SwitzerlandMandatory Reporting of Cyberattacks on Critical Infrastructure
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- Applies to the authorities and organisations listed in Article 74b(1) ISG, among them energy suppliers, banks, insurers and financial market infrastructures, hospitals on a cantonal hospital list, telecommunications service providers registered with the Federal Office of Communications, providers of cloud computing, search engines and digital security and trust services and data centres with a seat in Switzerland, and manufacturers of hardware or software used by critical infrastructures that has a remote-maintenance access or is used to control operational systems or to ensure public safety. Reached by declaring that you operate an essential service, provide financial or telecom services, handle health records or distribute a software product.
- Ensure that cyberattacks on your information technology are reported to the Federal Office for Cybersecurity (BACS) (Article 74a(1)).
- Report a cyberattack that endangers the functioning of the critical infrastructure, led to manipulation or exfiltration of information, remained undetected for a long period, or is combined with extortion, threat or coercion (Article 74d).
- Make the report within 24 hours of discovering the cyberattack (Article 74e(1)).
- State in the report the authority or organisation concerned, the nature and execution of the attack, its effects, the measures taken and, as far as known, the planned further course (Article 74e(2)).
- Supplement the report as soon as you have new information (Article 74e(3)); where not all required information is known within the 24 hours, BACS grants 14 days to complete the report (Cybersicherheitsverordnung, Article 16(1)).
- You need not give information in the report that would incriminate you or the person fulfilling the duty for you (Article 74e(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 74h(1) ISG: a fine of up to CHF 100,000 for intentionally failing to comply with a final BACS order that refers to the penalty threat; prosecution and judgment rest with the cantons (Article 74h(4)). Article 74g requires BACS first to set a reasonable period and then to issue an order.
Penalty structure
Article 74h(1) ISG sets a fine of up to CHF 100,000 for intentionally failing to follow a final BACS order or appeal decision issued with reference to that article; where a fine of at most CHF 20,000 is in question the authority may proceed against the business instead of the responsible persons (Article 74h(3)).
- Rule
- Fixed only
- As of
- Currency
- CHF
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Federal Office for Cybersecurity (BACS), which informs a body of signs of a breach of the reporting duty, sets a reasonable period and then issues an order under Article 74g ISG; the cantons prosecute a failure to comply with such an order.
Settledness
- As of
What this law does
Article 74a ISG requires the authorities and organisations listed in Article 74b to ensure that cyberattacks on their information technology are reported to the Federal Office for Cybersecurity (BACS). A bound body must make the report within 24 hours of discovering the attack.
A cyberattack must be reported if it endangers the functioning of the critical infrastructure, led to manipulation or exfiltration of information, remained undetected for a long period, or is combined with extortion, threat or coercion. If not all required information is known within the 24 hours, BACS grants a period of 14 days to complete the report.
Article 74h ISG punishes the intentional failure to follow a final BACS order, issued with reference to that provision, with a fine of up to CHF 100,000. The reporting duty took effect on and Articles 74g and 74h on .
When LexLint raises it
When your app profile says your app distributes a software product, handles health records, runs an essential service, provides financial services or provides telecom services.