DATPOL SHIELD / POLISH LOCAL GOVERNMENT & LCPD
The shared DATPOL Shield foundation — SOC, NOC, SIEM, XDR/MDR and penetration testing — with the additional needs of Polish public bodies: accountability, log retention, procedures, evidence and support for statutory duties.
Automated monitoring 24/7. Staffing and response follow the agreed SLA.
SHARED PROTECTION. INSTITUTIONAL REQUIREMENTS.
Businesses and public bodies need visibility, response and continuity. Public institutions add formal governance and evidence requirements; regulated businesses may face similarly extensive duties.
SOC + NOC + SIEM + XDR/MDR, IT/OT monitoring, auditing and penetration testing. Use the same protection model with sources, permissions and procedures adapted to each body.
Explore the shared Shield service scopeAUDIT AND IMPROVEMENT
The initial audit includes a penetration test of the whole agreed network, followed by recurring tests within the service. Automated discovery is combined with manual validation and controlled proofs of concept. Reports include evidence, priorities, remediation, end-of-life equipment and retesting.
Frequency, authorisation, exclusions and methods are agreed in the contract. OT and critical services require an installation-specific safe testing plan; monitoring does not authorise disconnecting controllers.
THE INSTITUTIONAL SERVICE LAYER
First establish the body’s status, applicable rules and the roles of management, IT, the data protection officer and suppliers. Shield supplies agreed operational and documentary support.
Support collection of institutional data, sources, risks, contacts and incident processes. Essential or important entity status and deadlines require an individual assessment, including for businesses within the Act’s scope.
Inventory, access control, vulnerability handling and evidence support information security management. Where KRI applies, account for internal security audits at least annually. A technical penetration test does not replace a complete organisational audit.
Agree party roles, data scope, authorisations, confidentiality and processing terms where needed. Document technical findings and support the DPO; the relevant controller retains statutory notification decisions.
Define receipt, analysis, notification and response, deputies, out-of-hours access and approval-required actions. Remote handling, site attendance and service restoration are separately agreed.
Define scope, ownership, permissions and report recipients for each body. Only authorised people receive consolidated views. LCPD can support the project; a new data centre is not a prerequisite.
Prepare technical scope, source lists, test scenarios, acceptance records and exit data handover. The authority approves its procurement documentation under its own procedures.
Reviewed on 29 October 2026. This describes service support, not legal advice or compliance certification. Check legislation, entity status and procurement requirements for the actual deployment. Polish regulatory content does not establish UK compliance.
RETENTION AND ARCHIVING
Design and price retention options of 24 months or longer. Separate fast search from archiving; confirm capacity, log volume, protection and export turnaround before launch.
Servers, computers, firewalls, routers and network devices.
Agreed searchable retention, correlation and missing-data checks.
Separate permissions and storage designed around risk.
Controlled retrieval, bounded exports and an access trail.
24 months is neither every plan’s default nor a duty for every client. For system logs within KRI § 20(4), separate legal retention periods apply, or two years where none are specified. Agree the relevant data categories, periods and archive scope rather than substituting a general NIS2 label. Read the KRI provision
The design covers integrity, encryption and key management, recipients, export controls and a recovery test. Archive separation is not a claim of WORM immutability unless that capability is separately agreed and verified.
Discuss your retention requirementsFROM DETECTION TO A DOCUMENTED NOTIFICATION
Support notification to the relevant CSIRT and prepare material for an authorised person. There is no promise of automatic submission or of acting for the authority without a mandate.
Timeline, sources and timestamps, impact, analytical findings, actions, preserved evidence and open questions. Record how material was collected and handed over.
Management, IT and the DPO receive appropriate information. Classification, notification duties, recipients and deadlines follow the circumstances and applicable law. CSIRT reporting and personal data breach reporting are distinct processes.
GDPR: the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to risk individuals’ rights and freedoms. A processor informs the controller without undue delay. UODO guidance
DOCUMENTATION AND PROCUREMENT
Help prepare technical requirements for a Polish procurement specification and comparable quotations. Separate implementation, subscription, licences, excess log volume, extended retention and out-of-scope work.
Bodies, sites, criticality, integrations and exclusions.
Contacts, deputies, response approval and supplier roles.
Tests of logs, missing data, detection, escalation and permissions.
Rules, retention, incident procedures and reporting.
Evidence, risks, remediation, EOL, fix owners and retesting.
Exports, open-case handover, access removal and data deletion.
Documents, report formats and formal support are agreed quotation items. Technical material does not replace approval of the specification, legal assessment or the contracting authority’s responsibilities.
Discuss procurement scopePUBLIC-SECTOR FUNDING OPTIONS
Help describe SOC, SIEM, NOC, audit and testing requirements against a programme’s criteria. Funding decisions and expenditure eligibility remain with the programme authority.
Sources reviewed: 29 October 2026. Check the official call documentation before making a decision.
CPPC lists the third call deadline as extended to 30 November 2026. The programme concerns partnership projects between local authorities, not automatic subsidy for any Shield subscription.
Official programme documentationThe FERC programme supported local government resilience. It is not presented here as a new open call. For an existing grant, check its agreement, settlement rules and eligible service scope.
Official programme documentationA sector programme for eligible water operators. The call has been decided; discuss service alignment with an awarded project rather than a guaranteed new grant.
Official programme documentationNo funding award, eligibility of a specific item or assessment score is guaranteed. The service may also be funded from the authority’s own budget without waiting for a grant. Current CPPC calls
Discuss the project’s technical scopeSERVICE DETAILS
This capability is shared by business and local government. The main offer explains it in detail; institutional coverage adds agreed responsibilities, documentation, retention and acceptance criteria.
