National strategy for the protection of Switzerland against cyber risks 2018-2022 Measures 8) Evaluation and introduction of minimum standards On the basis of the risk and vulnerability analyses, verifiable minimum ICT standards are evaluated and introduced in close cooperation among the specialist authorities, the private sector and the associations. Where available, existing standards are used and adapted if necessary. Building on the results of the vulnerability analyses, the competent authorities examine for which organisations and activities the standards should be binding. 9) Examination of a reporting obligation for cyber incidents and decision on introduction In order to improve the picture of the cyber threat situation, introduction of a reporting obligation for cyber incidents shall be examined and decided on. The first questions to be clarified are who should be subject to a reporting obligation, what incidents the reporting obligation concerns, to whom the incidents must be reported, and whether a reporting obligation can substantially improve the picture of the situation compared with today. Variants for implementation of reporting obligations in the various sectors will be developed and the requisite legal basis defined. This is done with the involvement of the relevant authorities, the private sector and associations, in coordination with the national strategy for the protection of critical infrastructures and taking international developments into account. On the basis of these clarifications, a decision is then made on introduction of a reporting obligation, and the necessary steps are taken where appropriate. 10) Global internet governance Switzerland should work actively and in a coordinated manner to promote an international regulatory framework for the use and further development of the internet that is compatible with Switzerland's ideals of freedom, democracy and (personal) responsibility, the supply of basic services, equal opportunities, security, human rights and the rule of law. For this purpose, the national stakeholders must be involved and the relevant developments presented to them. 11) Building expertise on standardisation questions relating to cyber security The federal government builds up a pool of experts on standardisation questions relating to cyber security. The pool of experts advises regulators on the development and implementation of topic-specific standards, regulations and guidelines. Where necessary, the pool of experts supports the cantons, monitors international developments relating to standardisation and regulation, and communicates with the private sector in this regard. By doing so, the pool of experts contributes to a coordinated approach in line with international developments. 17