National strategy for the protection of Switzerland against cyber risks – NCS implementation plan 2. Development and establishment of aids for SMEs Project description To support SMEs, the Confederation works together with the business community and associations to develop aids with which companies can easily and quickly identify how they are positioned with regard to cyber security, assess their cyber risks and identify what measures they can take to improve their security. A review will also be carried out to determine whether and by whom cyber security standards or labels should be created or supported. Responsibility and resources deployed Cyber Security Competence Centre, FONES, business associations Milestones Q3/2018: Publication of "Cybersecurity for SMEs" quick test (SATW) Q2/2019: Needs analysis of further aids (technical aids, labels, guidelines, instructions) for SMEs Q4/2020: Examination of possible introduction of labels and standards completed Q4/2021: Analysis of created aids and design of further instruments where necessary Examination of a reporting obligation for cyber incidents and decision on introduction (M9) Measure overview Measure objective A reporting obligation for cyber incidents will be examined and a decision will be made on its introduction. The first step is to clarify for whom a reporting obligation should apply, what incidents it concerns, to whom incidents must be reported and whether a reporting obligation can substantially improve the situation relative to today. Based on these issues, variants for the implementation of reporting obligations in the various sectors will be developed and the necessary legal foundations will be identified. The work will be carried out with the involvement of the competent authorities, the business community, universities and the cantons. It will form the basis for deciding on the introduction of a reporting obligation. Responsibility for the measure Cyber Security Competence Centre Participation of federal units FOCP, specialist offices (FOPH, OFCOM, FOT, FOCA, SFOE), fedpol Participation of third parties Business associations (e.g. SIA), cantons, FINMA (reporting obligation), universities, ICTswitzerland Existing Sectoral reporting obligations exist (e.g. in the fields of bodies/processes/concepts telecommunications, nuclear facilities, aviation). In the area of telecommunications, the further development of the existing obligations will have to be examined. 33/79