Background and need for action National Cyberstrategy (NCS) Risk and vulnerability analyses of critical sectors were already part of the first two cyberstrategies. The existing assessments and identified resilience measures must be regularly reviewed and adapted for all critical sectors. In addition, there are already well-established international standards on cybersecurity that are also applied in Switzerland. In cooperation with the business community and the specialist authorities, the FONES developed an ICT minimum standard and used this as the basis for sector-specific standards. Compliance with these standards is usually not mandatory. However, the new Data Protection Act, which will come into force in September 2023, introduces minimum requirements for data security when processing personal data. In addition, various sectors are examining which standards should be introduced as binding for which organisations. Alongside sector-specific standards, technology-specific standards are also important. Security standards for cloud computing applications or IoT play an important role in ensuring security in new technological applications. Switzerland has already issued directives on the security of wireless internet-connected devices in the OFCOM Ordinance on Telecommunications Installations. It is now examining what regulations are needed in the area of cloud computing. However, the need to examine and develop legal foundations is not limited to the question of whether binding standards should be introduced. One example of this is the bill already passed to introduce mandatory reporting of cyberattacks. Where further legal foundations may be required is a question that must be examined on an ongoing basis. - Priorities - - - - Key actors - - The existing risk and vulnerability analyses in critical sub-sectors will be updated as required by the FOCP and the relevant specialist authorities. The identified risks will be addressed as part of resilience management with suitable spheres of action and measures to improve resilience. Implementation of the measures will be regularly reviewed and the sharing of information on risks, vulnerabilities and resilience measures between the Confederation and the cantons will be promoted. Efforts will be made to promote wider compliance with standards. In particular, the application of standards by SMEs and communes is to be strengthened by making simple tools available. Compliance with ICT security standards must also be made a requirement of public procurement contracts, and verified. Promoting the wider use of existing labels: Cybersecurity labels have been successfully introduced in Switzerland. It is important that these labels are coordinated, both nationally and internationally. The use of existing labels will therefore be supported by the sharing of experience between labels. It will be examined whether and how companies' responsibility for protecting themselves against cyberincidents can be strengthened through legal requirements. The aim here should be to have effective regulations rather than detailed operational requirements. Regulations must also be harmonised across sectors in order to minimise disparities between any requirements. The need for sector-specific regulations will be examined and, where necessary, draft texts prepared. Mandatory reporting of cyberattacks on critical infrastructures is already being examined. If a decision is made to proceed with this, implementation will be undertaken in close cooperation with those affected. Confederation: FOCA, FOCP, FOT, NCSC, OFCOM, SFOE, FDPIC, FONES Cantons: cantonal cybersecurity competence centres Universities: SSCC Business community/society: cyber-safe.ch, ITSec4KMU, standardisation organisations, NTC, security service providers, associations of the economic sectors concerned, insurance companies 21