Federal Act of 18 December 2020 on Information Security within the Confederation (LIS) - Purpose (ISG)

This Act aims to: a. ensure the security of the processing of information under the jurisdiction of the Confederation and the security of its IT resources; b. increase Switzerland's resilience to cyber threats.

It thus aims to protect the following public interests: a. the decision-making and action capacity of the authorities and organizations of the Confederation; b. the internal and external security of Switzerland; c. the foreign policy interests of Switzerland; d. the economic, financial, and monetary interests of Switzerland; e. the fulfillment of the legal and contractual obligations of the authorities and organizations of the Confederation regarding information protection.

This Act aims to: a. ensure the security of the processing of information under the jurisdiction of the Confederation and the security of its IT resources; b. increase Switzerland's resilience to cyber threats.

It thus aims to protect the following public interests: a. the decision-making and action capacity of the authorities and organizations of the Confederation; b. the internal and external security of Switzerland; c. the foreign policy interests of Switzerland; d. the economic, financial, and monetary interests of Switzerland; e. the fulfillment of the legal and contractual obligations of the authorities and organizations of the Confederation regarding information protection.

This act applies to the following authorities: a. the Federal Assembly; b. the Federal Council; c. the courts of the Confederation; d. the Office of the Attorney General of the Confederation and its supervisory authority; e. the Swiss National Bank.

It also applies to the following organizations: a. the Parliamentary Services; b. the federal administration; c. the administrative services of the courts of the Confederation; d. the army; e. the organizations specified in Art. 2, para. 4, of the Act of March 21, 1997, on the Organization of the Government and Administration (LOGA), for their administrative tasks.

The Federal Council may restrict the scope of this act for organizations as defined in Art. 2, para. 3 and 4, LOGA to those that: a. perform sensitive activities, or b. use or access the Confederation's computer resources in the performance of their tasks.

It may limit the scope to certain provisions of this act as referred to in para. 3. In this regard, it takes into account the autonomy of execution of the concerned organizations according to the organizational acts that govern them.

Public or private law organizations that operate critical infrastructures without being referred to in paras. 1 to 3 are subject to Arts. 73a to 79. Special legislation may provide that other provisions of this act apply to them.

This act applies to the following authorities: a. the Federal Assembly; b. the Federal Council; c. the courts of the Confederation; d. the Office of the Attorney General of the Confederation and its supervisory authority; e. the Swiss National Bank.

It also applies to the following organizations: a. the Parliamentary Services; b. the federal administration; c. the administrative services of the courts of the Confederation; d. the army; e. the organizations specified in Art. 2, para. 4, of the Act of March 21, 1997, on the Organization of the Government and Administration (LOGA), for their administrative tasks.

The Federal Council may restrict the scope of this act for organizations as defined in Art. 2, para. 3 and 4, LOGA to those that: a. perform sensitive activities, or b. use or access the Confederation's computer resources in the performance of their tasks.

It may limit the scope to certain provisions of this act as referred to in para. 3. In this regard, it takes into account the autonomy of execution of the concerned organizations according to the organizational acts that govern them.

Public or private law organizations that operate critical infrastructures without being referred to in paras. 1 to 3 are subject to Arts. 73a to 79. Special legislation may provide that other provisions of this act apply to them.

The provisions applicable to cantons are only those relating to: a. classified information, when the cantons handle classified information from the Confederation, and b. the security of IT resources, when the cantons access IT resources of the Confederation.

These provisions do not apply when the cantons ensure at least equivalent information security.

The provisions applicable to cantons are only those relating to: a. classified information, when the cantons handle classified information from the Confederation, and b. the security of IT resources, when the cantons access IT resources of the Confederation.

These provisions do not apply when the cantons ensure at least equivalent information security.

The law of December 17, 2004 on transparency (LTrans) takes precedence over this law.

Information originating from third parties, of which the Federal Cybersecurity Office (OFCS) becomes aware during its activity of receiving and analyzing reports in accordance with Chap. 5, cannot be made accessible under the LTrans. Authorities, organizations, and individuals referred to in Art. 2, para. 1, LTrans are not considered third parties.

When the protection of information is also governed by other federal laws, the provisions of this law apply in a complementary manner.

The law of December 17, 2004 on transparency (LTrans) takes precedence over this law.

Information originating from third parties, of which the Federal Cybersecurity Office (OFCS) becomes aware during its activity of receiving and analyzing reports in accordance with Chap. 5, cannot be made accessible under the LTrans. Authorities, organizations, and individuals referred to in Art. 2, para. 1, LTrans are not considered third parties.

