WZ-IT supports this through the relevant service: Proxmox for public authorities.
Proxmox VE is used in public administration. The vendor publishes deployment reports. These document individual architectures, not universal suitability for every authority. This article focuses on technical assessment.
As of October 2026. The technical statements follow the linked primary sources.
Contents
- Assess documented deployments
- Check transferability to your authority
- IT-Grundschutz as an outline for the assessment
- Separate technology and responsibility
- Define operations and handover
Assess documented deployments
A published municipal deployment report from Italy describes Proxmox VE, Ceph and PBS as a combined infrastructure. It reports modernisation of an existing environment and building operational skills through training. This is a vendor publication about a third-party project, not a WZ-IT reference. Names and case figures are intentionally omitted here.
A second vendor report from German hospital operations documents Proxmox VE with PBS and highlights operational documentation. This report concerns a university hospital rather than municipal core administration. It establishes only the described deployment and is not a WZ-IT reference.
The supported conclusion is limited: a municipality deployed these components. The report does not establish German procurement approval or certification of Proxmox for every administrative process. Further evidence can be located through the vendor’s government filter.
Check transferability to your authority
The following is a technical checklist, not a legal or certification assessment.
| Area | Evidence for your environment |
|---|---|
| Administrative applications | Vendor approval and documented functional test |
| Identities | Role model, administrative accounts and access revocation |
| Data | Inventory primary data, backups and administrative access paths |
| Availability | Document failure assumptions, quorum, storage and emergency operations |
| Recovery | Accept backups, key access and application recovery together |
| Procurement | Have responsible teams assess scope, evidence and exit requirements |
IT-Grundschutz as an outline for the assessment
Many authorities structure the security assessment according to the BSI's IT-Grundschutz Compendium. The modules work as a grid for ordering technical evidence. The mapping is a working aid, not Grundschutz evidence and not a certification:
| Module | Subject | Evidence for Proxmox VE |
|---|---|---|
| SYS.1.5 Virtualization | Securing the virtualization infrastructure | Access, permissions, network separation, host maintenance |
| ORP.4 Identity and access management | Accounts, roles, revoking access | Realms, roles, 2FA, API tokens, emergency access |
| NET.1.1 Network architecture and design | Segmentation and zones | Network plan, firewall rules, separate management, cluster and guest networks |
| OPS.1.1.3 Patch and change management | Updates and changes | Update process, maintenance windows, change log |
| OPS.1.1.5 Logging | Logs and traceability | Log forwarding, retention, log access |
| CON.3 Backup concept | Backup and recovery | Backup concept, offsite copy, key storage, restore evidence |
| DER.4 Business continuity management | Recovery in an emergency | Recovery objectives, runbook, emergency exercise |
Which modules apply to your authority follows from the modelling of the information domain and the protection requirement. The technical guides: Secure and harden Proxmox, Set up Proxmox Backup Server and Disaster recovery.
Separate technology and responsibility
Proxmox VE integrates KVM, containers, cluster management and role-based administration (feature overview). These capabilities require an operational design. HA does not replace backup, and a German server location is not a complete sovereignty assessment.
ZenDiS provides an approach to assessing dependencies and exit strategies. The sovereign virtualization checklist applies that perspective to access, data and operator changes.
Define operations and handover
WZ-IT offers Proxmox services for public authorities. Define inventory, responsibilities, backups and handover against your requirements. Technical consulting does not replace approval by the responsible application, procurement and data protection teams. Adopt a reference architecture only after this assessment.
Further reading
- Proxmox Pros and Cons - and When It Fits
- VMware alternatives: assess Proxmox, Hyper-V, XCP-ng and Nutanix
Relevant service: Proxmox for public authorities.
