- CSV implements reporting obligations and organizational rules for cybersecurity in accordance with the revised ISG; entry into force planned for 1 January 2025.
- Art. 16 defines numerous exemptions from reporting obligations for public authorities, energy, transport and cloud providers under specific thresholds.
- Smaller facilities (e.g. hospitals, laboratories, postal services) with <50 employees and ≤CHF 10 million turnover in affected areas are exempt from the reporting obligation.
On May 22, 2024, the Federal Council opened the consultation on the Cybersecurity Ordinance (CSO):
The CSV is based on the ISG and contains implementing provisions for Chapter 5 of the revised ISG (reporting obligation for cyber attacks on certain critical infrastructures) on the one hand and regulates organizational aspects in connection with cyber security (e.g. tasks of the BACS) on the other.
The regulation is to come into force on January 1, 2025, together with the reporting obligation for critical infrastructures.
Art. 16 E‑CSV regulates the exceptions to the obligation to report critical infrastructures in accordance with Art. 74b E‑ISG:
1 The following authorities and organizations are exempt from the reporting obligation under the following conditions:
a. Bodies referred to in Article 74b(1)(b) [Federal, cantonal and municipal authorities] and c ISG [public law tasks in the areas of Safety and rescue, Drinking water supply, Waste water treatment and Waste disposal]: if they are responsible for fewer than 1000 inhabitants; the permanent resident population is decisive;
b. Undertakings referred to in Article 74b(1)(d) ISG [Energy supplierenergy trading, energy metering or energy control], provided that they:
- as grid operators, electricity producers, electricity storage operators or service providers in the electricity sector in accordance with Article 5a paragraph 1 and Annex 1a of the Electricity Supply Ordinance of March 14, 20084 do not have to comply with either protection level A or protection level B,
- as operators of gas pipelines in accordance with Article 2 Paragraph 3 of the Pipeline Safety Ordinance of June 4, 20215 have an average transported energy of less than 400 GWh/year over the last five years;
c. Companies pursuant to Art. 74b para. 1 letter n ISG [companies of the Civil Aviation and National Airportsprovided that they:
- do not have to set up an information security management system in accordance with Articles 2 and 4 and Annex II of Regulation (EU) 2023/2036 or Article 2 and Annex II of Regulation (EU) 2022/16457,
- do not have to implement the requirements under point 1.7 of the Annex to Regulation (EU) 2015/19988 in their security program in accordance with Articles 2, 12, 13 or 14 of Regulation (EC) 300/20089;
d. Railroad company as well as cableway, trolleybus, bus and shipping companies in accordance with Article 74b paragraph 1 letter m ISG, provided that they:
- are not entrusted with system tasks (Art. 37 of the Railways Act of December 20, 195710 [EBG]),
- have a passenger transport concession in accordance with Article 6 of the Passenger Transport Act of March 20, 200911 (PBG), but do not provide services jointly ordered by the Confederation and the cantons (Art. 28 – 31c PBG),
- they have an infrastructure concession in accordance with Article 5 EBG, but this has not been granted because there is a public interest in the construction and operation of the infrastructure (Art. 6 para. 1 let. a EBG);
e. Providers and operators in accordance with Article 74b paragraph 1 letter t ISG [provider and operator of Cloud Computing, Search engines, digital security and trust services as well as Data centers based in Switzerland]: provided they have a registered office in Switzerland and do not provide their services to third parties, either in part or in full, in return for payment.
2 Undertakings referred to in Article 74b(1)(f) [hospitals], g [medical laboratories], h [manufacturers, distributors and importers of Pharmaceuticals], l [Postal services] and p [Essential goods for daily needs with a risk of significant supply bottlenecks] ISGs to which paragraph 1 does not apply are exempt from the reporting obligation if they employ fewer than 50 persons in the affected area and their annual turnover or annual balance sheet total in the affected area does not exceed CHF 10 million.
The draft CSV contains further, practically important clarifications of the reporting obligation.