When the protection of information is also governed by other federal laws, the provisions of this law apply in a complementary manner.

The following terms are defined as: a. Information technology resource: any resource pertaining to information and communication technologies, including applications, information systems and files, as well as installations, products, and services used for the electronic processing of information; b. Sensitive activity: 1. the processing of information classified as "confidential" or "secret," 2. the administration, operation, maintenance, and monitoring of information technology resources falling under the security categories "high protection" or "very high protection," 3. access to security zones, particularly to protection zones 2 or 3 of a facility as per legislation on the protection of military installations; c. Critical infrastructure: the supply of drinking water and energy, information, communication, and transport infrastructures, as well as other installations, processes, and systems essential for the functioning of the economy and the well-being of the population; d. Cyber incident: an event occurring during the use of information technology resources resulting in a breach of the confidentiality, availability, or integrity of information or the traceability of its processing; e. Cyberattack: a cyber incident intentionally caused; f. Cyber threat: any circumstance or event that may lead to a cyber incident; g. Vulnerability: a cyber threat caused by flaws or errors in information technology resources.

The following terms are defined as: a. Information technology resource: any resource pertaining to information and communication technologies, including applications, information systems and files, as well as installations, products, and services used for the electronic processing of information; b. Sensitive activity: 1. the processing of information classified as "confidential" or "secret," 2. the administration, operation, maintenance, and monitoring of information technology resources falling under the security categories "high protection" or "very high protection," 3. access to security zones, particularly to protection zones 2 or 3 of a facility as per legislation on the protection of military installations; c. Critical infrastructure: the supply of drinking water and energy, information, communication, and transport infrastructures, as well as other installations, processes, and systems essential for the functioning of the economy and the well-being of the population; d. Cyber incident: an event occurring during the use of information technology resources resulting in a breach of the confidentiality, availability, or integrity of information or the traceability of its processing; e. Cyberattack: a cyber incident intentionally caused; f. Cyber threat: any circumstance or event that may lead to a cyber incident; g. Vulnerability: a cyber threat caused by flaws or errors in information technology resources.

The authorities and organizations subject to this law shall ensure that the need for protection of information within their jurisdiction is assessed according to the potential harm to the interests defined in Art. 1, para. 2.

They ensure that information, according to its need for protection: a. is accessible only to authorized persons (confidentiality); b. is available when needed (availability); c. cannot be altered unlawfully or inadvertently (integrity); d. is processed in a manner that is traceable (traceability).

They ensure that the IT resources they use to perform their legal duties are protected against misuse and disruptions.

In doing so, they take into account the principles of proportionality, cost-effectiveness, and ease of use.

The authorities and organizations subject to this law shall ensure that the need for protection of information within their jurisdiction is assessed according to the potential harm to the interests defined in Art. 1, para. 2.

They ensure that information, according to its need for protection: a. is accessible only to authorized persons (confidentiality); b. is available when needed (availability); c. cannot be altered unlawfully or inadvertently (integrity); d. is processed in a manner that is traceable (traceability).

They ensure that the IT resources they use to perform their legal duties are protected against misuse and disruptions.

In doing so, they take into account the principles of proportionality, cost-effectiveness, and ease of use.

The authorities subject to this Act shall ensure, each within their area of competence, that information security is organized, implemented, and monitored in accordance with the state of scientific and technical knowledge.

They shall establish: a. their objectives regarding information security; b. the principles of risk management; c. the consequences of a breach of regulations.

The authorities subject to this Act shall ensure, each within their area of competence, that information security is organized, implemented, and monitored in accordance with the state of scientific and technical knowledge.

They shall establish: a. their objectives regarding information security; b. the principles of risk management; c. the consequences of a breach of regulations.

The authorities and organizations subject to this Act shall ensure, each within its area of competence, that the information security risks are continuously assessed.

They shall take the necessary measures to eliminate the risks or reduce them to an acceptable level.

Risks deemed acceptable must be formally accepted.

The authorities and organizations subject to this Act shall ensure, each within its area of competence, that the information security risks are continuously assessed.

They shall take the necessary measures to eliminate the risks or reduce them to an acceptable level.

Risks deemed acceptable must be formally accepted.

When the authorities and organizations subject to this Act collaborate with third parties, they ensure that the requirements and measures provided by this Act are incorporated into the agreements and contracts they conclude for this purpose.

