Local Cybersecurity Centres for municipalities: how to build one together and sustain it after grant funding?

A municipality may already have a firewall, EDR, a backup system and sometimes a SIEM. Yet an overnight alert may still wait until morning, detection rules may not be regularly developed, and during an incident nobody knows who can isolate a device or block an administrator account. The problem is not always a lack of technology. What is often missing is the operational capability to turn a signal into a decision and a response.

A Local Cybersecurity Centre helps several local authorities build that capability together. It should not be understood as a shared server room, a shopping list or an outsourced service under a new name. It is a model for collaboration between local authorities, covering people, processes, tools, accountability and security funding beyond the end of the grant.

This article provides an introduction before discussing an LCC project. It explains who can participate, the key conditions, the value of a shared centre and why its architecture must be designed from the outset for the five-year sustainability period.

The information below reflects the FERC 4.1 call documentation and CPPC questions and answers updated on 20 August 2026 We distinguish formal conditions from technical recommendations. Before submitting an application, check the current documentation again on the CPPC funding call page.

Key information

• Partnership: at least two local authorities deliver the project together; one acts as the Lead Partner and Applicant.
• Scale: the LCC must cover at least 1,000 endpoints for which the participating local authorities are responsible.
• Funding: up to 100% of eligible expenditure; the project ceiling ranges from PLN 6 million for two local authorities to PLN 15 million for at least 20.
• Scope: the centre delivers seven mandatory groups of cybersecurity tasks.
• Sustainability: the LCC must remain operational and adequately resourced for five years after the project ends.
• Deadline: under the current timetable, applications close on 30 October 2026.

Useful insights

• An LCC is a shared operational capability for local authorities, not a product catalogue. It provides cybersecurity services to participating authorities and designated organisational units.
• An application is submitted by a local authority acting as Lead Partner, together with at least one partner authority. An association of local authorities, intermunicipal union, school or company cannot take the place of a Partner.
• The partnership must cover at least 1,000 endpoints in total. The devices must be the responsibility of the local authorities and actually receive LCC support.
• The programme includes seven mandatory groups of tasks and a five-year sustainability period. It does not prescribe a particular SIEM, XDR, vendor or single SOC model.
• The key question is not ‘What will we buy?’ but ‘How will the centre operate after the grant ends?’ The total cost of ownership must leave funding for analysts, monitoring, response, detection rule development, playbooks, automation and testing.
• Economies of scale come primarily from shared expertise and processes. More participating authorities do not guarantee a lower price for every licence.

What is a Local Cybersecurity Centre?

The funding call documentation presents an LCC as a way for local authorities to carry out cybersecurity tasks together. The centre serves participating authorities and designated institutions within their organisational structures. Cooperation is based on a contract or agreement between the authorities.

In practice, an LCC should function as a shared security operating model. One municipality may contribute administrator expertise, another existing tools, and a third infrastructure, while all benefit from shared standards, skills and threat response mechanisms.

This does not mean that every participant’s environment must become identical. The main elements to standardise are:

• minimum security standards;
• monitoring and incident handling;
• escalation and decision-making rules;
• playbooks, reporting and records of actions taken;
• development of detection rules, automation and skills;
• the service maintenance model after funding ends.

This model addresses a problem of scale. An individual municipality may struggle to maintain specialists in monitoring, incident response, vulnerabilities, identity, backup and business continuity. A shared centre makes those skills available to multiple authorities without each having to build a complete team from scratch.

LCC is not a product name. The documentation does not prescribe a single SIEM, XDR, SOAR or vendor. Nor does it require a shared server room. It requires a defined range of services and the capability to continue delivering them.

Who can establish an LCC?

The call is open exclusively to local authorities delivering a project in partnership. One authority becomes the Applicant and Lead Partner, submits the application and represents the other authorities. At least one further local authority participates as a Partner.

An association of local authorities, intermunicipal union, school, organisational unit or company cannot be the Applicant or a Partner in this call. Schools and other organisational units can, however, receive LCC support if they are properly identified in the project documentation.

VigilHorizon does not ‘establish its own LCC’ or replace local authorities as the beneficiary. The company can help design and deliver the technology and operational layers if selected through the applicable procedures. The local authority remains the Lead Partner, owner of the operating model and party responsible for the project.

The CPPC FAQ allows external providers to help deliver LCC tasks. An external contractor does not, however, take over the authority’s responsibility for the centre’s organisational model, sustainability or risk management. The partnership must still demonstrate that the LCC covers the minimum required tasks and has adequate skills and resources.

What are the key entry conditions?

