With an amendment to the Information Security Act, Switzerland introduced a statutory reporting obligation for cyberattacks. It has applied since 1 April 2025 and is aimed at operators of critical infrastructure. The federal office counted 222 reports from critical infrastructure in 2025.
Who must report
The ISA lists the organisations concerned. They include energy and drinking water utilities, transport companies, hospitals on cantonal hospital lists and cantonal and municipal administrations, plus further sectors specified by the act and the Cybersecurity Ordinance. Whether a company is covered should be established and recorded from the legal text. Those not covered can report voluntarily.
What is reportable
Not every attempted attack must be reported. Reportable are attacks that endanger the functioning of the critical infrastructure, that led to manipulation or leakage of information, that remained undetected for a long time, especially where there are indications they were preparing further attacks, or that involve extortion, threats or coercion. A blocked phishing attempt is usually not reportable; a successful ransomware infection is.
Deadlines and channel
The initial report is due within 24 hours of discovery via the federal office’s reporting form. Details not yet available can be added within 14 days. Since 1 October 2025 fines of up to CHF 100,000 are possible; the office first contacts operators who fail to report and sets a deadline. Twenty-four hours is tight: settling who reports and with what information only during an incident costs time needed for defence.
Relation to other duties
Reporting to the federal office does not replace other duties. If personal data is affected and there is a high risk, the FDPIC must also be informed as soon as possible under Art. 24 FADP (data breach notification). Sector supervisors such as FINMA have their own channels, and companies active in the EU may also fall under NIS2. An incident response plan should set out all of these side by side. All key dates are listed in our regulatory deadlines overview.
Further reading
The first hours after an attack are described in our article on ransomware in SMEs; all related content is collected in the cybersecurity topic page.