BR: Man­da­to­ry noti­fi­ca­ti­on of cri­ti­cal infras­truc­tu­re in the event of cyber attacks

On Decem­ber 11, 2020, the Fede­ral Coun­cil ins­truc­ted the FDF to deve­lop a Con­sul­ta­ti­on draft for the Intro­duc­tion of a report­ing obli­ga­ti­on for ope­ra­tors of cri­ti­cal infras­truc­tures in the event of cyber attacks to work out.

In 2012, the Fede­ral Coun­cil had for the first time deve­lo­ped or adopted a stra­tegy for the pro­tec­tion of cri­ti­cal infras­truc­tures (CIP), which at the end of 2017 was SKI 2017-2022 was repla­ced. Howe­ver, a defi­ni­ti­on of the term “safe­ty inci­dent” was miss­ing, which is also reflec­ted in the Postu­la­te “Man­da­to­ry report­ing of serious secu­ri­ty inci­dents in cri­ti­cal infras­truc­tures”. had been taken up by NR Graf-Lit­scher. The postu­la­te was adopted in par­lia­ment advi­se and writ­ten off on 14.9.2020. Howe­ver, the Fede­ral Coun­cil had ack­now­led­ged the need for impro­ve­ment and deci­ded to exami­ne the intro­duc­tion of a report­ing obligation.

On this basis, the Fede­ral Coun­cil had com­mis­sio­ned a report, the result of which is the pre­sent FDF report of 11 Decem­ber 2020 on the legal basis for a report­ing obli­ga­ti­on for serious secu­ri­ty inci­dents in cri­ti­cal infras­truc­tures fol­lo­wed by the decis­i­on of the Fede­ral Coun­cil to prepa­re a con­sul­ta­ti­on draft.

In its decis­i­on, the Fede­ral Coun­cil specified,

• to desi­gna­te a cen­tral report­ing office and to deter­mi­ne it uni­form­ly for all sectors;
• Defi­ne cri­te­ria for who should report which inci­dents and within what timeframe;
• to defi­ne the spe­ci­fic pro­vi­si­ons for the report­ing obli­ga­ti­on in appro­pria­te decrees, adapt­ed to the sec­tor-spe­ci­fic circumstances;
• ali­gn the report­ing obli­ga­ti­on with exi­sting sec­to­ral and data pro­tec­tion report­ing obligations.

The reports to MROS are inten­ded to estab­lish an ear­ly war­ning system. Not only the report­ing of “cyber inci­dents” is under dis­cus­sion, but also a report­ing obli­ga­ti­on for signi­fi­cant secu­ri­ty gaps in cri­ti­cal infras­truc­tures (report, p. 14). – The con­sul­ta­ti­on draft should also exami­ne how exi­sting de lege lata report­ing obli­ga­ti­ons for func­tion­al fail­ures of cri­ti­cal infras­truc­tures (see p. 9 f. of the report) can or should be deve­lo­ped or expanded.