National Cyberstrategy (NCS) 3.2 Measures for the objective "Secure and available digital services and infrastructure" Measures are needed at various levels to ensure the security of digital services and infrastructures. It is important that vulnerabilities in services and infrastructures are detected and fixed at an early stage and that new services and infrastructures are developed in such a way that they have as few vulnerabilities as possible from the outset. In addition to vulnerability detection and remediation, resilience management is critical. Based on risk and vulnerability analyses, it must be determined which technical and organisational measures will be implemented to increase the resilience of services and infrastructures. This also includes examining the areas in which standards or regulations are needed. Finally, it is important for public authorities to protect their own services against cyberthreats. M5 Vulnerability detection and prevention Description The use of digital technologies leads to process automation and networking. This results in complex systems that potentially have a large attack surface. This complexity, combined with the often high cost and time pressure involved in the development and application of such technologies, increases the risk of vulnerabilities in the systems. For cybersecurity, it is essential that the existence of such vulnerabilities is prevented wherever possible and that existing vulnerabilities are detected in good time and resolved quickly. It is important that vulnerabilities are only made public once countermeasures have been identified and implemented ("coordinated vulnerability disclosure"), otherwise disclosure puts the attackers in a stronger position. Background and need for action Overview of measure Within Switzerland, there is plenty of expertise in identifying vulnerabilities and analysing their causes. However, the potential is still underexploited. There are too few incentives for security researchers to look for and report vulnerabilities, and there is a lack of national coordination in vulnerability analysis. Close cooperation with specialist authorities in other countries and international organisations is also important. A prerequisite for more effective vulnerability management is the creation of a legal basis for the investigation, reporting and disclosure of vulnerabilities. Finally, efforts must be made to ensure that security holes are communicated and closed quickly. Too many companies and organisations remain vulnerable because they do not resolve vulnerabilities, even though solutions (patches) have been available for a long time. 19