Protecting public services requires governance, technology and continuity to work together.

No. Municipal status places the entity within Public Administration, but does not in itself determine qualification as an essential entity.

Qualification follows Articles 6 to 8 of the RJCS. A municipality may be qualified as essential, important or a relevant public entity, depending on its responsibilities, digital integration, services, size, criticality and the competent authority's decision.

CautionDo not rely solely on the designation 'municipality' or population size to anticipate the outcome.

Parishes form part of autonomous administration, which falls within the personal scope of the RJCS, but the specific framework should not be presumed without self-identification and qualification.

Size, services, shared dependencies and the criteria in Articles 6 and 7 shape the category and applicable measures. Small parishes should not be treated as though they automatically have the same framework as a municipality or an essential entity.

CautionPersonal scope, qualification and the level of measures are separate questions.

As a rule, yes, where it is an autonomous legal person, acts in its own name and has its own tax identity and representation.

The Regulation creates one provisional registration per entity, regardless of the number of sectors or subsectors. A municipality and municipal company should not be combined merely because of ownership, oversight or institutional dependence.

CautionAlways confirm legal personality, tax number, legal representation and which entity actually provides each service.

Where the municipality is qualified as an essential or important entity, it must appoint a person who belongs to its management, executive or administrative bodies, or who reports organically and directly to them.

The appointed person must be able to propose measures, inform and support the competent bodies, ensure risk management and the annual report, and coordinate the Permanent Contact Point (PCP) where that role is held by someone else.

CautionAuthority to make the appointment and the reporting model must be confirmed against the local authority's organization and specific rules.

An external CISO or vCISO may support governance, risk and implementation, but should not be presented as automatically eligible to fulfill the statutory Cybersecurity Officer (RCS) role.

Article 31 requires the appointed person to be a member of a management, executive or administrative body, or to report organically and directly to it. The law does not expressly resolve every external-delivery model, so the contract, named appointment, reporting, autonomy, resources and conflicts of interest require specific validation.

CautionUntil there is unequivocal official guidance for the specific model, distinguish CISOaaS/vCISO services from statutory appointment as RCS.

It depends on whether there is one legal entity or separate entities. The operational rule is one registration per entity, not one registration per service or sector.

Municipal services without autonomous legal personality may be included in the municipality's self-identification, identifying the relevant sectors and services. A municipal company or other autonomous legal person should generally have its own registration.

CautionMap legal personality, tax number, representation, assets, workers and responsibility for service delivery before submitting.

Organize proof through the connection between requirement, risk, measure, implementation and validation, rather than accumulating files without context.

For each item of evidence, identify the entity, asset or service, owner, source, date, period, approval, integrity and review status. Combine documents with operational records, configurations, test results, minutes, reports, tickets and proof of correction appropriate to the control.

CautionDo not submit sensitive information indiscriminately: confirm the request, classification, channel, necessity and minimization before communicating it.

In essential and important entities, management, executive and administrative bodies approve risk-management measures and oversee their implementation.

Decisions on policies, responsibilities, accepted risk, priorities, resources, measures, exceptions, continuity, incident response, critical procurement and oversight should be formalised under the applicable internal powers. Role appointments and powers of representation must also have a valid basis.

CautionArticle 25 does not allow the bodies' responsibility to be transferred to a consultant; authority for each decision must be confirmed within the entity's organizational framework.

Treat the three frameworks as coordinated layers of governance while preserving their own purposes, owners, decisions and evidence.

The RJCS addresses risks to networks and systems and service continuity; the GDPR protects personal data and data-subject rights; the RGPC organizes corruption prevention, integrity, training, risk and whistleblowing. An incident, supplier or process may activate all three without one assessment or notification replacing the others.

CautionUse a common matrix of processes, assets, data, risks, controls, owners and obligations while keeping legal bases, deadlines and competent authorities separate.

Requirements should reflect the risk, service and access granted to the supplier, with verifiable obligations throughout the contract lifecycle and at exit.

As appropriate, include scope and assets, responsibilities, access control and MFA, data location and protection, logs, vulnerabilities and updates, subcontracting, incident notification and cooperation, continuity and recovery, service levels, testing, audit, evidence, return or deletion of information, and transition at contract end.

CautionAvoid generic clauses: define acceptance criteria, deadlines, evidence, oversight and consequences, aligned with the procurement procedure and validated by legal, technical, data-protection and compliance functions.