National strategy for the protection of Switzerland against cyber risks 2018-2022 4.6 Crisis management Description Cyber incidents can have serious consequences and escalate to the point where crisis management becomes necessary at the national level. An up-to-date, uniform, and comprehensive picture of the situation is crucial for handling crises, as are the definition of efficient decision-making processes and a communication strategy. Crisis management is in principle scenario-independent. This means that the general crisis management procedures of the cantons and the federal government are still valid for crises with cyber aspects. In such crises, however, it is important for the crisis teams to be supported by specialist knowledge and intensive cooperation among all competent federal, cantonal and private sector bodies. Only in that way can it be ensured that all relevant information for handling the crisis is available in a timely and comprehensible form. Because no time can be lost in managing crises, the processes must be rehearsed in advance, and concepts for leadership and communication must be developed. Background Based on the results of the Strategic Leadership Exercise 2013, a concept for the management of crises with cyber aspects was drawn up at the federal level. This concept was subsequently expanded in cooperation with the cantons and business representatives into a concept for the national crisis management of cyber risks. The concept was tested and the exercises evaluated. The availability of a picture of the situation that is as precise and up-to-date as possible is considered to be a crucial element and the most important challenge in managing crises with cyber aspects. Objectives and need for action Overview of sphere of action The exercises have shown that capabilities for coordination at the operational level and for description of the situation must be expanded. The responsible cyber security offices must be directly involved in crisis management at the federal level, which is carried out by the existing or ad hoc crisis teams. Cooperation with the cantons and the private sector must also continue to be rehearsed on a regular basis so that those involved know their respective responsibilities and contact points. Measures 16) Integration of the responsible cyber security offices into the federal crisis teams The existing crisis teams (Federal Crisis Management Board for Civil Protection and FONES Crisis Team) are employed to deal with cyber crises, or ad hoc crisis teams are formed. The responsible cyber security offices must be integrated into the crisis teams, and they must have the capabilities to assume specialised coordination in a crisis with cyber aspects and to make recommendations to the crisis team. In the event of a crisis, it must also be clarified which power to give instructions is required at the level of the specialist organisation. 17) Joint crisis management exercises Crisis management is tested with regard to cyber aspects in joint exercises of the federal government, the cantons, and representatives of critical infrastructures. Cyber aspects must be included in general exercises, and specific exercises for managing crises with cyber aspects must also be held. The exercises are evaluated and flow into the optimisation of management procedures. 20