Cybersecurity for SMEs: reporting duties, baseline protection and incident planning
Since April 2025 Swiss critical infrastructure must report cyberattacks within 24 hours, since September 2026 the Cyber Resilience Act reporting duties apply to manufacturers of digital products, and in Germany NIS2 covers around 29,500 companies. For SMEs one question matters most: can we act in an emergency?
This topic page brings together our content from reporting duties to baseline protection with MFA, DMARC and backups and the response to ransomware, plus checklists, the cyber readiness check and CyveriQ, our product in preparation.
Terms
- Cyberattack reporting obligation (Switzerland)
- NIS2 Directive
- Cyber Resilience Act (CRA)
- Incident response plan
- Ransomware
- The 3-2-1 backup rule
- Multi-factor authentication (MFA)
- DMARC, SPF and DKIM
- Attack surface management (EASM)
- Shadow AI
- Penetration test
- Data breach notification
- RPO and RTO
- Secrets management
- Phishing and CEO fraud
- Zero trust
- Security awareness
- Data loss prevention (DLP)
- Cyber insurance
- Vulnerability management
- SBOM (software bill of materials)
- Business continuity management (BCM)
- Tabletop exercise
Articles
- Switzerland’s cyberattack reporting obligation: what the ISA requires and how to be ready to report within 24 hours
- Phishing and CEO fraud in SMEs: how the attacks work and which processes really protect
- Ransomware in SMEs: what to do in the first 24 hours
- The data breach playbook: preparation, roles and communication before the incident
Checklists
- Checklist: ready to report a cyberattack within 24 hours
- Checklist: creating a first business continuity plan
- Checklist: taking out cyber insurance without jeopardising cover
- Checklist: does NIS2 apply to a Swiss company?
- Checklist: a secure Microsoft 365 baseline configuration
- Checklist: data breach — the first 72 hours
- Checklist: introducing Microsoft 365 governance
Offers
Services
Products
- CyveriQComing soon
More topics
- Anti-money laundering compliance in Switzerland: AMLA, SRO, KYC and transparency register
- Public procurement in Switzerland: procedures, criteria and bids
- AI regulation: EU AI Act, AI governance and the Swiss perspective
- Data protection under the Swiss FADP and GDPR: duties, processes and evidence
- Requirements and projects: requirements engineering, HERMES and acceptance
LM
Reviewed by
Founder & CEO · MSc Innovation Management (FFHS) · PMP · IREB CPRE · Author of “Identity Over Discipline”
Mandates incl. EDA, MeteoSwiss, FSO, SERI, FINMA, Swisscom and BLS