National Cyberstrategy (NCS) - Priorities - - Key actors - - Institutionalising ethical hacking: Bug bounty and public trust programmes will be implemented. Ethical hacking will be encouraged by improving legal certainty for ethical hackers. Coordinated vulnerability disclosure: A coordinated approach to vulnerability disclosure will be promoted, in order to build security and trust through transparency. To this end, guidelines will be drawn up and disseminated, and incentives to report vulnerabilities will be created. Centralising vulnerability communication: The NCSC will be positioned as the central hub for the coordination and publication of vulnerability reports. It will disseminate information and alerts on new vulnerabilities as well as on technical and organisational solutions to address them. Automated vulnerability detection: Solutions for automated vulnerability detection and remediation will be developed and deployed. Software ecosystem: Secure software development (particularly open-source software) will be supported through collaboration with organisations and initiatives in this area. The aim is to create incentives to ensure that security is considered at an early stage in software development. Formally verifiable security properties will be defined for the development of ICT components. Cybersecurity in wireless internet-connected devices: The requirements of the revised Telecommunications Installations Ordinance must be enforced through effective market surveillance. Confederation: CYD Campus, NCSC, OFCOM Cantons: IT offices, cantonal cybersecurity competence centres Universities: ICT security research institutes Business community/society: Alliance Digital Security Switzerland, NTC, security companies M6 Resilience, standardisation and regulation Description Overview of measure A variety of technical and organisational measures exist to protect against cyberthreats. It remains the case that the majority of cyberincidents could be prevented by consistent implementation of basic protection measures. Decisions on the appropriate measures are based on sound analyses of the risk exposure to cyberthreats. By understanding how these risks manifest themselves in individual sectors, measures to improve resilience can be identified. The measures are based on international standards. These are an important tool for implementing protective measures. Compliance with standards can be promoted in a number of ways. Aside from the possibility of making standards binding through regulatory measures, the main approach will be to create incentives for their implementation. Transparency can create a strong incentive by using labels to establish who is complying with which standards. Such transparency means that investments in cybersecurity lead to increased customer trust. 20