No. As a private individual, you are not bound by this obligation to report. However, voluntary reports also help the NCSC to recognise trends or take countermeasures. You can find the form for voluntary reports here: https://www.report.ncsc.admin.ch/en/
Fundamentals
Do I have to report a cyberattack as a private individual?
Which companies are required to report?
Are only Swiss companies critical infrastructures? Do foreign companies also have to report incidents?
Does the reporting obligation apply to the entire organisation (IT & OT, Information Technology and Operational Technology) or only to incidents in the Operational Technology (OT) area?
Can I also report if I am not obliged to report?
Do Managed Service Providers (MSPs) also have to report cyberattacks? Is it possible for a customer to delegate all or part of this reporting to a security partner?
Who is required to report if the municipality uses the canton's IT services including its network? Must the municipality and / or the canton report?
In Switzerland, there is an obligation to report cyber incidents for companies that operate critical infrastructures. These companies are required to report cyber incidents to the NCSC. The reporting obligation is governed by the Information Security Act (ISA) and the Cybersecurity Ordinance. For companies that are not part of the critical infrastructure community, there is currently no legal obligation to report cyber incidents. However, it is recommended that such incidents be reported voluntarily to the NCSC to contribute to general cyber security.
All companies headquartered in Switzerland that fall within the scope of the law and the ordinance are subject to the reporting obligation.
A cyberattack must be reported if it jeopardises the operability of the critical infrastructure concerned, has led to a manipulation or information exfiltration, has remained undetected for a longer period or is associated with blackmail, threats or coercion.
Yes, you can report cyber incidents even if you are not required to do so. It is even recommended that you voluntarily report such incidents to the NCSC. This contributes towards improving overall cyber security and helps to recognise and combat potential threats at an early stage.
The organisation that is affected by the attack is always required to report it. If you have an attack and your customers are considered critical infrastructure, you must report it in accordance with the ISA/Cybersecurity Ordinance. In the case of municipalities, for example, the MSP can also submit a report on behalf of the municipality affected by the cyberattack, but this must then be indicated and documented accordingly.
The operator of the networks is required to report, in this case the canton.
Reporting process
Where can I submit notifiable reports?
Do I have to report if I do not yet have full information on the incident?
Where do I send my report if I am not on the CSH?
What happens if it is not clear to my organisation whether it is subject to reporting obligation?
Is it not an additional administrative burden for small companies and organisations to report cyberattacks to the NCSC? How can it be ensured that the reporting obligation does not become a burden for companies and organisations?
Does the registration on the CSH have to be for a single person or can this be done in the name of a whole IT department, using i.e. a group mail "IT-department@...”?
The following reporting options are available:
Companies with an account on the Cyber Security Hub (CSH), the NCSC exchange platform with companies, can report directly via this portal. Reporting companies that do not yet have a CSH account are advised to open an account with the CSH.
Further information can be found at: Cyber Security Hub
For companies without an account on the CSH, the NCSC provides an alternative reporting channel via e-mail. Information on this process will be published on the NCSC website before the reporting obligation comes into force.
Yes, even if you do not yet have full information, you must submit an initial report within 24 hours. You can then submit a final and complete report with additional information within 14 days.
You can report the cyberattack via the report button on the NCSC website using an email template. The NCSC recommends critical infrastructures to register on the CSH.
In accordance with Art. 74a para. 2 ISA, the NCSC is required to inform all interested authorities and organisations whether they are subject to the reporting obligation. It issues a corresponding decision upon request.
For organisations that are registered on the CSH, the hub shows whether the NCSC considers them to be subject to the reporting obligation or not.
The additional workload for companies is generally low, as the reporting form is very simple and limited to the bare minimum. In the Cybersecurity Ordinance, the Federal Council also issued far-reaching exemptions for small companies.
In addition, the NCSC is available to provide initial assistance to the reporter, which in many cases can also reduce the initial workload.
The accounts on the CSH are personal accounts, there is no option for group mails. The NCSC must be able to identify the CSH participants.
Exceptions and special cases
Employees / municipal representatives have access to certain IT software on their private devices via a protected channel. Is it necessary to report immediately if an employee's private infrastructure has been hacked?
Threat to operability: For example, if a DDoS attack on a non-business-critical application leads to a system interruption, would this need to be reported regardless of business criticality?
What happens if a provider such as Q (i.e. Q 365) is attacked? Does this incident have to be reported?
No, this is not an attack on the critical infrastructure. However, the NCSC recommends seeking a detailed clarification by an IT specialist.