They ensure that the implementation of the measures is adequately monitored.

When the authorities and organizations subject to this Act collaborate with third parties, they ensure that the requirements and measures provided by this Act are incorporated into the agreements and contracts they conclude for this purpose.

They ensure that the implementation of the measures is adequately monitored.

The authorities and organizations subject to this Act shall ensure that information security breaches are detected promptly, their causes clarified, and their consequences minimized to the fullest extent possible.

The authorities subject to this Act shall ensure the establishment of action plans in the event of serious information security breaches likely to threaten the fulfillment of essential tasks of the Confederation; they shall organize exercises for this purpose.

The authorities and organizations subject to this Act shall ensure that information security breaches are detected promptly, their causes clarified, and their consequences minimized to the fullest extent possible.

The authorities subject to this Act shall ensure the establishment of action plans in the event of serious information security breaches likely to threaten the fulfillment of essential tasks of the Confederation; they shall organize exercises for this purpose.

Authorities and organizations may process personal data pertinent to information security, particularly within the information security management systems designed for this purpose (ISMS applications).

They may exchange personal data referred to in para. 1 among themselves and with national, international, or foreign public law organizations, provided the following conditions are met: a. it serves the purpose of information security; b. it does not violate any legal or contractual obligation to maintain confidentiality; c. the provisions of the federal data protection legislation are adhered to; d. the organization receiving the data performs legal tasks in the field of information security that correspond to those of the authority or organization communicating the data.

They may interconnect their information systems, notably ISMS applications, and exchange data automatically or upon request through interfaces.

They may manage electronic forms used to submit or process requests and reports in the field of information security and link them to their ISMS applications or other information systems.

Insofar as it is necessary to manage information security breaches or to remedy vulnerabilities, they may perform the following actions with sensitive data as defined in Art. 5, let. c, of the Federal Act of September 25, 2020, on Data Protection (DPA) related to individuals involved in these breaches or vulnerabilities or who are or could be affected by them: a. process them; b. exchange them among themselves and with national, international, or foreign public law organizations, provided the condition referred to in para. 2, let. b, is met.

They may retain sensitive data for up to two years after managing information security breaches or eliminating vulnerabilities, but no more than ten years.

The archiving of data is governed by the provisions of the legislation related to archiving.

The processing of personal data by the FCSC in the context of fulfilling its tasks is governed by Arts. 75 to 79.

Authorities and organizations may process personal data pertinent to information security, particularly within the information security management systems designed for this purpose (ISMS applications).

They may exchange personal data referred to in para. 1 among themselves and with national, international, or foreign public law organizations, provided the following conditions are met: a. it serves the purpose of information security; b. it does not violate any legal or contractual obligation to maintain confidentiality; c. the provisions of the federal data protection legislation are adhered to; d. the organization receiving the data performs legal tasks in the field of information security that correspond to those of the authority or organization communicating the data.

They may interconnect their information systems, notably ISMS applications, and exchange data automatically or upon request through interfaces.

They may manage electronic forms used to submit or process requests and reports in the field of information security and link them to their ISMS applications or other information systems.

Insofar as it is necessary to manage information security breaches or to remedy vulnerabilities, they may perform the following actions with sensitive data as defined in Art. 5, let. c, of the Federal Act of September 25, 2020, on Data Protection (DPA) related to individuals involved in these breaches or vulnerabilities or who are or could be affected by them: a. process them; b. exchange them among themselves and with national, international, or foreign public law organizations, provided the condition referred to in para. 2, let. b, is met.

They may retain sensitive data for up to two years after managing information security breaches or eliminating vulnerabilities, but no more than ten years.

The archiving of data is governed by the provisions of the legislation related to archiving.

The processing of personal data by the FCSC in the context of fulfilling its tasks is governed by Arts. 75 to 79.

The authorities and organizations subject to this law shall ensure that information meeting the criteria defined in Art. 13 is classified.

The classification must be limited to what is strictly necessary and, if possible, be temporary.

The authorities and organizations subject to this law shall ensure that information meeting the criteria defined in Art. 13 is classified.

The classification must be limited to what is strictly necessary and, if possible, be temporary.

The authorities subject to this Act shall designate the competent individuals and services responsible for classifying information (classification authors). Only the classification author or the service to which they are subordinate may modify or delete a classification. The Federal Council regulates the declassification of archives.

The authorities subject to this Act shall designate the competent individuals and services responsible for classifying information (classification authors). Only the classification author or the service to which they are subordinate may modify or delete a classification. The Federal Council regulates the declassification of archives.

