Duty LXD-7543
Is a lender, in Switzerland
Duty of Supervised Financial Institutions to Report Events of Substantial Importancesince 3 lines
Bundesgesetz vom 22. Juni 2007 über die Eidgenössische Finanzmarktaufsicht (Finanzmarktaufsichtsgesetz, FINMAG), SR 956.1, Art. 29 Abs. 2 · Read the law's page
- Applies to persons that need an authorisation, recognition, admission or registration from FINMA under the financial market acts. Reached by declaring that you provide financial services.
- Report to FINMA without delay events that are of substantial importance for supervision (Article 29(2)).
- Treat a significant successful or partially successful cyber attack as such an event (FINMA Aufsichtsmitteilung 05/2020, section 1).
Mandatory Reporting of Cyberattacks on Critical Infrastructuresince 7 lines
Bundesgesetz vom 18. Dezember 2020 über die Informationssicherheit (Informationssicherheitsgesetz, ISG), SR 128, Art. 74a-74h · Read the law's page
- Applies to the authorities and organisations listed in Article 74b(1) ISG, among them energy suppliers, banks, insurers and financial market infrastructures, hospitals on a cantonal hospital list, telecommunications service providers registered with the Federal Office of Communications, providers of cloud computing, search engines and digital security and trust services and data centres with a seat in Switzerland, and manufacturers of hardware or software used by critical infrastructures that has a remote-maintenance access or is used to control operational systems or to ensure public safety. Reached by declaring that you operate an essential service, provide financial or telecom services, handle health records or distribute a software product.
- Ensure that cyberattacks on your information technology are reported to the Federal Office for Cybersecurity (BACS) (Article 74a(1)).
- Report a cyberattack that endangers the functioning of the critical infrastructure, led to manipulation or exfiltration of information, remained undetected for a long period, or is combined with extortion, threat or coercion (Article 74d).
- Make the report within 24 hours of discovering the cyberattack (Article 74e(1)).
- State in the report the authority or organisation concerned, the nature and execution of the attack, its effects, the measures taken and, as far as known, the planned further course (Article 74e(2)).
- Supplement the report as soon as you have new information (Article 74e(3)); where not all required information is known within the 24 hours, BACS grants 14 days to complete the report (Cybersicherheitsverordnung, Article 16(1)).
- You need not give information in the report that would incriminate you or the person fulfilling the duty for you (Article 74e(4)).