Cybersecurity Policy Report, Switzerland to Require Cyber Incident Reporting for Critical Infrastructure, (Mar 7, 2025)

By Tony Foley

Switzerland’s Federal Council has introduced a reporting obligation for cyber attacks on critical infrastructure that will come into force on April 1.

According to a news release today from the country’s National Cyber Security Centre (NCSC), the Federal Council has decided to implement an amendment to the Information Security Act (ISA) from September 2023 stipulating that authorities and organizations subject to the law’s reporting mandate, like energy and drinking water suppliers, transport companies, and cantonal and communal administrations, must report cyber attacks to the NCSC within 24 hours of discovery.

The news release notes that a cyber attack must be reported when it threatens the functioning of critical infrastructure, results in the manipulation or leakage of information, or involves blackmail, threats, or coercion. Critical infrastructure operators that fail to meet the reporting obligation may be subject to fines, although the Federal Council has decided not to impose fines until Oct. 1 to give organizations sufficient time to prepare for the new reporting obligation.

The NCSC will provide a reporting form on its online Cyber Security Hub, which the agency already uses to exchange information with critical infrastructure operators. Organizations that are not registered on the platform may submit reports by e-mail using a form available on the NCSC website. After submitting an initial report within 24 hours of incident discovery, organizations will have an additional 14 days to complete the report.

The news release adds that the Federal Council has approved the Cybersecurity Ordinance, which also will enter into force on April 1. The ordinance contains implementing provisions for the new reporting obligation and regulates exemptions from the requirements as provided by article 74c of the ISA.

News: InternationalLegislation DataSecurity DataBreach