Condition	What it means in practice
At least two local authorities	One authority acts as Lead Partner and Applicant, with at least one other as a Partner.
A contract or agreement before application	The document defines roles, tasks, funding, financial arrangements and responsibilities. It must remain in force throughout the project and the required sustainability period.
At least 1,000 endpoints	The threshold applies to the whole partnership, not each authority individually. The devices must be the authorities’ responsibility and covered by LCC protection.
Minimum staffing capability of the Applicant	On the application date, the Applicant must employ at least one person under an employment contract who holds a CPPC-specified certification or a relevant cybersecurity qualification.
The full minimum scope of tasks	The project must demonstrate delivery of all seven groups of LCC tasks.
Five years of continued operation	The organisational model and staffing, technical, organisational and financial resources for the sustainability period must be presented.

Endpoints may include devices used in schools and other organisational units, including computers in teaching labs, provided they meet the call’s definition, the authority is responsible for their security, they connect to a network and the LCC will actually protect them.

Each supported institution and its endpoint count must be listed in the required annex. Simply naming the institution in the project description is not enough.

Nor should it be assumed that the entire SOC must be directly employed by the authority. The staffing criterion defines the Applicant’s minimum capability, while the documentation permits external providers as long as a genuine LCC operating model is maintained.

Participation in the ‘Cybersecure Local Government’ project does not exclude participation in an LCC. The activities and expenditure must, however, be clearly separated to avoid claiming the same costs twice.

Which LCC tasks are mandatory?

The annex to the criteria identifies seven areas in which the LCC must implement standardised mechanisms and provide services based on them. This is the formal minimum scope, not a list of optional modules.

Mandatory area	Practical implications for local authorities
Cyber threat and incident handling	Procedures, event analysis, response, impact containment and records of actions taken.
Asset management and ISMS support	An inventory of ICT products, services and processes, linked to information security management.
Secure software versions and updates	Control of versions, lifecycles, vulnerabilities and updates, including on mobile devices.
Access rights management	Least privilege, granting and changing access, and promptly revoking it.
Data protection, including backups	Backups logically and physically separated from production data, with completeness and recovery tests.
Communications and email security	Protection of communication channels, email and authentication proportionate to risk.
Skills and cyber hygiene	Training, skills development and preparing staff and management to respond to incidents.

This list shows why an LCC cannot be reduced to log monitoring. A SOC can be an important part of the centre, but it does not cover the full mandatory scope.

How much funding is available and what are the deadlines?

The total budget for the call is PLN 269,649,295.75, with maximum funding of 100% of eligible expenditure. This is a competitive call: meeting the conditions does not automatically secure funding. Projects are assessed and placed on a ranking list.

The maximum project grant increases with the number of participating authorities:

Number of local authorities in the partnership	Maximum project grant
2	PLN 6 million
3	PLN 6.5 million
4	PLN 7 million
5	PLN 7.5 million
6	PLN 8 million
10	PLN 10 million
20 or more	PLN 15 million

Between these thresholds, the ceiling increases by PLN 0.5 million for each additional authority, up to PLN 15 million. Construction work may not exceed 20% of the project’s eligible expenditure.

The call opened on 31 July 2026 and, according to the documentation, closes on 30 October 2026 Projects must be completed no later than 31 December 2030, followed by a five-year sustainability period.

A high funding ceiling is not a goal in itself. Applications must pass a cost-effectiveness assessment covering financial, economic and sustainability analysis, operating costs, price reasonableness and analysis of technical options. The availability of funding is not a reason to spend most of it on technology.

How are LCC projects scored?

The call is competitive, so the outcome depends on both entry conditions and the project’s score. Four criteria are particularly important when building a partnership:

• number of local authorities: two authorities receive no points under this criterion; each additional authority adds one point, up to a maximum of ten for a partnership of at least 12 authorities;
• full county participation: an additional ten points are available if the partnership includes at least one county and all municipalities within it;
• the Applicant’s staffing capability: beyond the minimum requirement to employ one qualified person, a larger appropriately qualified team earns points—from two points for two people to five points for at least five;
• the Applicant’s institutional capability: between zero and ten points are awarded depending on whether the existing team jointly handles cybersecurity for the authority’s organisational units and what proportion of those units it covers.

Simply maximising the number of Partners is no substitute for a credible operating model. Scoring should support a partnership with real expertise, management capability and a funding plan for the entire LCC sustainability period.

Municipalities already have SIEM, XDR and firewalls. What does an LCC add?

Many local authorities have already deployed SIEM, EDR/XDR, firewalls, backup systems and network management tools, alongside training and audits. These investments can provide a valuable foundation. The problem arises when the tools do not form a single operational process.

