The numbers that define us
years in IT
clients across 12 industries
contract renewal rate
completed projects
critical devices managed
certified technology vendors
When the tax system doesn't work, the counter jams and the queue becomes endless.
Public institutions are among the most frequent targets of cyberattacks, for a structural reason: infrastructures have grown in stages, on annual budgets, with understaffed IT teams and with data the institution is not allowed to lose — tax records, urban planning, social assistance, registry, electronic archive, etc.
At the same time, the regulatory framework has changed, so central public administration is one of the areas targeted by GEO 155/2024, the act transposing the NIS2 Directive into Romania. What this means in practice for a given institution differs between the central and local levels and is determined for each institution individually. Added to this are GDPR requirements for citizens' data and the need to keep electronic documents long-term, in a verifiable format.
In addition, there are also local public administration authorities that have decided to comply voluntarily with the NIS2 Law in order to benefit from monitoring and support from the National Cyber Security Directorate.
We have worked with public institutions for more than 20 years, experience that gives us a particular understanding of the framework in which they operate: public procurement, annual budgets, subsequent audits. We don't propose solutions that cannot be contracted; rather, we want to support you so that IT infrastructure is a help, not a problem.
Five situations we've encountered in public institutions
Services to citizens depend on systems that no one monitors continuously.
Taxes, registry, civil status, urban planning are services that usually no one checks, and the first person to notice they aren't working is usually the citizen trying to access them.
The backup runs, but a full restore has never been tested.
In a ransomware attack — the most frequent attack scenario in public administration — an untested backup is more of a hindrance. The vast majority of institutions have a backup, but unfortunately no one tests it periodically, so when it's actually needed, it doesn't work as expected.
The entire infrastructure is in one person's head.
Passwords, configurations, vendor relationships, intervention history are undocumented and known only to the IT administrator. If that person is unavailable or leaves, all that information leaves with them, which can quickly become a critical situation for the entire institution.
Old applications and equipment share the data network with new systems and applications
Alongside the critical applications the daily activity depends on, there are also operating systems of secondary importance, often without updates. Un-isolated, they become the entry point for an attack that will compromise the entire infrastructure — including critical systems.
The budget is annual, but the problem is permanent.
Investments are approved once a year, but incidents don't follow the budget calendar. Without an assessment that puts priorities on paper, money is allocated based on the need for renewal.
If your institution finds itself in any of the situations above, an assessment puts on paper exactly where you stand, what needs urgent remediation and what can wait for the next budget cycle. The solution is methodical and doesn't happen overnight. The good news is you don't have to rebuild everything from scratch.
The ITPS approach in the public sector
Monitoring and intervention
Through our Managed Services, we continuously monitor critical systems: citizen applications, the electronic registry, servers and the network. We often intervene before the problem is noticed by anyone. Response times are set by contract and SLA.
A process for detecting, classifying and escalating incidents.
Together with you, we define the process by which an incident is detected, classified and escalated on time, with written roles and steps. Handling an incident no longer depends on who happens to be on duty.
Documentation that supports compliance
We work according to ISO 27001:2022 certified processes and build the security documentation together with you: access policies, a record of technical measures, data processing agreements (DPA). So that when an audit comes, all the answers exist in writing.
Backup and documented restore tests.
We don't consider a backup functional until its restore has been tested and recorded. Data can be replicated in our Timișoara datacenter, on Romanian territory.
Network segmentation for applications that cannot be replaced.
We segment the network so that old applications and equipment keep working, without exposing the rest of the infrastructure to risk.
A whole team of engineers
Your infrastructure is documented: configurations, procedures, intervention history. Continuity no longer depends on one person's memory. And if you already have an in-house IT specialist, we work alongside them, complementing their skills.
Coverage outside public opening hours.
Systems don't stop when the counter closes, given that there are nighttime processes, reports and updates. Our contracts cover the intervals in which your institution works — one of the reasons 95% of our clients choose to renew their contracts.
The relevant services for public institutions
Out of the suite of services we offer, four are of particular importance for the smooth functioning of a public institution:
IT Audit & Consulting →
A complete analysis of the IT environment: current vulnerabilities, applicable regulatory requirements, remediations catalogued by priority and budget impact. The document a justified procurement starts from.
Managed Services →
We augment the internal team with specialists in specific technologies. We take over systems monitoring and provide on-site intervention for incidents. You run the institution, and we handle IT.
Backup & Disaster Recovery →
Backups for the institution's records and day-to-day systems, with documented restore tests and a clear recovery plan in case of an incident.
Hosting & Colocation →
A second point for critical systems, in our Tier III datacenter in Timișoara — replication and continuity when the on-site infrastructure is unavailable. Data stays on Romanian territory.
Not sure yet whether and how GEO 155/2024 applies to you? See also NIS 2 Consulting →
Compliance and certifications
Public administration is one of the areas targeted by GEO 155/2024, and institutions process citizens' personal data under the GDPR regime. ITPS operates its own Tier III, carrier-neutral datacenter, with ISO 27001:2022 (information security) and ISO 9001 (quality management) certifications, keeping data on Romanian territory at all times. We don't promise to „make you compliant" — compliance remains your institution's responsibility. What we do concretely is implement the technical measures, build the documentation that proves them and sign the agreements that clearly define each party's responsibilities.
Avem peste 80 de certificări pentru platformele pe care rulează afacerea dumneavoastră. Colaborăm cu 20 de furnizori de tehnologie best-of-breed.
Request an assessment of your institution's IT infrastructure.
An ITPS engineer analyzes the current state of your infrastructure together with you: where the risks are, what the regulations require, what's worth remediating by priority and budget.
We reply within the next business day.