Objectives:
The aim of the article is to analyze the organizational, legal and technological conditions of security incident management in local government units and to identify barriers hindering effective response to contemporary threats

Material and methods:
The literature analysis included a review of scientific publications in the field of information security, crisis management, public administration and cybersecurity, as well as normative documents (such as the Act on the National Cybersecurity System, GDPR, KRI Regulation) and reports of public institutions – in particular the comprehensive report of the Supreme Audit Office of 2025 on the state of security of IT systems in local government units. This analysis made it possible to capture organizational standards, applicable regulations and existing recommendations for incident response, as well as to identify gaps and inconsistencies in the existing solutions. This analysis was complemented by the use of the case study method, which analysed selected security incidents that occurred in various local government units in Poland.

Results:
It becomes necessary to develop procedures and mechanisms that enable quick identification of the incident, assessment of its nature and scale, as well as effective response and removal of the consequences. Responsibility for these actions lies largely with local authorities.

Conclusions:
The final conclusion is the need to treat incident management not as an episodic technical activity, but as an integral component of the local security strategy. In the era of digital transformation and complex security threats, competent incident management is becoming a basic condition for the sustainable and effective functioning of local government administration.