The use of common tools and processes promotes collaboration and reduces the likelihood of errors.
A key advantage of the CMP is its flexible operating model. The platform supports both in-house operation by the customer and operation by Telekom, as well as a hybrid operating model in which both parties work closely together and can dynamically allocate responsibilities. This enables rapid adaptation to current circumstances and requirements, which significantly increases responsiveness and efficiency.
Security is a top priority for the CMP. The platform meets the strict requirements of the Federal Office for Information Security (BSI) and is certified to ISO 27001 on the basis of IT-Grundschutz. These certifications guarantee that the highest security standards are maintained and that sensitive data is protected as effectively as possible.
Implementing the CMP requires experienced and security-vetted staff. Our “team” consists of highly qualified experts with extensive experience in managing security-relevant infrastructure.

The operation of security-critical IT infrastructures can be carried out either in-house by the organisation or by external partners. Each approach has specific advantages and is more or less suitable depending on the context and requirements.

In-house operation

In-house operation gives the organisations responsible for running the system full control and independence over their IT infrastructures and data. This control is particularly important when dealing with sensitive or confidential information. Direct control enables organisations to strictly monitor compliance with security standards and respond more quickly to threats.

Another important reason for in-house operation is regulatory requirements. In some cases, statutory or sector-specific regulations stipulate that certain IT services must be operated in-house. This applies in particular to areas where highly sensitive data is processed, such as in the field of national security or where highly sensitive personal data is involved. Where laws or regulations explicitly require in-house operation, this is not merely an option but an obligation.

Furthermore, specific security certifications, such as those required by the Federal Office for Information Security (BSI), can only be maintained through internal processes. These certifications are often linked to specific security standards, which can be better ensured through in-house operation. Overall, in-house operation offers the opportunity to efficiently meet security requirements, regulatory requirements and specific certification requirements.

Operated by a partner

Outsourcing to an external partner offers numerous advantages that can help overcome the challenges posed by in-house solutions.

A key advantage of outsourcing operations to a partner is resource efficiency. By utilising a partner’s infrastructure and staff, operating costs can be significantly reduced. External service providers often have access to state-of-the-art technology and specialist staff, which enhances the efficiency and effectiveness of IT services. This is particularly advantageous in times of skills shortages, as the partner can provide qualified staff. Another
advantage is scalability. External partners are more flexible and can quickly adapt their services to growing or changing requirements. This enables public organisations to respond to new challenges without having to make extensive internal adjustments.

Outsourcing operations to a partner is particularly suitable for standardised IT services that do not require specific internal management. Examples of this include general IT support services or standardised network services. If the organisation does not have sufficient qualified staff or technical resources to manage operations in-house, an external partner can offer an efficient solution. Outsourcing to a partner can also be advantageous for reasons of cost-efficiency, as external service providers can often operate more cost-effectively than in-house solutions.

Hybrid operating model

Hybrid models combine the strengths of in-house operations and those of an external partner to create a flexible and efficient solution. These models enable organisations to benefit from both the control and security of in-house operations and the resource efficiency and expertise of external service providers.

A key advantage of hybrid models is their flexibility. The dynamic allocation of responsibilities enables organisations to respond quickly to changing requirements and situations. For example, in crisis situations or for short-term projects, responsibilities can be adjusted to ensure optimal operations. This flexibility is particularly valuable when specialised skills or additional resources are needed at short notice.

In a hybrid model, in-house teams and external partners can work closely together to operate IT infrastructures efficiently. A common scenario is collaborative operation, in which the core infrastructure is managed in-house, whilst supporting services such as first-level support and on-site service are provided by a partner. This makes it possible to focus internal resources on strategically important areas whilst benefiting from the partner’s efficiency and expertise.

A look to the future shows that the challenges are not getting any smaller. Increasing digitalisation and the changing threat landscape require continuous adaptation and improvement. However, CMP is well equipped to deal with these developments and thus offers a sustainable solution for the secure and efficient operation of IT infrastructures in the public sector.

Optionally, subject to the requirements mentioned, collaboration services and a Security Operations Centre (SOC) may also be provided in future as supplementary services.