Background and need for action National Cyberstrategy (NCS) Many organisations – but by no means all critical infrastructures – in Switzerland have set up or mandated specialised teams to deal with cyberincidents. These teams have different names (e.g. Security Operations Centres, Computer Emergency Response Teams, Computer Security Incident Response Teams) and competencies defined in accordance with their respective areas of responsibility. Many cantons and the Confederation also have such teams at their disposal. Incident management is carried out primarily via these units. Through the NCSC, the Confederation provides subsidiary assistance to the teams of the cantons, communes and cities and those of critical infrastructure operators and their security service providers with the technical analysis of incidents, and supports the sharing of information between them. The general public can also report cyberincidents and cyberthreats to the NCSC and, if required, will receive initial expert assessments and recommendations for further action. These reports are important for assessing cyberthreats. So far, these federal services have not been underpinned by a legal foundation. The legal framework for information sharing also needs to be regulated. Proposals for the necessary legal adjustments have been drafted, but have not yet been enacted. One challenge with incident management is scaling. If several major incidents occur simultaneously, the existing resources are rapidly exhausted. A check must be carried out of how capacities can be ramped up quickly where necessary by drafting in experts. - Priorities - - Key actors - - Enhancing the capabilities of critical infrastructures to detect and manage cyberincidents by developing, creating and making shared use of SOCs. Expanding cyberincident reporting: As many cyberincidents as possible should be reported in order to build up a good picture of the current threat situation. Information sharing: The NCSC's existing platform for sharing information between critical infrastructure operators will be overhauled and expanded with the aim of simplifying it and gradually making it accessible to wider groups of users. Capacity expansion through cooperation: Further intensification of operational cooperation and improvement of coordination between GovCERT, SWITCHCERT and other security teams. How and when volunteer expert pools can support incident management will also be examined, taking into account existing organisations. Strengthening cooperation with specialist authorities: The relevant specialist authorities will be informed by the NCSC about incidents in their sector, so that they can assess the threats in their sector. This excludes information that allows the parties concerned to be identified, unless the latter agree to this information being provided to the specialist authorities. Confederation: NCSC, FOCA, FOITT, FOT, MilCERT, OFCOM, SFOE Cantons: cantonal CERTs, CSIRTs, SOCs (or similar organisations), cantonal police reporting points Business community/society: CERTs, CSIRTs, SOCs (or similar organisations) of companies and organisations, SWITCH 24