National strategy for the protection of Switzerland against cyber risks 2018-2022 4.4 Standardisation / Regulation Description ICT standardisation and regulation are important tools for protecting against cyber risks. Minimum requirements for protective measures strengthen prevention, and specifications for dealing with incidents (e.g. reporting obligations) contribute to an improved response. Standardisation and regulation are also important in the international context, given that they create more transparency and trust in the globalised digital society. When introducing standardisation and regulation, however, the major differences between economic sectors and companies of different sizes must be taken into account. Sectors are not all equally exposed to cyber risks, and the financial and human resources of companies vary widely. Standardisation and regulation must therefore be developed and introduced in close cooperation between the private sector and the state. Moreover, the international context must always be taken into account. Standards and regulations in cross-border cyberspace must be as internationally compatible as possible. The work of international standardisation bodies and regulatory developments relevant to Switzerland must therefore be observed. The various internet governance processes created by the UN World Summit on the Information Society (WSIS) also fall within the scope of standardisation and regulation. These processes deal with the development of principles, norms, rules and decision-making mechanisms for the development and use of the internet at the international level. In implementing WSIS Action Line C5 (Building Confidence and Security), the ITU serves as the moderator of various projects and strands of work. In addition, other international actors such as the OECD and the WEF have launched processes and activities to improve security in the digital field. The WSIS's key concern of involving all stakeholders (multi-stakeholder approach) takes account of the development that norms and rules in the digital world are increasingly determined by private global actors and that cooperation between public and private actors is therefore of fundamental importance. Background Various sectoral and general standards for cyber security exist. In cooperation with the private sector, an initial assessment was made of the need for standardisation and regulation in the various sectors. Familiarity exists with developments in international standardisation bodies and in the area of regulation in other countries. The EU Network and Information Security Directive (NIS Directive) has been adopted at the European level and is now being implemented by the Member States. The directive provides for the introduction of minimum standards and an obligation to report cyber incidents. In the area of internet governance, the bodies, processes and events of particular relevance to Switzerland have been identified, responsibilities within the federal government have been clarified, and coordination with all involved actors has been ensured thanks to the processes established by the NCS. Objectives and need for action Overview of sphere of action The growing importance of ICT standardisation and regulation must be taken into account. Binding and verifiable minimum ICT standards are relevant for security and confidence in the digital economy and society, and they must be evaluated in cooperation with the private sector and introduced where appropriate. It should also be examined whether and how an obligation to report cyber incidents should be introduced. The measures take account of the international context, which has a significant influence on them, which is why developments must continue to be monitored. Switzerland therefore contributes its interests and values to the most important processes. 16