National strategy for the protection of Switzerland against cyber risks – NCS implementation plan Standardisation / regulation ICT standardisation and regulation are important tools for protecting against cyber risks. Minimum requirements for protective precautions strengthen prevention, and specifications for dealing with incidents (e.g. reporting obligations) help to ensure an improved response. Standardisation and regulation are important in the international environment too, as they create more transparency and trust in the globalised digital society. When introducing standardisation and regulations, however, it is important to bear in mind the major differences between the economic sectors and companies of different sizes. Moreover, the international environment must always be taken into account. Standards and regulations in the cross-border cyber space must be as internationally compatible as possible. Verifiable minimum ICT standards are relevant for security and trust in the digital economy and society and should be evaluated in cooperation with the private sector and introduced where appropriate. Similarly, the question of whether and how a reporting obligation for cyber incidents should be introduced must be examined. The international context is taken into account in the measures and has a significant influence on them, which is why developments must continue to be monitored. Figure 8 Standardisation / regulation roadmap Evaluation and introduction of minimum standards (M8) Overall measure overview Measure objective Based on the risk and vulnerability analyses carried out, verifiable minimum ICT standards are developed and introduced in close cooperation between the specialist authorities, the private sector and associations. The minimum ICT standards to be developed build on existing standards (e.g. the national economic supply minimum ICT standard). The competent authorities check for which organisations and activities the standards should be binding. Responsibility for the measure FONES Participation of federal units Cyber Security Competence Centre, FOCP, specialist offices (FOCP, FOPH, OFCOM, FOT, FOCA, SFOE) 31/79