3.2.3 Tier 3: repeatable Organisations at tier level 3 have formally approved risk management plans, as well as requirements for their implementation throughout the business. Policies applicable to the company as a whole define how cybersecurity risks are to be handled. The cybersecurity risks that are recorded as standard, as well as the requirements for dealing with them, are updated regularly. These updates factor in changes to business needs, technical developments and a changing threat landscape – as a result of new actors, for example – or political shifts. Procedures and processes for dealing with these new risks are defined in writing. The organisation uses standardised methods to respond to changes in risk. Staff have the knowledge and skills they need to fulfil their roles. The organisation understands its dependencies upon external partners, and regularly shares information with them that enables its management to take decisions in response to incidents. 3.2.4 Tier 4: adaptive Tier level 4 means that an organisation meets all of the requirements for tier levels 1–3 in full, and also reviews its own procedures, methods and capabilities continuously, improving them where necessary. This continuous improvement is based on the complete documentation of all cybersecurity incidents. The organisation analyses past incidents and learns the necessary lessons, adapting its own procedures and the security technologies it uses dynamically to advances in cybersecurity technologies or changing threat situations. Cybersecurity risk management is an integral part of the corporate culture. Findings from previous incidents, and information from external sources and from the business’s ongoing monitoring of its own systems and networks is integrated continually into the risk management process. The organisation shares information with partners all the time, for which it has standardised procedures in place. 3.3 Interpreting the assessment – an example The figure below shows an example of a notional interpretation of all of the tasks described earlier in this document. The assessment can be conducted using the Excel file that can be downloaded from the website of the Federal Office for National Economic Supply.9 The diagrams shown below tell users about their organisation’s degree of cybersecurity maturity in each of the five categories (ID-Identify, PR-Protect, DE-Detect, RS-Response, RC-Recover). All of the tasks in each of the five categories are scored between 0 and 4 (the coloured line). The dotted line shows the average for each category. The diagram to the top left (the cybersecurity maturity score) shows the overall score formed by the average figures for the individual categories. Please note that these diagrams are examples only, and do not show guideline or target values. Each organisation must determine its own appetite for risk, and thus define the corresponding level of defence (for each category). 9 https://www.bwl.admin.ch Minimum ICT standard 2018 38