Login
iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Powered by MOMENTUMMEDIA
Switzerland has announced that the critical sector will be mandated to report a cyber attack within 24 hours of discovery.
From 1 April, critical infrastructure operators who suffer a cyber attack will be required to report it to the Swiss National Cyber Security Centre (NCSC) within the first 24 hours of discovering a breach.
These include water, energy, communications, transport, health, administration and more areas of the critical sector.
“These reports will enable the NCSC to assist victims of cyber attacks and alert operators of critical infrastructure,” said the NCSC in a statement.
“The move is considered a significant step for Swiss cyber security, enhancing information sharing and response to cyber threats.“
The new mandate is an amendment to Switzerland’s Information Security Act, and while it will come into effect in April, those who fail to report will not face sanctions until 1 October, allowing operators to prepare their threat detection and analysis.
“This means that the reporting obligation will apply for six months before failure to report becomes sanctionable,” added the NCSC.
Those organisations that suffer a cyber attack that “threatens the functioning of critical infrastructure, has resulted in the manipulation or leakage of information, or involves blackmail, threats or coercion” will be mandated to report it under the new scheme.
To ease the reporting process, the NCSC has made the reporting form available on its Cyber Security Hub website. Those who are not registered can access a form on the NCSC website and email it.
“After submitting the initial report within 24 hours of discovering the incident, they have 14 days to complete their report,” it said.
The NCSC said the new reporting requirements are in line with international standards, including the EU Directive that mandates that all EU member states report cyber security events.
Australia, the US, Japan, the UK, and more have also mandated reporting requirements for critical infrastructure.
The Australian Cyber Security Centre (ACSC) requires organisations that become “aware that a critical cyber security incident has occurred, or is occurring, AND the incident has had, or is having, a significant impact on the availability of your asset” to report it to the ACSC within 12 hours of discovery.
Be the first to hear the latest developments in the cyber industry.
