Industry
Technology and security for government and the public sector
Public bodies hold data that citizens cannot withhold and run services people depend on, often on legacy estates. Onion Infosec supports modernization, operation and security of those systems.
- Sector
- Government & Public Sector
- Segments
- Central and federal agencies, State and local government, Public digital services, State-owned enterprises
01Context
Public-sector systems hold data that citizens cannot choose to withhold and deliver services that people depend on.
The adversaries range from criminals to state actors.
The work happens on procurement cycles and legacy estates that resist rapid change. Long-lived applications have been given modern connectivity without a matching investment in their security, and contractors and suppliers hold significant access. Outages and breaches are public events, and they affect trust in the service as well as the service itself.
02Technology
What the sector builds and runs.
- Digital public services
- Citizen portals, forms, identity and payment integrations built for accessibility, high transaction volumes and clear audit trails.
- Legacy modernization and cloud
- Assessment, re-platforming and migration of long-lived applications to approved cloud environments, with data residency and sovereignty requirements designed in.
- AI in public services
- Document processing, case triage and citizen assistance, designed with human review, transparency about automated steps and records retention.
- IT operations
- Endpoint, identity, network and service desk operations with 24×7 monitoring and support, documented to public-sector audit standards.
03Risk
The risks that matter most.
- State-aligned targeting
- Persistent actors seeking access to government networks, data and the suppliers that government depends on.
- Disruption of citizen services
- Ransomware and DDoS against services where downtime is publicly visible and affects people directly.
- Legacy system exposure
- Long-lived applications with modern connectivity and accumulated technical debt.
- Supplier and contractor access
- Third parties with standing access to systems and data, managed under contracts that predate current security expectations.
04Regulation and assurance
What you may need to demonstrate.
NIST SP 800-53 and NIST CSF are widely used control references, with FedRAMP for cloud services to US federal agencies. ISO 27001 and the CIS Controls are common internationally. NIS2 brings public administration into scope in the EU, and GDPR governs personal data. National examples include the NCSC Cyber Assessment Framework in the UK, and CERT-In directions and the DPDP Act in India.
Which of these apply depends on where you operate and what you do. We scope against your actual obligations.
05Where we usually start
Services that matter most here.
Managed SOC and MDR
24×7 monitoring and incident handling with the reporting discipline that national CERT notification rules require.
Managed IT services
Patching, identity, endpoint and backup operations for large, aging estates, with clear records of what was changed and when.
GRC and compliance
Control frameworks, risk management and audit support aligned with national security standards and privacy law.
Cloud transformation
Migration planning and execution for legacy applications, with residency, classification and exit requirements addressed in the design.
Software and product development
Citizen-facing services built accessibly and securely, with documentation that survives a change of supplier.
Zero trust
Identity-centered access for staff, contractors and suppliers, replacing broad network trust in stages.