Swiss critical sector faces new 24-hour cyberattack reporting rule

Switzerland’s National Cybersecurity Centre (NCSC) has announced a new reporting obligation for critical infrastructure organizations in the country, requiring them to report cyberattacks to the agency within 24 hours of their discovery.

According to the NCSC announcement, this new requirement is introduced as a response to the increasing number of cybersecurity incidents and their impact on the country.

Examples of types of cyberattacks that will have to be reported include:

Cyberattacks that jeopardize the operation of critical infrastructure
Manipulation, encryption, or exfiltration of data
Extortion, threats, and coercion
Malware installed on systems
Unauthorized access to systems

The mandate is introduced via an amendment to the Information Security Act (ISA), which will go into effect on April 1, 2025. The law applies to critical service providers such as utilities, local government, and transportation organizations.

“The Federal Council has decided that the amendment to the Information Security Act (ISA) of 29 September 2023 will enter into force on 1 April,” reads the announcement.

“The ISA stipulates that authorities and organisations subject to the reporting obligation, such as energy and drinking water suppliers, transport companies and cantonal and communal administrations, must report cyberattacks to the NCSC within 24 hours of discovery.”

The complete list of all entity types that are impacted by this new requirement is published here.

A leniency period will be given until October 1, 2025, but failure to comply after that date will result in fines of up to CHF 100,000 ($114,000).

Organizations impacted by a cybersecurity incident will have to report it via an online form on the NCSC site or via email, with no registration required.

The first report must be submitted within 24 hours of the incident’s discovery, and a follow-up report with additional details will be expected in the next 14 days.

There are provisions for particular exceptions under Art. 74c of the ISG, with more details available here.

Switzerland calls this new requirement a milestone for cybersecurity in the country, noting that it is in accordance with the NIS Directive, an EU-wide cybersecurity legislation that applies to operators of essential services and digital service providers.