National strategy for the protection of Switzerland against cyber risks – NCS implementation plan Incident management Since there is no complete protection against cyber incidents and an increasing number of targeted attacks is to be expected, the establishment and operation of an organisation to deal with incidents (incident management) is one of the core tasks in dealing with cyber risks. This task requires specialist skills, analytical tools, a smoothly functioning organisation and intensive cooperation among all relevant units. The exchange of information between trustworthy partners on incidents and possible countermeasures is crucial, as incidents often affect different units at the same time and can therefore be dealt with more quickly and effectively if all the units concerned exchange relevant information. Many organisations in Switzerland have set up or commissioned specialised teams to deal with cyber incidents. The Confederation operates the Reporting and Analysis Centre for Information Assurance (MELANI) in the Cyber Security Competence Centre to support operators of critical infrastructures. With the expansion of the NCS target group, support in the case of incidents must also be extended to other circles. The already close cooperation with the relevant competence centres must be intensified in a targeted manner in order to make the most effective and efficient use possible of Switzerland's limited specialised resources. Figure 9 Incident management roadmap Development of MELANI as a public-private partnership for critical infrastructure operators (M12) Measure overview Measure objective MELANI operates a platform for the exchange of information for critical infrastructure operators. This support in the form of a public-private partnership for cyber security will be further expanded with the aim of involving all sectors in the exchange of information and also maintaining it across sectors. At the same time, the existing quality should be ensured and who has access to what services and information should be clearly defined. Responsibility for the measure Cyber Security Competence Centre including the FIS Participation of third parties Critical infrastructure operators 38/79