Having a SIEM does not mean having a SOC. A SIEM may collect millions of events, but someone still needs to:

1. analyse alerts;
2. distinguish false positives from genuine threats;
3. correlate events from different sources;
4. assess the impact on public services;
5. escalate incidents;
6. activate agreed procedures;
7. respond and document decisions;
8. capture lessons learned;
9. update detection rules, automation and playbooks.

Tool or resource	What it provides	What the authority still needs
SIEM	Centralised logs, correlation and alerts	High-quality data, detection rules, triage, alert ownership and response
EDR/XDR	Endpoint telemetry and actions	Correct configuration, contextual analysis, isolation permissions and exception handling
Firewall	Traffic control and segmentation	Current rules, monitoring, blocking decisions and assessment of service impact
Backup	A copy of the data	Separation, identity protection, a disaster recovery plan and tested recovery
Audit	A snapshot at a particular point in time	Action owners, deadlines, progress tracking and follow-up verification

An LCC should turn existing technology into a working cybersecurity operation, with round-the-clock or risk-appropriate coverage, defined responsibilities, shared procedures and measurable response times.

‘The most expensive SIEM does not create a shared security capability. That takes high-quality data, people who understand the context, and agreed decisions made under time pressure.’

The difference between monitoring and a mature operational process is explored in more detail in the article What a 24/7 SOC is and why monitoring alone is not enough.

The VigilHorizon model: technology, automation and people

The VigilHorizon model puts technology in support of analysts and processes, rather than allowing it to consume most of the operating budget. The architecture should not depend on dozens of expensive licences that cannot reasonably be renewed after grant funding ends.

Open source where it makes sense

Mature open-source solutions can reduce costs and dependence on a single vendor, but they are not automatically free or maintenance-free. They require updates, expertise, integration, testing and clear maintenance ownership.

Decisions should consider security, functionality, lifecycle cost, skills availability, integration options and vendor lock-in risk. The right model is not ‘everything open source’, but ‘the lowest justified total cost of ownership at the required level of security’.

Automate routine work, not accountability

Automation can enrich an alert with device, user and vulnerability information, collect artefacts, open a case, send a notification or execute a pre-approved block. Every mechanism should have an owner, access controls, an activity log, exception handling and a safe way to stop it.

Irreversible actions and decisions with a significant impact on public services should remain under human control. Automation should save analysts time, not blur accountability.

A shared playbook library

A playbook describes the path from signal to case closure:

event → analysis → decision → response → escalation → documentation → lessons learned.

A shared library can cover ransomware, phishing, account compromise, unusual logins, brute force, malware, privilege escalation, C2 communications, administrator account compromise, Active Directory anomalies and critical vulnerabilities.

A shared SOC can apply the same procedures and knowledge across several authorities while maintaining data separation, appropriate permissions and local exceptions. Lessons from an incident at one authority can then improve detection and readiness across the partnership.

The key issue: costs after the grant ends

An LCC must be designed from day one around what happens when funding ends. Five-year sustainability is not an optional addition; it is a formal commitment that must be demonstrated in the application.

High-risk model:

grant → large licence purchase → high renewal costs → reduced service scope → insufficient funds for people, tuning, response and testing.

Sustainable model:

inventory → proportionate technology → standardisation → automation → shared playbooks → a functioning SOC → predictable operating costs.

Total cost of ownership should include not only procurement, but also:

• licence and subscription renewals;
• log storage and processing;
• infrastructure, connectivity, energy and maintenance;
• integrations and connector maintenance;
• staff, shifts and cover;
• monitoring, event analysis and incident response;
• development of detection rules, playbooks and automation;
• threat hunting, reporting and vulnerability management;
• tests, exercises and audits;
• backup, disaster recovery and business continuity;
• migration or supplier exit at the end of the contract.

After project completion, the greatest operational value should come from analysts’ expertise, detection, response and continuous improvement. The operating budget should fund security, not just the right to keep using tools.

The agreement between authorities must define how ongoing operations will be funded, how participant numbers can change, responsibility for shared assets and what happens if a Partner leaves. Without this, the five-year plan may remain only a statement of intent.

Where do economies of scale come from?

Partnership is a formal condition of the call, but it should be more than a structure created to submit an application. Its purpose is to combine resources that an individual municipality often cannot build and maintain alone.

Real economies of scale come primarily from sharing:

• a SOC team and access to scarce specialist skills;
• procedures, playbooks and training materials;
• detection rules and automation;
• configuration standards and baselines;
• exercises, tests and reporting;
• incident analysis and lessons learned across multiple authorities;
• vulnerability management and security improvement processes.

