National strategy for the protection of Switzerland against cyber risks 2018-2022 4.5 Incident management Description Since there is no complete protection against cyber incidents and an increasing number of targeted attacks are to be expected, one of the core tasks in dealing with cyber risks is to set up and operate an organisation to handle incidents (incident management). Incident management involves identifying incidents as early as possible, identifying and implementing the right countermeasures, and analysing the incidents in order to derive findings for improving prevention. This task requires specialised skills, analytical tools, a smoothly functioning organisation, and intensive cooperation among all relevant departments. Exchange of information among trustworthy partners about incidents and possible countermeasures is crucial, given that incidents often affect different agencies simultaneously and can therefore be dealt with more quickly and effectively if all affected agencies exchange relevant information. The responsibilities and processes must be clear and efficient, and appropriate routines must be established. The exchange and evaluation of information must be coordinated on a centralised basis so that the strategic importance of an incident and its significance for security policy can be recognised as quickly as possible, the relevant agencies can be involved, and the competent bodies can be informed – within the federal government, these include the Security Core Group (SCG) and the Federal Council Security Committee (FCSC), depending on the type and scope of the event. Background Overview of sphere of action Many organisations in Switzerland have set up or mandated specialised teams to deal with cyber incidents. These teams have different names (e.g. Security Operations Centres, Computer Emergency Response Teams, Computer Security Incident Response Teams) and competencies defined in accordance with their respective areas of responsibility. Many cantons and the federal government also have such teams at their disposal. Incident management is carried out primarily via these teams. The federal government operates the Reporting and Analysis Centre for Information Assurance (MELANI) to support operators of critical infrastructures. MELANI serves as a contact point at the state level and offers support in the technical and intelligence analysis of incidents, including the associated information exchange platform. MELANI also plays a leading coordinating role within the Federal Administration in dealing with incidents. As a rule, the affected federal offices inform MELANI, which evaluates the reports and forwards them to the necessary federal agencies. However, the processes are not standardised, and it is not clear at what time MELANI informs the SCG and/or the FCSC. As part of the NCS 2012-2017, the personnel capacities of MELANI were strengthened, and cooperation with specialised teams within and outside the Federal Administration was further expanded. This made it possible to increase the number of companies with access to the information exchange platform and technical support. But even after this expansion, MELANI's services to the private sector remain focused on the operators of critical infrastructures. 18