New Cyber Incident Reporting Obligation in Switzerland: What Operators of Critical Infrastructure Need to Know Now

Starting April 1, 2025, the new cyber incident reporting obligation will come into effect in Switzerland. The regulation particularly affects companies classified as critical infrastructure (CI) – such as those in energy, healthcare, finance, telecommunications, transport, and water supply sectors. The goal is to strengthen cybersecurity at the national level, detect incidents early, and improve coordination.

Who is affected?

Operators of critical infrastructure, meaning organizations and companies whose failure would have serious impacts on society, economy, or public security. These include:

• Energy providers (electricity, gas, etc.)
• Telecommunications providers
• Financial service providers (e.g., banks, stock exchanges, payment service providers)
• Hospitals and healthcare providers
• Transport and logistics companies
• Operators of water supply networks

What needs to be reported?

Cyber incidents that result in significant impairment of the availability, confidentiality, or integrity of IT systems and could thereby endanger the operation of critical infrastructure. These include:

• Ransomware attacks
• System failures due to malware
• Data breaches involving sensitive information
• Denial-of-Service attacks (DDoS)
• Compromise by Advanced Persistent Threats (APT)

Who should incidents be reported to?

Reports should be submitted to the National Center for Cybersecurity (NCSC), which is centrally responsible for coordinating and analyzing incidents. Companies and organizations must report relevant incidents immediately, or within a maximum of 24 hours after an incident is detected.

What does this mean for companies?

The new reporting obligation requires affected companies to establish clear internal processes:

• Establishment of an incident response team
• Definition of a reporting process
• Employee training
• Technical monitoring systems
• Regular risk analyses

Additionally, companies should verify whether they formally fall under the CI definition – if unclear, early clarification with the NCSC or the relevant industry association is recommended.

Our Opinion

The introduction of the reporting obligation is an important step for Switzerland's cyber resilience. Operators of critical infrastructure are required to adapt their security processes and be prepared for potential incidents. Those who act now can not only meet legal requirements but also sustainably strengthen their cyber defense.

Further information: https://www.ncsc.admin.ch/ncsc/de/home/aktuell/im-fokus/2025/meldepflicht-2025.html