Explore the shared scopeThis capability is shared by business and local government. The main offer explains it in detail; institutional coverage adds agreed responsibilities, documentation, retention and acceptance criteria.
Explore the shared scopeThis capability is shared by business and local government. The main offer explains it in detail; institutional coverage adds agreed responsibilities, documentation, retention and acceptance criteria.
Explore the shared scopeThis capability is shared by business and local government. The main offer explains it in detail; institutional coverage adds agreed responsibilities, documentation, retention and acceptance criteria.
Explore the shared scopePrioritise staff identities, line-of-business systems, records, email and public services. Map local and external dependencies. Escalation includes IT staff, management and the appropriate data protection contacts.
Different sites have different connectivity, suppliers and maturity. Provide an authorised overall risk view while separating data and permissions. Start with critical systems and expand in stages.
A shared service can support several bodies when their roles, mandates and responsibilities are explicit. Use separate monitoring and reporting scopes with an authorised consolidated view; a shared platform does not mean unrestricted access to everyone’s data.
Shared computers, changing users and distributed support require practical maintenance rules. Match coverage to devices and data. Each body’s legal status requires its own assessment even when monitoring is organised jointly.
Water, wastewater and transport operations need industrial-system awareness. Logging and access observation do not authorise automatic disconnection of controllers. Actions affecting a process require agreement with the person responsible for its safety.
SOC adds analysis, context and agreed incident handling to everyday administration. Local administrators know the applications and processes. Define task ownership and escalation so an incident cannot stall between suppliers.
Identify bodies, sites, system owners and critical services. Review endpoint protection, identity, networks, backups and supplier access. Produce an environment map with constraints and priorities.
Agree sources, licences, collectors, retention and processing locations, together with responsibilities, incident classes and response procedures. Separate implementation stages from ongoing service costs.
Connect representative resources and check data quality, load and application compatibility. Agree stopping and rollback criteria. Use the pilot result to decide how to expand.
Add sources in stages, assign institutional context and tune detection. Each integration needs an owner, tested connectivity and a way to detect interrupted ingestion.
Test an alert, out-of-hours contact, escalation, response approval and incident documentation. Confirm decision-makers, deputies and alternative contact channels. Only accepted scope enters routine operation.
Review reports, new resources, changing risks and procedural updates. Plan expansion from monitoring results and institutional needs, not simply the number of features a platform offers.
Specify event ingestion and assessment, qualification, escalation, authorised actions and case documentation for the agreed sources. Define how delivery is measured and reviewed.
Distinguish receipt, start of analysis, notification, agreed action and restoration. Response time is not a guaranteed resolution time for every incident. Values, clocks, measurement methods and exclusions belong in the signed SLA.
Active attack indicators and loss of critical services need a different path from uncertain signals or planned work. Consider credibility, reach and resource importance rather than an alert colour alone.
Pre-agree when device isolation, account blocking or communication restrictions are permitted. Record sensitive exceptions, approvers, deputies and the procedure when contacts cannot be reached.
The provider fulfils the delegated operational scope. Management retains decisions on risk, organisation and required notifications. A service contract does not automatically transfer statutory duties or responsibility for the entire environment.
Confirm staffing and out-of-hours escalation, subcontractors, confidentiality, processing locations, personnel access, retention, additional work and exit arrangements before launch. Include these in procurement documents.
Estimate computers, servers, identities, sites and bodies. Identify protection, firewalls, email, directory services and backups. Initial discussions need ranges and technologies, not passwords, raw logs or residents’ data.
Include sources, availability, detection tests, response, documentation and reporting. Address migration, licences, retention, permissions and exit. Acceptance criteria must be testable; integration scope needs verification.
Who handles alerts out of hours? How is missing telemetry detected? Which actions are pre-authorised? Where is data processed and who can access it? How do evidence handover, SLA disputes and termination work?
Separate setup, subscription, licences, excess log volume, extended retention and out-of-scope incident work. Ask about new bodies and data exports. A starting price alone is not the total cost of the chosen service.
Verify event receipt and timestamps for every source, missing-data alerts, a test detection and escalation. Include reporting access, contact lists and documentation handover in acceptance.
Use the brief below to gather requirements and acceptance criteria. Adapt it to the authority; it is not a complete tender specification or legal assessment.
This capability is shared by business and local government. The main offer explains it in detail; institutional coverage adds agreed responsibilities, documentation, retention and acceptance criteria.
Explore the shared scopeCorrelate identity, device and email logs. After context checks, terminate sessions, block or reset access only within the agreed mandate. Requires suitable logs and response permissions.
Review device, server and account telemetry. Isolation, evidence preservation and recovery follow the procedure. Requires working telemetry, authority to isolate and independent backups.
Check the VPN identity owner, work schedule and administrative audit trail. Escalate or restrict the session within the mandate and document actions.
Treat missing data as lost visibility. Check the source, collector, delay and connectivity; document the gap and restore ingestion within the agreed scope.
DATPOL SHIELD / LOCAL GOVERNMENT BRIEF
Complete, then print or save as PDF. Fields remain in this browser tab only: they are not stored on the server or sent automatically. Do not include passwords, residents’ data or incident details.
A working document for the authority to adapt; not a completed tender specification or legal assessment.
datpol@datpol.com · +48 55 621 29 29 · shield.datpol.com
The Shield calculator is an initial budget estimate. A local government quotation also considers log volume, retention, integrations, licences, coverage hours and the number of bodies. LCPD can be part of the project, but a data centre build is not a prerequisite.
