National strategy for the protection of Switzerland against cyber risks 2018-2022 4.3 Resilience management Description Critical infrastructures (CI) are highly dependent on functioning and secure ICT systems and infrastructures. Measures to reduce the ICT vulnerabilities of CI are therefore of great importance for the protection of Switzerland against cyber risks. These measures relate not only to strengthening prevention, but also include measures to contain damage and reduce downtime in the event of incidents. The aim is to improve the resilience and regeneration capacity of critical infrastructures in Switzerland. A large part of the critical infrastructures in Switzerland is operated by private enterprises. These enterprises implement the measures to improve ICT resilience. Nevertheless, as part of its constitutional mandate to safeguard the security of the country, the state bears the responsibility to protect critical infrastructures and thus guarantee the availability of goods and services that are vital for the population and the economy. It must implement this task on a subsidiary basis and in close cooperation with the private sector. For that reason, the federal government plays an active role in defining measures to improve ICT resilience in the critical subsectors and also monitors their implementation. Depending on the measure, implementation may occur at different levels (at the level of the enterprise or the sector). The critical ICT infrastructures of the public authorities themselves are a special case. Here, the federal government and the cantons are themselves responsible for implementing the measures. Background Between 2013 and 2017, the FOCP and the FONES, in cooperation with the competent authorities, associations, and representatives of CI operators, identified the ICT risks and vulnerabilities in 28 critical sub-sectors and jointly developed (and already partially implemented) proposals for measures to improve ICT resilience. To protect its own ICT infrastructure, the federal government has developed a concept with which it ensures a regular analysis of the vulnerabilities of ICT systems in the Federal Administration. The cantons have carried out risk analyses for their administrations as part of two SSN projects. Objectives and need for action Overview of sphere of action The measures identified to improve ICT resilience in the critical sub-sectors and administrations are to be implemented and further developed on the basis of periodically updated risk and vulnerability analyses. This is done in coordination with the measures set out in the standardisation and regulation sphere of action, using synergy effects with the ongoing work of the federal government relating to the protection of critical infrastructures, crisis management, civil protection (Secure Data Network SDN+), national economic supply, risk management of the federal government, ICT security, and other involved bodies. 14