Local Public Administration · PCP and incidents
Permanent Contact Point and incident response: available and ready to act.
The Permanent Contact Point (PCP) connects availability, reception, escalation and coordination. Municipal response also requires decision-making, technical capability, communication and service continuity.
Availability and coordination
The contact is an operational function, not merely an address.
The entity should ensure the channel is monitored, substitutions exist and information quickly reaches those who can decide and act. Official deadlines and recipients should be confirmed against the applicable framework and channels.
- Demonstrable availability and substitutions
- Clear triage and escalation criteria
- Coordination with the RCS, decision-makers, teams and providers
- Notification and communication retained as evidence
Govern before delegating
Clear responsibility, specialist support and effective reporting.
Governance connects decisions, risk, resources and oversight. It must not exist only in an organization chart or an isolated document.
Permanent Contact Point (PCP)
Ensures permanent reception and coordination under the applicable rules, using tested on-call arrangements, substitutions and channels.
Cybersecurity Officer (RCS)
Connects risk, governance and oversight of measures, coordinating with the PCP without confusing the two roles.
Decision and response
Decision-makers, technical teams, communications, data protection and providers should know when and how to intervene.
Services and dependencies
A permanent contact requires people, channels and a procedure.
The Permanent Contact Point (PCP) should be able to receive, acknowledge, escalate and follow up communications without depending on informal knowledge or one unavailable person.
Availability
- Permanent channel
- On-call arrangements and substitutions
- Acknowledgement of receipt
- Periodic testing
Triage and escalation
- Severity criteria
- Affected services
- Decision-makers and teams
- Suppliers to mobilise
Notification and communication
- Applicable deadlines
- Official channels
- Data protection
- Internal and public communication
Recovery and improvement
- Containment and continuity
- Validated recovery
- Evidence preservation
- Lessons and corrections
Municipal implementation
From the initial assessment to continuous improvement.
Each stage should produce a decision, verifiable implementation or evidence that allows progress to be monitored.
- 01
Define
Establish contacts, on-call arrangements, substitutions, authority and criteria.
- 02
Connect
Coordinate the PCP, RCS, decision-makers, teams, communications and providers.
- 03
Exercise
Simulate reception, triage, escalation, decision and notification.
- 04
Respond
Contain, communicate, recover and maintain records throughout the incident.
- 05
Improve
Review timings, failures, contacts, decisions and corrective measures.
Usable outcomes
Deliverables that support decision-making and implementation.
The model should be simple enough to work under pressure and complete enough to retain decisions, deadlines and communications.
- 01Contact, on-call and substitution matrix
- 02Triage and escalation procedure
- 03Decision, communication and notification matrix
- 04Playbooks for priority scenarios
- 05Exercise plan and report
- 06Chronological incident and improvement record
Demonstrable response
Three perspectives that corroborate one another.
Availability
On-call arrangements, contact tests, acknowledgements, substitutions and response times.
Decision
Classification, escalation, approvals, notifications and communications.
Recovery
Actions, outcomes, service validation, lessons and completed corrections.
First steps
Begin with enough information to make better decisions.
Test the pathway from detection to decision and notification. An untested contact list does not demonstrate response capability.
Open the RJCS Checker- 01Confirm the requirements applying to the entity
- 02Define a monitored channel and two substitution levels
- 03Map who decides and who acts for each incident type
- 04Connect the procedure to official notification channels
- 05Conduct a simple exercise and correct the failures found
Continue along the B2G pathway
From context to role and response.
Choose the next subject without losing the connection to the framework, entity and implementation.
Continue through the ecosystem
Understand, prepare and implement.
Connect this context to technical knowledge, working tools, implementation capabilities and ongoing support.
Frequently asked questions
Provide guidance without anticipating official decisions.
Is the PCP merely an email address or telephone number?
No. The contact requires availability, monitoring, substitution, escalation capability and integration into a tested procedure.
Can the PCP and RCS be treated as the same role?
They are distinct roles. The organizational model may provide for coordination but should keep each role's purpose, responsibility, availability and formalisation clear.
Does the support provider replace the municipal response?
No. It may perform technical tasks and support coordination, but the entity should retain decision-making, communication, oversight and knowledge of the incident.
How does the entity know when to notify?
It should use the criteria and deadlines in the applicable framework and confirm official channels. The internal procedure should make it possible to gather the necessary information quickly without delaying action.
Primary sources
Always confirm against the official source.
Informational content. Deadlines, recipients and channels should be confirmed against official sources and the entity's specific framework.