It would be wrong to claim that every licence will be cheaper simply because more municipalities join the project. The main benefit is that each authority does not need to create a complete team, process and knowledge library on its own.

More participants also mean more systems, exceptions, process owners and agreements. A partnership should therefore be built around genuine readiness to operate and fund the LCC together, rather than simply maximising points or the budget.

Why should the project start with an audit and gap analysis?

An LCC project should start with a detailed assessment of each participant’s current situation, including:

• previous cybersecurity projects and their funded scope;
• SIEM, EDR/XDR, firewalls and network tools;
• Active Directory, access rights and privileged identities;
• backups, retention, separation and the latest recovery tests;
• configurations, integrations and telemetry quality;
• monitoring, procedures and alert handling;
• staff skills and availability;
• vulnerabilities and the update process;
• line-of-business systems, their owners and dependencies;
• contracts, renewal dates and licensing restrictions.

A gap analysis should then assess all seven mandatory areas. A gap may be a missing product, but just as often it is missing configuration, process, ownership, expertise or testing.

We do not replace working technology simply because new funding is available. We first use what already meets the requirements, then address confirmed gaps. This reduces costs, implementation time and the risk of duplicating previously funded work.

What should local authorities standardise?

Where environments are similar, the partnership can develop shared:

• security policies and minimum requirements;
• configuration baselines;
• log collection and integration standards;
• firewall and detection rules;
• incident classifications and escalation rules;
• playbooks and response procedures;
• management reports and service quality metrics;
• exercise and test scenarios.

Standardisation does not mean ignoring local context. An authority may have different line-of-business systems, contracts, risk levels and organisational constraints. The model should therefore allow documented exceptions, with owners and review dates.

For example, four authorities could jointly protect 1,260 endpoints, use their existing firewalls, EDR and backup systems, then build a single alert handling process, a shared playbook library and an agreed response model. The result would not be identical infrastructure in every municipality, but one measurable approach to detecting, escalating and handling threats.

Why is detecting an attack not enough?

Even an effective SOC cannot guarantee that every attack will be stopped before it affects systems. A mature LCC model should therefore extend beyond detection and containment. It should also cover secure recovery and maintaining essential public services until systems are restored.

These areas form a single process. Incident analysis helps determine the scope of compromise and select a safe recovery point. Problems uncovered during recovery should, in turn, lead to updates to detection rules, procedures and playbooks.

The minimum LCC scope includes data protection through backups, logical and physical separation, and completeness and recovery testing. A ‘backup completed successfully’ message alone does not confirm that the authority can resume work within an acceptable time.

The resilience layer should address off-site backups, ransomware protection for copies, RPO, RTO, disaster recovery, recovery testing and business continuity. This is explored further in the accompanying SecureVault article: The LCC will detect a cyberattack. Can the authority resume operations afterwards?

How can an LCC be sustained for five years?

The project does not end when the grant is settled. Throughout the five-year sustainability period, the LCC must operate effectively with adequate staffing, organisational, technical and financial resources.

The operating model should define:

• the responsibilities of the Lead Partner, Partners and suppliers;
• minimum staffing, shifts and cover;
• owners of services, systems and risks;
• how shared and local costs will be funded;
• updates to procedures, rules and tools;
• development of skills, playbooks and automation;
• response to new threats and vulnerabilities;
• tests, exercises, audits and reporting;
• contract exit and migration plans;
• rules for Partners joining, leaving or failing to meet their obligations.

Low and predictable total cost of ownership should be one architectural design criterion, but not the only one. The solution must also be secure, supportable, documented and resilient to the departure of an individual employee or supplier.

How should you start preparing an LCC project?

1. Build a partnership of local authorities. Find authorities interested in delivering security services together, not just submitting a joint application.

2. Check the entry conditions. Verify Partner status, endpoint numbers, eligibility, the Applicant’s staffing capability, deadlines and required annexes.

3. Identify the institutions to be supported. Assign them to the relevant authorities, define their roles and count endpoints using the call’s definition.

4. Inventory previous investments. Document tools, licences, contracts, publicly funded projects, integrations, procedures and actual skills.

5. Conduct an audit and gap analysis. Check what actually works and what is missing in each of the seven areas.

6. Design the LCC architecture. Define the technology, SOC, processes, responsibilities, playbooks, automation, reporting and business continuity arrangements.

7. Calculate total cost of ownership for the sustainability period. Compare options and check whether the post-grant budget can fund an effective service, people, testing and development.