In the event of a DDoS attack on a non-critical application, there is no automatic reporting obligation. The decisive factor is whether the attack jeopardises the operability of the critical infrastructure as a whole. If the system interruption has no impact on mission-critical functions, the core services are not affected and there is no risk of lateral movement, the incident must not be reported. The reporting obligation is based on the actual impact on operability.
In such cases, the provider concerned - such as Q - is primarily responsible for reporting the incident, provided it falls under the reporting obligation. However, the NCSC is dependent on information from users: If you notice any signs of such an incident, please let us know so that we can assess the situation and act if necessary.
Support from the NCSC and cooperation
Are reports to the NCSC shared directly with FINMA / the FDPIC?
Does the report to NCSC replace the report to FINMA?
Can the report be forwarded to other recipients besides FINMA, for example?
How is the confidentiality of the reported information guaranteed?
How is the compliance of the reporting obligation supervised and verified? Are there mechanisms in place to ensure that companies effectively report all relevant incidents and not just those they deem acceptable?
What does the NCSC do with the reports it receives?
How does NCSC provide support after a report?
Does the NCSC offer support in the event of ransomware extortion and negotiations with blackmailers in the event of ransomware Trojans?
How quickly does the NCSC respond to a report?
If reporters explicitly state that their report is to be sent to third-party authorities such as the FDPIC, FINMA, FSIO or SEPOS, it will be forwarded accordingly. This allows several reporting obligations to different authorities to be fulfilled from a single centralised form. Any queries or requests for additional information are then sent directly from the relevant authorities to the reporting organisation.
Institutions that are also subject to the reporting obligation under the Information Security Act (ISA; SR 128) can submit their initial report, which must be made within 24 hours of discovering the cyberattack, using the reporting form of the NCSC. It is possible to have the report forwarded to FINMA at the same time - as long as timely transmission can be ensured. The detailed report must still be submitted within 72 hours via FINMA's survey and application portal (EHP).
No, the reporting parties have to do that themselves.
The NCSC guarantees the protection of the reported information. For almost 20 years, the NCSC and its predecessor organisations such as MELANI have regularly exchanged information with operators of critical infrastructures and treated information confidentially.
The numerous reports received by the NCSC via the reporting form are also treated confidentially by the NCSC. In order to warn the population, these reports are anonymised, categorised and statistically recorded. This is also done with the data from the mandatory reporting system.
There will be no active supervision of compliance with the reporting obligation. If the NCSC learns of a cyberattack that is subject to the reporting obligation but has not been reported, it will contact the organisation concerned and draw its attention to the reporting obligation. If the organisation still fails to comply with the reporting obligation, the NCSC will issue a decision with a threat of a penalty. If a report is still not submitted, the NCSC can file a complaint with the competent prosecution authorities.
When a report is received by NCSC, it is analysed. If the company concerned requests support, the NCSC contacts them. Reported attacks help the NCSC to better assess the threat situation and warn potential victims earlier so that they can take appropriate protective measures.
The NCSC provides technical assistance as an initial support. However, this is not intended to compete with market-based services. Depending on the extent of the attack, the NCSC will therefore ask those affected to seek help from specialised companies if they have not already done so. The NCSC stays available to advise victims and any specialists that may have been hired.
No. The NCSC does not negotiate with blackmailers. It does, however, provide initial technical assistance and support in assessing the situation and restoring the systems. The police and prosecution authorities are responsible for legal action or negotiations.
An automated confirmation of receipt will be sent immediately. If you require technical support, NCSC can be contacted via the on-call number - even outside office hours and at weekends.
Deadlines and consequences of violations
Does the deadline of 14 days refer to working days or 14 calendar days?
What happens if, for example, a system fails on Friday evening, but it only becomes apparent on Monday that it is an attack?
What happens if I do not report within 24 hours?
How is the money from the fines used?
The deadline of 14 days includes non-working days (also Saturday/Sunday).
You must report the incident to the NCSC within 24 hours of discovering it. In this example, on Monday morning.
The NCSC can only inform a company subject to the reporting obligation of this obligation if it becomes aware of a reportable cyber incident itself. If there is no response within the deadline after the submission of the report, the NCSC will issue a decision with a threat of a penalty. If the report is still not submitted, the NCSC can report the incident to the competent prosecution authorities.
The NCSC can only inform a company subject to the reporting obligation of this obligation if it becomes aware of a reportable cyber incident itself. If there is no response within the deadline after the submission of the report, the NCSC will issue a decision with a threat of a penalty. If the report is still not submitted, the NCSC can report the incident to the competent prosecution authorities.
Last modification 31.03.2025
