Sovereign, accountable IT and security for public services.
Ministries, agencies and municipalities run critical services on tight budgets and ageing systems, under strict data-sovereignty rules. Simorin runs inside your jurisdiction, on-premise or air-gapped, with every action accountable.
The most targeted sector in Europe.
Public administrations face more attacks than any other sector, and most start with an unpatched system.
Every identity, device and server is under one agent, so a small team covers the whole estate.
Known-exploited vulnerabilities are patched first, including on legacy and agent-less systems.
Contractors and suppliers get time-limited, logged access that ends with the contract.
Statistics are from the third-party reports named on each card. They describe the industry, not Simorin results.
What you have to prove.
Key rules that apply in this sector. Which apply to you depends on where and how you operate.
| Regulation | What it asks of you | How Simorin helps |
|---|---|---|
| NIS2Directive (EU) 2022/2555 | Cybersecurity risk-management measures, management accountability, and early warning of significant incidents within 24 hours for public administration at central and regional level. | Asset, access, patch and incident evidence for your risk measures, plus correlated timelines for reporting. |
| Swiss Information Security Act (ISA)Reporting duty in force since 1 Apr 2025 | Operators of critical infrastructure in Switzerland must report cyberattacks to the Federal Office for Cyber Security (BACS) within 24 hours of discovery. | Incident timelines across identity, devices and servers, ready for a report within hours, not days. |
| CIRCIAUS · final rule pending | Would require covered critical-infrastructure entities to report significant incidents to CISA within 72 hours and ransom payments within 24 hours. | Correlated incident timelines that make fast reporting realistic. |
| GDPR / Swiss FADPEU and Swiss data protection | Appropriate security for personal data and breach notification, for example within 72 hours to the authority under GDPR. | Data-protection controls, access logs and breach timelines, kept in the region you choose. |
Summaries for orientation only, not legal advice. Check obligations with your counsel.
Where Simorin works in the public sector.
Sovereign deployment
Run fully inside government data centres, on-premise or air-gapped.
Legacy systems
Manage and patch older systems agent-less, where nothing can be installed.
Contractor access
Time-limited identities for suppliers, removed when contracts end.
Many agencies, one platform
Multi-tenant separation for agencies or municipalities, with shared policy templates.
Accountability
Every action and approval recorded for audit offices and oversight.
Citizen-facing staff support
AI service desk for staff, so IT teams focus on services.
Your data stays where your regulator wants it.
Seven connected domains, with autonomous AI agents governed by your policies and approvals.
Questions the public sector teams ask.
Can Simorin run without any foreign cloud?
Yes. It runs fully on-premise or air-gapped, including the agent’s reasoning.
Can several agencies share one deployment?
Yes, with strict tenant separation and per-agency guardrails.
Which public-sector certifications do you hold?
Contact our team to review the documents and contractual requirements for your organisation.
Bring managed autonomy to public IT.
A confidential 30-minute session on sovereign deployment.