Statutory Core Requirements
- 24-Hour Mandatory Deadline: Any cyberattack with significant damage potential must be reported to FOCS within 24 hours of discovery.
- Covered Sectors: Energy, water supply, hospitals and clinics, cantonal and municipal authorities, banks, insurance companies, telecoms, and critical digital service providers.
- Penal Fines: Intentional failure to report is punishable by fines of up to CHF 100,000 (Art. 74f ISA).
- Technical Preparedness: The reporting mandate effectively necessitates continuous attack surface monitoring and rapid incident detection capabilities.
1. Legislative Framework and the Role of FOCS
Following high-profile ransomware attacks on Swiss hospitals, cantonal authorities, and municipal administrations, the Federal Assembly introduced mandatory cyber reporting into the Information Security Act (ISA). The Federal Office for Cyber Security (FOCS, formerly NCSC/BACS) acts as the central national authority.
| Aspect | ISA Mandate (FOCS) | revised FADP Mandate (FDPIC) |
|---|---|---|
| Statutory Purpose | National early warning and critical infrastructure protection | Protection of individual fundamental rights and personal data |
| Notification Deadline | Within 24 hours of discovery | As quickly as possible (typically within 72 hours) |
| Supervisory Body | Federal Office for Cyber Security (FOCS) | Federal Data Protection and Information Commissioner (FDPIC) |
| Financial Penalties | Fine up to CHF 100,000 (Art. 74f ISA) | Personal criminal fine up to CHF 250,000 (Art. 60 revFADP) |