8. Only then select technology and prepare the project. Every expense should address a confirmed gap and have an owner after implementation.

Formal basis and sources

The programme conditions and dates in this article were verified against materials available on 20 August 2026:

• CPPC – FERC Action 4.1, third call: Local Cybersecurity Centres – status, objectives, beneficiaries, budget, deadlines and complete documentation;
• CPPC questions and answers – updated 20 August 2026 – partners, endpoints, staff, external providers, sustainability and eligibility;
• ‘Project Selection Criteria’ and ‘Minimum Scope of LCC Tasks’, published in the Call Rules package on the CPPC website;
• ‘Minimum Scope of the Partnership Contract/Agreement’, published in the Other Documents package on the CPPC website.

The application and agreement should always be based on the latest documents from the body organising the call. This article is educational and does not replace legal or financial analysis or application documentation.

Summary

A Local Cybersecurity Centre gives local authorities an opportunity to build a shared capability that an individual municipality often cannot sustain alone. Success depends on the right sequence: partnership, eligibility checks, inventory, gap analysis, operating model, total cost of ownership, and only then technology.

The programme requires at least two authorities, 1,000 endpoints, sufficient staffing capability of the Applicant, delivery of seven groups of tasks and five-year sustainability. It does not require buying everything from scratch or tying the centre to a single vendor. There is room for existing systems, justified use of open source, standardisation, automation and shared SOC operations.

Considering a joint LCC with other local authorities? Choosing technology need not be the first step. VigilHorizon can help check entry conditions, endpoint numbers, existing controls, operational gaps, possible architecture and estimated operating costs. Let’s discuss your LCC model, before the shopping list overshadows the service that the authorities will need to sustain together.

Frequently asked questions (FAQ)

What is a Local Cybersecurity Centre?​

An LCC is the shared capability of several local authorities to provide cybersecurity services to participating authorities and designated organisational units. It combines people, processes, technology, accountability and ongoing operations—not merely joint procurement.

Can one municipality apply for an LCC on its own?​

No. The project must be delivered by a partnership of at least two local authorities. One is the Applicant and Lead Partner, while the others are Partners.

Can an intermunicipal union or association of authorities be the Lead Partner?​

No. According to the current CPPC FAQ, only local authorities may be the Applicant and Partners.

Can schools and other organisational units receive LCC support?​

Yes. They cannot be Partners, but may be identified as supported institutions. They must be listed in the required annex, assigned to the relevant authority and accompanied by an endpoint count.

Does the minimum of 1,000 endpoints apply to each authority separately?​

No. The threshold applies to the entire partnership. Devices must meet the endpoint definition, be the responsibility of a participating authority and actually receive LCC support.

Does a virtual server count as an endpoint?​

According to the CPPC response of 20 August 2026, a virtual server does not count because it is not a physical device. A physical server may be included. Use the full definition in the current documentation when preparing the inventory.

Must the Applicant already employ a cybersecurity specialist?​

Yes. On the application date, the Applicant authority must employ at least one person under an employment contract who holds a CPPC-listed certification or an appropriate university, postgraduate or MBA qualification in cybersecurity.

Must the entire SOC be employed directly by the authority?​

The documentation does not require this. External providers may deliver some tasks, but an outsourced service alone cannot replace the LCC. The partnership must retain an organisational model, expertise, resources and operating capability throughout the sustainability period.

Does the programme require a particular SIEM, XDR or open-source solution?​

No. The criteria define services and outcomes, not a particular vendor. Technology choices should follow analysis of gaps, risks, integrations, security and lifecycle costs.

Is a 24/7 SOC a formal requirement of the LCC programme?​

The criteria require cyber threat and incident handling but do not specify a product or service called ‘SOC 24/7’. Round-the-clock operations may be an appropriate way to meet operational needs where justified by risk and the partnership’s architecture.

Does participation in ‘Cybersecure Local Government’ exclude an LCC project?​

No. Activities and expenditure must, however, be separated, and the same expenses cannot receive public funding twice.

How long must an LCC continue after project completion?​

The sustainability period is five years. The Applicant must demonstrate an organisational model, staffing, organisational, technical and financial resources, and a way to keep procedures, tools and skills up to date.

Does 100% funding mean every cost will be covered?​

No. The maximum is 100% of eligible expenditure. Costs must fall within the eligible categories, be justified, market-based and reasonable, and the project is assessed competitively.

Learn more

• The LCC will detect a cyberattack. Can the authority resume operations afterwards?
• What a 24/7 SOC is and why monitoring alone is not enough
• SIEM in a company—why deployment alone does not improve security
• Incident Response — responding to a cyberattack step by step