National strategy for the protection of Switzerland against cyber risks – NCS implementation plan Implementation organisation The success of NCS implementation depends to a large extent on the fact that the existing resources can be optimally deployed and further expanded in a well coordinated manner. The tasks described in this implementation plan are binding specifications for the federal offices. However, due to the complexity of the tasks, the limited resources and the legal restrictions regarding responsibility, these are dependent on the participation of third parties in the implementation of the specifications. The organisation of the work must make allowances for this. Consequently, the following section first describes how the Confederation is organised in the area of cyber risks, then discusses how cooperation between the Confederation, the cantons, the business community and universities should be structured for NCS implementation, and finally describes how controlling and reporting are organised. Organisation of the Confederation in the area of cyber risks Within the Federal Administration, a distinction is made between three areas with regard to cyber risks: • Cyber security: all measures that are aimed at prevention, incident management and improved resilience to cyber risks and that strengthen international cooperation for that purpose. The Confederation takes the measures needed to increase its own cyber security and helps to improve the cyber security of the business community and society, taking account of the principle of subsidiarity, whereby the key importance of critical infrastructures is weighted accordingly. The measures also include the promotion of international cooperation in the field of cyber security. • Cyber defence: all civil intelligence and military measures designed to defend critical systems, defend against attacks in cyberspace, ensure the operational readiness of the Armed Forces in all situations and build capacity and capabilities to provide subsidiary support to civil authorities. In particular, this area includes active measures to detect threats, identify attackers and disrupt or stop attacks. • Cyber prosecution: all measures taken by the police and public prosecutors of the Confederation and cantons in the fight against cybercrime. The Federal Council defined the overarching organisation of the Confederation in the area of cyber risks based on this division of tasks on 30 January 2019. The key elements of this organisation in relation to NCS implementation are illustrated in Figure 2. 5/79