National strategy for the protection of Switzerland against cyber risks 2018-2022 5 Implementation of the strategy The measures described in the ten spheres of action will be implemented by 2022. For this to succeed, it must be clearly defined who is responsible for which measures, on which legal foundations the measures are implemented, and by when which objectives are to be achieved. Firstly, this presupposes that the federal government clearly defines the competencies of the administrative units involved and determines who bears overall responsibility for implementation of the NCS. Secondly, the legal foundations must be clarified and any necessary legislative projects initiated. Thirdly, it must be set out how the federal government cooperates with the cantons, the private sector and society and what roles these actors play in the implementation of the individual measures. Fourthly, the implementation progress of the NCS must be made transparent. For that purpose, measurable performance targets must be defined for all measures, and it must be determined by when these targets are to be achieved. Fifthly and finally, it must be set out how and by whom the NCS will be updated if new developments make additions or changes necessary before the end of 2022. Since these points concern the question of implementation and not the strategic direction as such, they are described in a separate implementation plan. The implementation plan should be understood as an integral part of the NCS, supplementing the strategic objectives with operational objectives and describing the responsibilities and competencies. The main elements pertaining to these questions are summarised below, clarifying how implementation of the NCS will be approached. 5.1 Tasks and responsibilities in the Federal Administration By adopting the NCS, primarily the federal government itself undertakes to implement the measures contained therein. Since the NCS covers a wide range of measures, various federal offices are directly involved in implementing the NCS under its decentralised approach. The tasks of the federal government can roughly be divided into three areas: - Cyber security: Encompasses the entirety of measures aimed at prevention, incident management, and improvement of resilience to cyber risks, as well as strengthening international cooperation for this purpose. The federal government takes the necessary measures to increase its own cyber security and, taking into account the principle of subsidiarity, contributes to improving the cyber security of the private sector and society, with a particular emphasis on critical infrastructures. The measures also include the promotion of international cooperation in the field of cyber security. - Cyber defence: The entirety of intelligence and military measures serving to protect critical systems, defend against attacks in cyberspace, ensure the operational readiness of the Armed Forces in all situations, and build capacities and capabilities for subsidiary support of civilian authorities. This area includes in particular active measures to identify threats and attackers and to disrupt and suppress attacks. - Prosecution of cybercrime: Measures taken by the police and prosecutors to combat cybercrime. 27