Ordinance
on Protection against Cyber Risks
in the Federal Administration
(Cyber Risks Ordinance, CyRV)

The Federal Council shall carry out the following tasks:

1. It monitors the implementation of the NCS on the basis of the strategic controlling and decides on measures as required.

2. It shall within the scope of its responsibilities specify the areas in which directives on protection against cyber risks are required or must be revised.

3. It shall issue directives on protecting the Federal Administration against cyber risks.

4. It shall authorise derogations from its directives.

The Cyber Core Group (CyCG) shall comprise:

1. the Federal Cyber Security Delegate (Art. 6a of the Federal Department of Finance Organisation Ordinance of 17 Feb. 2010⁷) as the representative of the Federal Department of Finance (FDF);

2. a representative of the Federal Department of Defence, Civil Protection and Sport (DDPS);

3. a representative of the Federal Department of Justice and Police (FDJP);

4. a representative of the cantons appointed by the Conference of Cantonal Governments.

The Federal Cyber Security Delegate chairs the Group.

The CyCG shall inform representatives of other federal administrative units that are active in connection with cyber risks about its agenda and may invite them to attend individual meetings. Where matters have a foreign policy dimension, it may involve the Federal Department of Foreign Affairs (FDFA). In addition it may involve experts from the private sector and the universities.

The CyCG has the following tasks in particular:

1. It assesses current cyber risks and their potential development on the basis of information from the domains of cyber security, cyber defence and cyber prosecution.

2. It continuously evaluates the existing systems in the domains of cyber security, cyber defence and cyber prosecution and checks whether these are adapted to the threat situation.

3. It provides support, if necessary with other offices, for interdepartmental incident management.

4. It informs the Federal Security Core Group (SCG) about cyber incidents and developments that are relevant to foreign and security-policy.

The three departments represented in the CyCG shall make information available for the joint assessment of a situation.

The Federal Intelligence Service is responsible for presenting the overall cyber threat situation to the CyCG.

The Federal Council shall appoint a Steering Committee for the National Strategy for the Protection of Switzerland against Cyber Risks (NCS StC).

The NCS StC shall comprise the Federal Cyber Security Delegate, representatives from the cantons appointed by the Conference of Cantonal Governments, representatives of business and the universities and representatives of the administrative units that are responsible for implementing any NCS measures in accordance with the NCS implementation plan. Each department and the Federal Chancellery shall appoint at least one representative to the NCS StC.

The Federal Cyber Security Delegate chairs the Steering Committee.

The NCS StC has the following tasks:

1. It ensures the strategic coherence of the implementation of NCS measures and checks their progress continuously by a process of strategic controlling.

2. It draws up proposals for special measures in the event of the delayed or incomplete implementation of NCS measures.

3. It ensures the ongoing further development of the NCS; to do so it monitors the development of the threat situation in consultation with the CyCG and devises proposals for the adjustment of the NCS as required.

4. It prepares a report each year on the implementation of the NCS for the Federal Council and the public.

5. It ensures all the offices concerned from the Confederation, cantons, business and universities take a coordinated approach to implementing the NCS measures.

6. It ensures that in implementing the NCS measures account is taken of the risk policy of the Confederation, the national strategy to protect critical infrastructures and the Federal Council strategies in relation to information technology.

The IT Security Committee (ITSC) comprises a representative of the National Cyber Security Centre (NCSC⁸), the departmental and the Federal Chancellery IT security officers and the IT security officers for standard information and communication technology services (ICT).

Additional persons may be included in an advisory capacity on a case-by-case basis.

The NCSC representative chairs the committee.

The ITSC acts as a consultative body for the NCSC on IT security issues in the Federal Administration.

The Federal Cyber Security Delegate has the following tasks:

• a. He or she chairs the NCSC.

• b. He or she ensures the best possible coordination of cross-departmental work in the domains of cyber security, cyber defence and cyber prosecution.

• c. He or she ensures the visibility of the activities of the Confederation related to cyber risks, contributes to achieving the best possible conditions for an innovative cyber security economy, is the relevant federal contact person for cyber risks and represents the Confederation in the relevant committees and working groups; he or she ensures the best possible coordination of the work of the cantons and of the Confederation to protect Switzerland against cyber risks.

• d. He or she represents the NCSC in the federal crisis units.

• e. He or she shall issue IT security directives.

• f. ⁹He or she decides on derogations from the directives that he or she issues; if the derogations also affect directives issued by the Federal Chancellery on the digital transformation und ICT steering, he or she shall consult the Federal Chancellery beforehand.

He or she shall regularly inform the FDF on behalf of the Federal Council about the status of information technology security in the departments and the Federal Chancellery.

He or she may participate in the preparation of Federal Administration IT directives that relate to cyber security and in security-relevant IT projects. In particular he or she may request information, comment thereon and request changes.

He or she may, after consulting the Swiss Federal Audit Office, request audits of information technology security.

The NCSC is the centre of excellence of the Confederation for cyber risks and coordinates the work of the Confederation in the cyber security domain. It has the following tasks:

1. It runs the National Contact Point for Cyber Risks; this receives reports from the Federal Administration, the private sector, the cantons and the public, analyses them and may issue recommendations thereon.

2. It ensures with its cooperation partners in the Federal Administration that subsidiary support is given to operators of critical infrastructures and encourages these operators to exchange information on cyber risks.

3. It runs the Computer Emergency Response Team (GovCERT); this is the national specialist service responsible for technical aspects of incident management, analysing technical questions, assessing the threat situation from a technical viewpoint and providing technical support to the National Contact Point.

