National Cyberstrategy (NCS) M4 Analysis of trends, risks and dependencies Description It is very important for Switzerland to understand how dependent it is on digital technologies, how this dependency is developing and what risks this entails. Given that digital technologies are developing dynamically, it is important in this context to identify new developments at an early stage and to understand their impact on security. This will help to strengthen Switzerland as a business location, a location where secure digital technologies and services are applied and locally developed. Another need for analysis arises from the fact that the majority of key digital technologies are now manufactured abroad. It is important for Switzerland to understand what dependencies it has on these manufacturers and what risks are associated with this. Switzerland must be able to make decisions about the use of digital technologies and services based on autonomous, independent analyses and assessments. Background and need for action Overview of measure Technology monitoring with regard to cybersecurity is carried out by the CyberDefence Campus in close cooperation with universities and the business community. The Swiss Academies of Arts and Sciences are tasked with assessing the opportunities and risks associated with new technologies. Switzerland is significantly less advanced when it comes to the systematic analysis of dependencies and risks related to ICT products. The National Test Institute for Cybersecurity (NTC), which is currently being set up, will have the capacity to examine ICT products in depth for their attack surface. This centre will complement and strengthen the capabilities available today at the CYD Campus and those increasingly being built up by private security service providers. These capabilities are a prerequisite for independently assessing the security of products used, for example, in critical infrastructures. There is also further potential in the systematic evaluation of incidents. This can help to better understand who is affected by which attacks and how such attacks could be prevented in the future. This requires an established exchange of information between public authorities, security service providers and universities, and a willingness on the part of affected companies to transparently disclose incidents and their impacts. 17