The municipal level is where the State touches residents' lives every day · licences, permits, complaints, registers, small-scale procurement, primary healthcare, waste collection, street lighting, neighbourhood security. It is also the level where investment in cybersecurity and institutional integrity is structurally lowest. This technical observation sets out that asymmetry in Argentine local governments — municipalities, communes, governing boards — based on public incidents in 2024 and 2025. The thesis fits in one line. The predominant exposure is organisational rather than technological.
The practical context
Argentina has more than 2.200 local governments. The exact number varies depending on the register consulted, and that imprecision is itself a data point on the state of the public inventory. Capabilities vary radically · large urban municipalities operate with professional staff and integrated systems, while small jurisdictions manage the same types of sensitive data on personal computers, without a backup policy, identity management or internal audit.
Publicly documented incidents during 2024 and 2025 include — without claiming to be exhaustive — municipal servers held hostage with disruption to cadastral services, exposure of resident databases containing sensitive personal information and unauthorised interference in municipal charge and revenue collection systems. Each exploited one of the four vulnerabilities in the following table. None of the four is solved by buying technology.
Four structural vulnerabilities
| Vulnerability | Observable sign | Cost on the day of an incident |
|---|---|---|
| No inventory of critical systems | No one can list which systems process sensitive data, which supplier maintains each one or under which contract | The scale of the damage is discovered during the incident · every hour of diagnosis is an hour of service downtime |
| No identity management | Active credentials of former employees · shared administrator accounts · basic passwords on systems containing personal data | Improper access without an identifiable actor · reconstructing who did what becomes impossible |
| Unaudited suppliers | Continuous remote access by the management system supplier, without security clauses or an obligation to report incidents | The vector enters through the contract. The municipality finds out from residents before it hears from the supplier |
| Untested backups | Formal backups without a single recorded restoration exercise | On the day of the incident, the backup is corrupt, outdated or takes weeks · residents' data cannot be recovered |
The standard without the certificate
ISO/IEC 27001 — originally intended for private organisations — is entirely applicable to the public sector. Jurisdictions that have implemented information security management systems under an international standard gain exactly what the preceding table shows is missing · an inventory with assigned owners, managed identities, suppliers under auditable contracts, tested restoration.
The common argument — «municipalities have no budget for certification» — confuses implementation with certification. The operational framework can be implemented with or without a certificate. Certification adds third-party verification when maturity justifies it. For a government that manages its residents' sensitive personal data, operating under a minimum security management framework is the mandatory part; the certificate is the optional part. A municipality discussing the cost of the certificate without having implemented the framework is discussing the optional part.
Patterns detected in small jurisdictions
A review of public evidence on small and medium-sized Argentine municipalities reveals three recurring patterns —
- Critical systems operated without a formal security policy. Responsibility floats between the mayor's office, the government secretariat and the external supplier
- Municipal internal audit — where it exists — focused on accounts and procurement. Digital systems remain outside its scope
- No continuity plan for a cyber incident, or one reduced to a document that no one has rehearsed
Minimum protection · five components with deadlines
Five operational components, ordered by implementation deadline. None requires specialised software or an extraordinary budget · they require a decision by the municipal authority and an accountable signatory for each component.
Auditable inventory of critical systems
Which systems process sensitive data, which supplier maintains each one, which contractual clause applies. An up-to-date spreadsheet with accountable signatories is enough to start. What makes it auditable is the signature and the date, and that takes a decision before it takes money.
Identity management policy
Credential creation and deactivation within defined deadlines · named accounts instead of shared ones · periodic review of privileged access. A departing employee's credentials are deactivated on the day they leave.
Contractual clauses with suppliers
Defined and revocable access, an obligation to report incidents within a specified timeframe, audit rights. The existing contract is renegotiated at the next renewal. A new contract starts with the clauses in place.
Effective restoration exercise
Actual restoration of the critical systems in the inventory, measured against a declared recovery objective, with a dated record. The only backup that counts is one that has been tested.
Annual internal audit of digital systems
With an auditor of accredited technical competence · covers the four preceding components and reports to the municipal authority, with verifiable findings and follow-up of actions. Closes the first cycle and sets up the second.
The municipal decision
Every municipal authority with a population exceeding fifty thousand inhabitants should establish the five components within a maximum horizon of eighteen months, following the staggered deadlines in the cards · inventory and identities first, contracts and restoration next, internal audit to close the first cycle.
The five components directly address the four documented vulnerabilities — with or without formal certification, using the regular budget. All they require is an accountable signatory for each component · which is precisely what is missing today.
The municipality that manages the register, primary care records and residents' complaints manages the most sensitive part of the state's everyday life. The trust that residents place in it is not sustained by declarations. It is sustained by the five components in the table, each with a signed trail that a third party can verify. That is the difference between declaring that data is protected and being able to demonstrate it.