Switzerland’s ISA: New Cyberattack Reporting for Critical Infra

Switzerland's Information Security Act (ISA), or Informationssicherheitsgesetz (ISG), has transitioned from a legislative concept to an active compliance regime. Mandatory reporting obligations for cyberattacks affecting critical infrastructure are now in effect as of April 1, 2025 Source.

This development creates a dual compliance landscape for businesses in or serving the Swiss market. The ISA focuses on the security of federal information and critical infrastructure protection, while the revised Federal Act on Data Protection (FADP), effective September 1, 2023, addresses personal data handling.

Immediate Actions for Businesses

Businesses need to undertake several crucial steps. This includes scoping their ISA exposure to determine if they qualify as critical infrastructure operators, federal authorities, or suppliers to these categories. A gap assessment mapping existing security controls against ISA’s technical and organizational measures (TOMs) and FADP guidance is also essential.

Furthermore, all vendor and cloud contracts require review to ensure data-processing agreements include audit rights, encryption commitments, subprocessor controls, and ISA-aligned breach-notification clauses. Businesses must also establish a 24-hour incident-response capability, especially for critical infrastructure operators who must notify the National Cyber Security Centre (NCSC) within that timeframe upon discovering a qualifying cyberattack Source. Documentation of policies, risk assessments, training records, and incident logs is critical for demonstrating compliance.

Understanding ISA's Scope and Definitions

The ISA applies to federal authorities, cantonal authorities (when accessing federal systems), and most significantly, operators of critical infrastructure. These include sectors like energy, transport, water supply, healthcare, finance, telecommunications, and digital infrastructure. Private businesses not directly operating critical infrastructure may still be affected indirectly through contracts with federal bodies or critical infrastructure operators Source.

Key definitions under ISA include:

• Operator of critical infrastructure: An entity whose systems are vital for public life, the economy, or public safety in Switzerland.
• Critical infrastructure: Infrastructure whose disruption would severely impact national security, the economy, or public welfare.
• Cyberattack (reportable): An attack threatening critical infrastructure functionality, leading to data manipulation or leaks, or remaining undetected for a long period, affecting availability, integrity, or confidentiality of critical systems/data Source.

ISA and FADP: Overlap and Compliance Priorities

While distinct, ISA and FADP share the common requirement for implementing appropriate technical and organizational measures (TOMs) to protect data and systems. Compliance teams should aim to build an integrated TOM framework that satisfies both regulatory frameworks simultaneously.

The ISA focuses on federal information and critical infrastructure protection, while FADP centers on personal data protection, including breach notifications to the Federal Data Protection and Information Commissioner (EDÖB) and, if required, to affected individuals. The interaction between these acts is evident in TOM scope, breach reporting triggers, and cross-border data transfer rules.

Differentiating Data Breaches and ISA Incidents

It's crucial to distinguish between an ISA-reportable cyberattack and an FADP data breach, as each has different reporting channels and timelines:

• ISA incident only: If a cyberattack disrupts critical infrastructure but no personal data is compromised, report to the NCSC within 24 hours.
• FADP breach only: If a database exposes personal data but the system isn't critical infrastructure, notify the EDÖB as soon as possible. Data subjects may also need notification.
• Dual-trigger event: A ransomware attack on critical infrastructure that encrypts systems and exfiltrates personal data requires notification to both the NCSC (within 24 hours under ISA) and the EDÖB (as soon as possible under FADP). Incident response plans must include parallel notification tracks Source.

Cross-border data transfer implications, especially with cloud services hosted outside Switzerland, must also be considered within ISA compliance programs.