Cybersecurity regulation in Switzerland (2026)

Sanctions under Art. 74h of the Information Security Act became enforceable for critical infrastructure operators that wilfully fail to report significant cyberattacks within the 24-hour deadline set by the NCSC. The Federal Council deliberately delayed enforcement by six months to allow affected organisations to prepare.

Switzerland's first cross-sector mandatory cyber incident reporting regime — amending the Information Security Act — took effect, requiring energy, water, and transport operators as well as cantonal and communal administrations to notify the NCSC within 24 hours of discovering a significant attack and submit a full report within 14 days. The accompanying Cybersecurity Ordinance (adopted by the Federal Council on 7 March 2025) provides implementing rules and reporting exceptions.

Three major instruments took effect simultaneously: the NCSC formally became a federal office under the Federal Department of Defence, Civil Protection and Sport (DDPS); the Information Security Act (ISA/ISG) entered into force for the entire federal administration; and FINMA Circular 2023/1 on operational risks and resilience became mandatory for banks and securities dealers (with resilience-specific transition periods running to 2026).

Parliament approved an amendment to the Information Security Act creating a statutory reporting obligation for cyberattacks on critical infrastructure — Switzerland's first cross-sector cyber reporting requirement. The vote was partly catalysed by the May 2023 Xplain ransomware incident and the resulting exposure of thousands of sensitive federal files.

The Play ransomware gang breached Xplain, a technology supplier to federal police, justice, and migration authorities; attackers published roughly 65,000 sensitive federal documents on the dark web in June 2023, including classified files and PII from the Federal Department of Justice and Police. The incident became the most significant Swiss government data breach on record and directly accelerated the mandatory reporting legislation.

Switzerland's third national cyberstrategy replaced the 2018–2022 NCS with five strategic objectives: empowering citizens and businesses, securing digital services and critical infrastructure, defending against and managing cyberattacks, combating cybercrime, and deepening international cyber cooperation.

FINMA issued a revised and consolidated circular integrating Basel Committee operational resilience principles, requiring banks and securities dealers to adopt a structured cyber risk framework (identify, protect, detect, respond, recover), carry out regular penetration testing, and report significant cyber incidents to FINMA within 24 hours with a detailed follow-up within 72 hours.

In a single session, the Federal Council resolved to transform the NCSC into an autonomous federal office effective 1 January 2024 (to be housed under DDPS) and adopted the dispatch proposing mandatory cyberattack reporting for critical infrastructure for submission to the Federal Assembly.

This executive ordinance created the first legally binding cybersecurity obligations across all federal administrative units, mandating risk management processes, incident reporting to the NCSC, and minimum protective measures — translating the NCS II strategic goals into operational requirements for government bodies.

The Swiss government and GovCERT published a 34-page technical report revealing that Turla (Snake/Uroburos) APT malware — linked to Russian-language threat actors — had infiltrated RUAG, the state-owned defence company, since at least September 2014 and exfiltrated more than 23 GB of data. The incident was a watershed for Swiss federal cyber defence and infrastructure protection policy.