Public administration is the most frequently attacked sector in Europe. While federal and state governments often have their own IT security teams, many municipalities struggle with limited resources: too little budget, too few specialized staff, and too many legacy systems. It is precisely within this challenging environment that the city of Wuppertal has taken a remarkable step.
Software from the health department, for the health department
VEO, short for “Verwaltung Elektronisch Organisiert” (Electronically Organized Administration), is a case management solution developed in-house by the Wuppertal Health Department together with the Office for Digitalization. It digitally maps central tasks of the public health service: the evaluation of water samples, the tracking of reportable infectious diseases, and recurring administrative processes such as document filing and follow-ups.
For around 400 nursing homes and other medical facilities in the city, this specifically means that hygiene certificates are now fully digital, instead of being printed and submitted by post or email. . Incoming reports are automatically assigned to the appropriate process. The next expansion step planned is the integration of drinking water monitoring. The evaluation carried out by SRC confirmed the effectiveness of the product’s security measures.
Voluntarily certified – with results
What makes VEO special is not just the in-house development, but the path the city took afterwards: it voluntarily underwent an Accelerated Security Certification (BSZ) by the Federal Office for Information Security (BSI). The BSZ is a comparatively lean certification process developed to provide manufacturers with predictable effort without losing depth of testing.
As the testing laboratory, SRC took over the evaluation and simulated exactly those scenarios in targeted penetration tests that matter most for a system with sensitive health data: Can user login be bypassed? Are login credentials truly protected? Are there ways to gain unauthorized access? It was precisely in these areas that VEO had to prove its resilience.
At the beginning of July 2026, the city of Wuppertal received the completed certificate at the city hall. This makes it the first municipality nationwide to have fully completed a BSZ.
Why this is relevant beyond Wuppertal
This example is interesting for other municipalities for two reasons. Firstly, it shows that municipal in-house developments—not just standard software from large manufacturers—can be certified, and that this effort is worthwhile: it builds trust among citizens and employees. Secondly, the BSZ process makes exactly what municipalities often lack possible: a predictable, time-limited testing process that does not require the resources of a full Common Criteria certification.
Part of the VEO development was, by the way, supported by EU funding and funds from the Federal Ministry of Health, with a total volume of 1.3 million euros. This is an indication that paths to secure digitalization are open even for municipalities with limited budgets of their own.
SRC congratulates the city of Wuppertal on this important step and thanks the BSI for the trustful cooperation throughout the entire process.
Image copyright: Assunta Jaeger.
