National strategy for the protection of Switzerland against cyber risks – NCS implementation plan Legal basis Pursuant to Article 5 of the Federal Constitution, all activities of the state are based on and limited by law. The activities of the authorities described in the implementation plan must therefore be based on a legal basis. Unless explicit reference is made to the absence of a legal basis, the administrative units listed in the implementation plan have the legal powers necessary for the measures envisaged. They perform tasks in the field of NCS within the framework of their activities defined in the existing legal basis. These tasks are not materially new, but have a new field of application with regard to cyber risks. The competent units are responsible for ensuring that NCS implementation does not go beyond the existing legal powers. In contrast, there is a need for legislation with regard to the tasks of the Cyber Security Competence Centre, as this newly created administrative unit cannot rely on existing foundations and performs tasks for which a legal basis does not yet exist. The descriptions of the measures explicitly indicate where it is necessary to create a legal basis. Strategic controlling and reporting With the help of strategic controlling, the NCS StC regularly checks the implementation status and develops adjustment strategies or plan changes in the event of deviations from the influencing factors relevant to the objective. Furthermore, strategic controlling reporting creates transparency for all parties involved. Controlling includes an assessment of the milestones reached in the individual projects, as well as an evaluation of further planning in terms of content, deadlines and resources by the Cyber Security Competence Centre office. Every six months, the office presents a brief report on the status of the implementation measures to the NCS StC, which adopts it and submits it to the Federal Council Cyber Committee for information purposes. The NCS StC prepares an annual report on NCS implementation for the Federal Council. An NCS effectiveness assessment will be carried out by 2022 at the latest. This should provide information on the need for further action. Implementation plan structure The implementation plan defines the implementation projects of all 29 measures. It is structured like the NCS and groups the measures per area of action into ten sub-sections. This results in the implementation plan structure shown in Figure 3. 8/79