Since 1 April 2025 Switzerland has had a statutory reporting obligation for cyberattacks on critical infrastructure. Operators must report attacks to the Federal Office for Cybersecurity within 24 hours of discovery. Since 1 October 2025 failure to report can be fined up to CHF 100,000. The office counted 222 reports from critical infrastructure in 2025. This article describes who is affected, what must be reported and how to organise the 24 hours before you need them.
Who is affected
The Information Security Act lists the organisations concerned. They include energy and drinking water utilities, transport companies, hospitals on cantonal lists and cantonal and municipal administrations; further sectors are specified by the act and the Cybersecurity Ordinance. The assessment of whether your organisation is covered should be recorded in writing with reference to the relevant provision. Those not covered can report voluntarily and receive support and warnings through the information exchange.
Companies outside the scope still feel the obligation. Covered operators pass requirements on to their IT providers: availability during incidents, delivery of information within hours, cooperation in the analysis. Anyone supplying critical infrastructure should know what their customers will need from them in an emergency.
What must be reported
Not all attempted attacks, but attacks with specific consequences: they endanger the functioning of the infrastructure, have led to manipulation or leakage of information, remained undetected for a long time, especially where there are indications of preparation for further attacks, or involve extortion, threats or coercion. A successful ransomware infection usually meets several criteria at once; a blocked phishing attempt meets none.
Organising the 24 hours
Twenty-four hours is little time in an incident. A four-step sequence, defined and exercised in advance, works well:
- Detect and escalate: whoever notices a possible attack knows whom to contact, including at night and at weekends. The clock starts at discovery.
- Assess: a named person checks against the statutory criteria whether reporting is required and records the reasoning, even if the answer is no.
- Initial report: report via the federal office’s form with the information available. Incomplete information is allowed and can be completed within 14 days.
- Follow up: analysis results, impact and measures are added within the deadline.
The critical point is almost always the second step. If the reporting question is debated only during the incident, the hours run out. A short decision aid with the statutory criteria and examples belongs in the incident response plan.
Parallel reporting duties
The report to the federal office is rarely the only one. If personal data is affected and there is a high risk to data subjects, the FDPIC must also be informed as soon as possible under Art. 24 FADP (data breach notification); data subjects may also need to be notified. Financial institutions have their own reporting duties towards FINMA with their own deadlines. Companies active in the EU may fall under NIS2, and manufacturers of digital products have been subject to the reporting duties of the Cyber Resilience Act since 11 September 2026. Organising these channels separately leads to duplicate, contradictory or late reports.
Preparation that works
Four measures make the biggest difference. First, an inventory of systems and owners, including the internet-facing attack surface (attack surface management); what you do not know, you cannot recognise as under attack. Second, an incident response plan with roles, contact details, decision rights and all reporting channels. Third, tested backups whose restore demonstrably works. Fourth, one tabletop exercise per year with a realistic scenario and a stopwatch. It reliably shows which phone number is outdated and which decision nobody wants to take.
Common mistakes
Treating the obligation as a pure IT topic, although decisions on shutdowns, communication and reports are management decisions. Not documenting the reporting assessment, so that it is later unclear why a report was or was not made. External providers not contractually obliged to cooperate. And the plan stored as a file on a system that is encrypted during the incident.
Context
The obligation does not require perfect defence but transparency and speed. For well-organised operators it is one additional process step. For organisations that do not know their systems and responsibilities, it is the occasion to catch up. The sequence with verifiable criteria is in our cyber reporting checklist; we support the set-up in the cyber readiness check.