Provides telecom services, in Switzerland

Verordnung vom 9. März 2007 über Fernmeldedienste (FDV), SR 784.101.1, Art. 96 · Read the law's page

• Applies to providers of telecommunications services. Reached by declaring that you provide telecom services.
• Report disruptions in the operation of your telecommunications installations and services that can affect at least 10,000 customers to the National Alarm Centre without delay (Article 96(1)).
• Inform the public about such a disruption on a freely accessible website (Article 96(1)).

Verordnung vom 9. März 2007 über Fernmeldedienste (FDV), SR 784.101.1, Art. 96a to 96c · Read the law's page

• Applies to providers of internet access. Reached by declaring that you provide telecom services.
• Prevent outgoing connections with forged addressing elements by suitable technical means, in order to counter distributed denial-of-service attacks (Article 96a(2)).
• Where you supply telecommunications installations to customers, configure their security properties according to the recognised rules of technology (Article 96a(3)).
• While you keep technical control over those installations, update their security properties without delay and replace installations that can no longer be updated where a security risk results (Article 96a(3)(a) and (b)).
• Operate a reporting point that receives reports of unauthorised manipulation of telecommunications installations, and initiate suitable countermeasures within a reasonable time (Article 96b).

Verordnung vom 9. März 2007 über Fernmeldedienste (FDV), SR 784.101.1, Art. 96d to 96g · Read the law's page

• Applies to holders of a mobile network concession, for mobile networks that meet the international technical specifications for fifth-generation networks or later. Reached by declaring that you provide telecom services.
• Develop, implement and continuously review an information security management system based on a risk analysis and the security objectives resulting from it (Article 96e(1)).
• Within that system, implement a business continuity plan and a security incident management plan (Article 96e(2)).
• Ensure that the security-critical installations you operate meet the state of the art (Article 96f(1)).
• Operate your network operations centres and security operations centres only in Switzerland or in states whose legislation ensures adequate data protection (Article 96f(2)).
• Where the Federal Office of Communications has a well-founded suspicion of a breach and needs an audit to establish the facts, undergo an audit by a qualified body at your own cost, or have your installations tested (Article 96g(2)).

Bundesgesetz vom 18. Dezember 2020 über die Informationssicherheit (Informationssicherheitsgesetz, ISG), SR 128, Art. 74a-74h · Read the law's page

• Applies to the authorities and organisations listed in Article 74b(1) ISG, among them energy suppliers, banks, insurers and financial market infrastructures, hospitals on a cantonal hospital list, telecommunications service providers registered with the Federal Office of Communications, providers of cloud computing, search engines and digital security and trust services and data centres with a seat in Switzerland, and manufacturers of hardware or software used by critical infrastructures that has a remote-maintenance access or is used to control operational systems or to ensure public safety. Reached by declaring that you operate an essential service, provide financial or telecom services, handle health records or distribute a software product.
• Ensure that cyberattacks on your information technology are reported to the Federal Office for Cybersecurity (BACS) (Article 74a(1)).
• Report a cyberattack that endangers the functioning of the critical infrastructure, led to manipulation or exfiltration of information, remained undetected for a long period, or is combined with extortion, threat or coercion (Article 74d).
• Make the report within 24 hours of discovering the cyberattack (Article 74e(1)).
• State in the report the authority or organisation concerned, the nature and execution of the attack, its effects, the measures taken and, as far as known, the planned further course (Article 74e(2)).
• Supplement the report as soon as you have new information (Article 74e(3)); where not all required information is known within the 24 hours, BACS grants 14 days to complete the report (Cybersicherheitsverordnung, Article 16(1)).
• You need not give information in the report that would incriminate you or the person fulfilling the duty for you (Article 74e(4)).