National strategy for the protection of Switzerland against cyber risks 2018-2022 Vision of the NCS 2018-22 "In exploiting the opportunities of digitalisation, Switzerland is adequately protected against cyber risks and is resilient to them. The capacity to act and the integrity of its population, economy and the state against cyber threats is safeguarded." Strategic objectives: This vision can be realised only if the following seven strategic objectives of the NCS 201822 are achieved: - - Switzerland has the competencies, the knowledge, and the capabilities to identify and assess cyber risks at an early stage. Switzerland is developing effective measures to reduce cyber risks and is implementing them within the framework of prevention. Switzerland has the necessary capacities and organisational structures in all situations to identify cyber incidents quickly and to deal with them even if they persist over an extended period of time and affect different areas simultaneously. Switzerland is resilient to cyber risks. The ability of critical infrastructures to provide essential services and goods remains safeguarded even in the event of major cyber incidents. The protection of Switzerland against cyber risks is the joint responsibility of society, the private sector and the state, with responsibilities and competencies clearly defined and put into practice by all those involved. Switzerland is committed to international cooperation to increase cyber security. It promotes dialogue in cyber foreign and security policy, participates actively in international expert bodies, and maintains exchanges with other states and international organisations. Switzerland learns from cyber incidents at home and abroad. Cyber incidents are carefully analysed, and appropriate measures are taken on the basis of the findings. 3.2 Principles The vision and strategic objectives set out what the NCS 2018-22 aims to achieve. The principles define how this is to be done. - - - - The NCS starts with a risk-based, comprehensive approach aimed at improving Switzerland's resilience to cyber risks. This implies the assumption that full protection against cyber risks is not possible, but that the risks can be dealt with to the extent that the remaining risk is acceptable. A comprehensive approach takes into account all relevant vulnerabilities and threats. Cyber security affects almost all areas of life, business, and administration. Everyone is called upon to act and shares responsibility for protecting Switzerland against cyber risks. The NCS strengthens this shared responsibility by holding actors with the necessary competencies to account and by using the existing structures. This results in decentralised implementation, but implementation that is controlled in a centralised manner by the strategic management of the NCS and that envisages a clear division of tasks and roles. The NCS is based on an understanding of the subsidiary role of the state, which means that the state only intervenes when the welfare of our society is substantially affected and private actors are unable or unwilling to solve the problem independently. In this case, the state can provide support, create incentives, or intervene through regulation. The NCS follows a cooperative approach. It strengthens and coordinates the existing 8