4. It runs a specialist service for the federal information technology security; this shall draw up IT security directives, advise the administrative units on their implementation and monitor the status of information technology security in the departments and the Federal Chancellery.

5. It provides the federal IT security officers (FITSOs).

6. It coordinates the implementation of the NCS, conducts strategic controls and prepares the meetings of the CyCG and of the NCS StC.

7. It has a pool of experts from which experts are provided to support the individual offices in implementing NCS measures and in developing, implementing and checking standards and regulations in relation to cyber security.

8. It contributes with specific information to raising awareness of cyber risks in the Federal Administration and among the general public, provides information on the current situation and gives instructions on preventive and reactive measures.

9. It runs a resilient analysis and communications infrastructure that must function independently of the other federal IT systems.

10. It informs the CyCG and, on matters of importance to foreign and security policy, the SCG about relevant cyber incidents.

It may, provided this directly or indirectly serves to protect the Federal Administration against cyber risks, process data on cyber incidents and associated communication flows. It may disclose such data to government and private security teams, provided:

1. the data provider agrees; and

2. no statutory duties of confidentiality are infringed.

A disclosure of personal data abroad is only permitted if the related requirements of the federal legislation on data protection are complied with.

Sensitive personal data may only be processed if there is a statutory basis for processing such data with the means available within the federal IT systems.

After consulting with the offices concerned, the NCSC shall assume overall responsibility within the Federal Administration for managing a cyber incident if the incident poses a risk to the proper functioning of the Federal Administration. In doing so, it has the following tasks and powers:

1. It may require the service providers and recipients concerned to provide it with all necessary information.

2. It may order immediate measures.

3. It shall update the management of the administrative units concerned on the current situation.

If, following a cyber incident, the risk to the confidentiality or the efficiency of the Federal Administration is sufficiently reduced by the measures taken and if the required follow-up work and its funding have been defined, the NCSC shall reassign responsibility for the further processing to the offices concerned.

The departments and the Federal Chancellery shall report to the NCSC at the end of the year on the status of information technology security.

The internal service providers in accordance with Article 9 DTIO¹⁰ shall submit regular reports to the NCSC on weaknesses and cyber incidents that have been detected and on measures planned and taken for their rectification.¹¹

The departments and the Federal Chancellery shall each appoint a departmental IT security officer (ITSOD), who shall act on the direct instructions of the head of department.¹²

The ITSODs are in particular responsible for:

1. coordinating IT security aspects within the department or the Federal Chancellery and with the offices responsible for cross-departmental coordination and cooperation.

2. drawing up the required principles for implementing the IT security directives and for organisation at the level of the department or the Federal Chancellery.¹³

The departments and the Federal Chancellery shall regulate the relationship between the ITSODs and the IT security officers for the administrative units (ITSOOs), in particular technical leadership on security issues.¹⁴

The administrative units shall each appoint an IT security officer (ITSOO) who shall act on the direct instructions of the head of the administrative unit. The Digital Transformation and ICT Steering Sector at the Federal Chancellery (DTI Sector of the FCh) shall also appoint an IT security officer for standard services.

The ITSOOs and the IT security officer for standard services shall carry out the following tasks:

1. They shall ensure the rapid implementation of the IT security directives and the use of the security procedures in the administrative units (Chapter 3a).

2. They shall ensure that employees are made aware of and receive training on IT security issues on taking up employment and periodically thereafter and are familiar with the responsibilities and procedures for information technology security in their working environment relevant to their level and function.

3. They shall report to the head of their administrative unit at least every six months on the current status of information technology security in their administrative unit.

The administrative units are responsible for the security of their protected IT systems. They shall carry out the following tasks:

1. They shall conduct an inventory of their protected IT systems and take the required security measures; they shall in particular ensure that these measures are documented for the individual protected systems in the current manner.

2. They are responsible for compliance with and the implementation of the IT security directives and the decisions of the Federal Council, the NCSC and the departments or the Federal Chancellery within the scope of their responsibilities.

3. They are responsible, subject to Article 12 paragraph 5, for managing cyber incidents that affect their protected IT systems.

4. When obtaining services from an external service provider, they shall ensure that the IT security directives form part of the contractual relationship with that provider.

5. They shall verify in an appropriate manner whether external service providers are complying with the IT directives.

6. They shall ensure that the responsibilities for information technology security at an operational level are set out in the project and performance agreements between service providers and service procurers.

7. They shall ensure that persons to whom this Ordinance does not apply are only allowed access to federal IT infrastructure if they undertake to comply with the IT security directives.

The service providers shall perform the following functions:

1. They shall provide their service procurers on request with all the information required to protect their protected IT systems in an appropriate form.

2. They shall ensure that they have the capacities required to conduct a technical analysis and manage cyber incidents that affect them directly or affect their service procurers.

3. They shall report to their service procurers without delay any weaknesses and security incidents that they detect that relate to their protected IT systems.

4. They shall work with the service providers to define a process for managing cyber incidents. The process shall in particular regulate decision-making powers in relation to immediate measures.

If it is not possible to manage a cyber incident in accordance with the defined process, the parties concerned shall inform the NCSC so that it can decide on what further action to take.

The administrative units shall consult the NCSC in connection with security-relevant IT directives as well as projects.

They are responsible for developing, implementing and checking standards and regulations in relation to cyber security in their sectors. The NCSC shall wherever possible provide them with experts from the pool mentioned in Article 12 paragraph 1 letter g.

Employees of the Federal Administration who use IT Resources are responsible for using them in accordance with the regulations.