Checklist: ready to report a cyberattack within 24 hours
For: Critical infrastructure operators and their providers
Updated: 2026-11
A company is ready to report when it has clarified its applicability under the ISA, regulated roles and 24/7 reachability, has a decision aid on the reporting duty, prepared the initial report, knows parallel reporting duties, obliged providers to cooperate and exercised the process.
Since 1 April 2025 critical infrastructure operators must report cyberattacks to the Federal Office for Cybersecurity within 24 hours of discovery; since October 2025 failure to report can be fined. This checklist describes what must be organised in advance.
It is also useful for companies not subject to the duty: the steps largely match the preparation for data breach notifications under the FADP and GDPR.
The checklist
- 01
Clarify applicability
Check against the ISA whether the organisation is subject to the duty and record the result.
Done when: A written finding with reference to the relevant provision exists.
- 02
Define roles
Name the incident lead, deputy and the person who decides on reporting.
Done when: Roles are assigned by name and known to the people concerned.
- 03
Ensure reachability
A 24/7 incident contact list that works without email and the company network.
Done when: The list is available outside the IT systems and has been checked in the last three months.
- 04
Provide a decision aid
Summarise the statutory criteria for reportable attacks with examples on one page.
Done when: The decision aid is with the deciding people and has been used in an exercise.
- 05
Prepare the initial report
Clarify access to the federal office’s reporting channel and prepare the typical information as a template.
Done when: A template with the initial report fields exists; whoever reports knows how to access the channel.
- 06
Map parallel duties
Place FDPIC data breach notification, sector supervisors and NIS2 or CRA where relevant alongside the federal report.
Done when: An overview lists every reporting channel with deadline and owner.
- 07
Involve providers and exercise
Agree cooperation duties with IT providers and run a tabletop exercise once a year.
Done when: Contracts contain cooperation and reachability terms, and the record of the last exercise exists.
Common mistakes
- —Debating the reporting question only during the incident and losing the 24 hours.
- —Storing the contact list only on a system that is encrypted during the incident.
- —Forgetting the data breach notification because the federal office has already been informed.
- —Leaving decisions on shutdowns and communication to IT alone.
What this checklist does not cover
- —The checklist does not replace legal review of the reporting duty in individual cases.
- —Technical measures for detecting and defending against attacks are not covered.
- —Sector-specific reporting duties, for example towards FINMA, must be clarified separately.
Parent service: Cyber readiness & IT security
Matching offers
Cyber readiness check
The cyber readiness check establishes whether your company detects an attack in time, responds correctly and reports on time: review of reporting duties under the ISA, FADP and NIS2 where relevant, inventory of the attack surface, review of cloud and Microsoft 365 baseline configuration, backup recoverability, an incident response plan and a tabletop exercise.
Data breach readiness: playbook, notification process and drill
Data breach readiness gives you a ready-to-use playbook: named roles and emergency contacts, a decision matrix per system for notification duties under the FADP and GDPR, templates for authorities, data subjects and customers, an incident register and a guided drill. In an emergency you decide in minutes instead of hours.
FAQ
When do the 24 hours start?
At discovery of the attack. That is why escalation must work immediately.
What if not all information is available?
The initial report may be incomplete; missing details can be added within 14 days.
Must blocked attacks be reported?
Generally not. Reportable are attacks with the consequences named in the act.
More checklists
Checklist: preparing for SRO membership
SRO membership is prepared in seven steps: clarify coverage and professional activity, choose a suitable SRO from the current FINMA list, define organisation and AML responsibility, align directives with the regulation, prepare a risk assessment, submit a complete application and set up operations with documentation from the first client.
Checklist: introducing Microsoft 365 governance
Microsoft 365 governance is introduced in seven steps: take inventory, set rules for creating teams and sites, require at least two owners per team, review guest access regularly, classify sensitivity and retention, define a lifecycle with archiving and steer flows and apps through an approval process.
Checklist: writing an app brief
A good app brief describes the goal and user groups, the three to five most important flows, platform requirements, the necessary data and interfaces, requirements for operations and data protection, and measurable success criteria. It leaves the technical solution open and makes proposals comparable.