Cybersecurity is often treated as a technology question. In an emergency, organisation decides first: who notices the attack, who decides on shutdowns, who reports within 24 hours, and is there a backup that can actually be restored? We answer these questions before they become urgent.
Clarify reporting duties
Since 1 April 2025 Switzerland has had a reporting obligation for cyberattacks on critical infrastructure under the Information Security Act. Running in parallel are data breach notification under Art. 24 FADP, sector reports such as to FINMA and, for companies with EU exposure, NIS2, plus the Cyber Resilience Act for manufacturers of digital products. We establish which duties apply and map all reporting channels with deadlines in one plan.
Know the attack surface
What you do not know, you cannot recognise as under attack. An inventory of internet-facing domains, services and access points (attack surface management) reveals forgotten test systems, outdated software and open admin access. Add the question of shadow AI: which AI tools employees use with which data.
Baseline configuration and recovery
Many successful attacks exploit gaps in baseline configuration: missing multi-factor sign-in, too many administrators, legacy protocols. We review key settings in Microsoft 365 and cloud and check whether backups can demonstrably be restored, with targets described by RPO and RTO.
Plan and exercise
An incident response plan sets roles, contact details, decision rights and reporting channels. It only works once exercised. A tabletop exercise with a realistic scenario reliably shows which phone number is outdated and which decision nobody wants to take.
What we do not do
We do not run a security operations centre and do not sell security products. Penetration tests are carried out with specialised partners where the check shows they make sense. Legal assessment of reporting duties in individual cases stays with you or your law firm. The entry point is the cyber readiness check; context is in our article on the Swiss cyber reporting obligation.