CivicPlus — municipal websites, 311, agenda, recreation

Reporting path

1. Open a Security case through the CivicPlus customer portal and mark it Critical.
2. Phone CivicPlus support — number in your customer success welcome email.
3. Request the CivicPlus security incident summary in writing for your records.

Contract clauses to read first

• Notification window — typically 72 hours for confirmed customer-data exposure.
• PCI scope for recreation registration and payment modules — your municipality and CivicPlus are joint responsible parties; clarify the lines.
• Resident-notification responsibility — usually sits with the municipality even if CivicPlus is the breached party.

Known incident pattern

CivicPlus has experienced individual customer-site defacements and a handful of platform-side advisories over the years. Their status page and security advisories are the canonical sources — subscribe.

Descriptive reference only. CivicPlus is a trademark of its owner. No affiliation or endorsement is implied.