Information that could harm the interests defined in Art. 1, para. 2, let. a to d, if disclosed to an unauthorized person, is classified as "internal."

Information that could significantly harm the interests defined in Art. 1, para. 2, let. a to d, if disclosed to an unauthorized person, is classified as "confidential."

Information that could seriously harm the interests defined in Art. 1, para. 2, let. a to d, if disclosed to an unauthorized person, is classified as "secret."

Information that could harm the interests defined in Art. 1, para. 2, let. a to d, if disclosed to an unauthorized person, is classified as "internal."

Information that could significantly harm the interests defined in Art. 1, para. 2, let. a to d, if disclosed to an unauthorized person, is classified as "confidential."

Information that could seriously harm the interests defined in Art. 1, para. 2, let. a to d, if disclosed to an unauthorized person, is classified as "secret."

Only individuals who provide all assurances that they will handle the information appropriately and meet one of the following conditions may access classified information: a. they need the information in question to perform a legal task; b. they have been contractually granted access authorization and need the information in question to carry out the tasks entrusted to them.

Access to classified archives is governed by the legislation on archiving.

Access restrictions provided for in international treaties as referred to in Art. 87 are reserved.

Only individuals who provide all assurances that they will handle the information appropriately and meet one of the following conditions may access classified information: a. they need the information in question to perform a legal task; b. they have been contractually granted access authorization and need the information in question to carry out the tasks entrusted to them.

Access to classified archives is governed by the legislation on archiving.

Access restrictions provided for in international treaties as referred to in Art. 87 are reserved.

Access to classified information pertaining to the Federal Assembly, Parliamentary Services, courts, and public prosecutor's offices is governed by the applicable procedural law.

Before any decision granting access to information as referred to in para. 1 is made, the competent parliamentary body or court may consult the author of the classification.

Access to classified information pertaining to the Federal Assembly, Parliamentary Services, courts, and public prosecutor's offices is governed by the applicable procedural law.

Before any decision granting access to information as referred to in para. 1 is made, the competent parliamentary body or court may consult the author of the classification.

To ensure information security during the use of information technology resources, the authorities subject to this Act shall develop a security procedure.

The security procedure shall specifically define: a. the criteria for assessing the need for protection of information before the commissioning of information technology resources; b. the methods for implementing and monitoring security measures; c. the authority to approve the use of information technology resources; d. the procedure to be followed in the event of a change in risks.

The execution of the security procedure is the responsibility of the authorities and organizations subject to this Act that decide on the use of information technology resources.

To ensure information security during the use of information technology resources, the authorities subject to this Act shall develop a security procedure.

The security procedure shall specifically define: a. the criteria for assessing the need for protection of information before the commissioning of information technology resources; b. the methods for implementing and monitoring security measures; c. the authority to approve the use of information technology resources; d. the procedure to be followed in the event of a change in risks.

The execution of the security procedure is the responsibility of the authorities and organizations subject to this Act that decide on the use of information technology resources.

Information technology resources fall under the "basic protection" security category unless they belong to a higher security category.

They fall under the "high protection" security category in the following cases: a. a violation of the confidentiality, availability, integrity, or traceability of the information they process is likely to significantly harm the interests defined in Art. 1, para. 2; b. their misuse or disruption is likely to significantly harm the interests defined in Art. 1, para. 2.

They fall under the "very high protection" security category in the following cases: a. a violation of the confidentiality, availability, integrity, or traceability of the information they process is likely to seriously harm the interests defined in Art. 1, para. 2; b. their misuse or disruption is likely to seriously harm the interests defined in Art. 1, para. 2.

Information technology resources fall under the "basic protection" security category unless they belong to a higher security category.

They fall under the "high protection" security category in the following cases: a. a violation of the confidentiality, availability, integrity, or traceability of the information they process is likely to significantly harm the interests defined in Art. 1, para. 2; b. their misuse or disruption is likely to significantly harm the interests defined in Art. 1, para. 2.

They fall under the "very high protection" security category in the following cases: a. a violation of the confidentiality, availability, integrity, or traceability of the information they process is likely to seriously harm the interests defined in Art. 1, para. 2; b. their misuse or disruption is likely to seriously harm the interests defined in Art. 1, para. 2.

The authorities subject to this law establish the minimum security requirements applicable to the security categories defined in Art. 17.

All IT resources must meet the minimum requirements of the "basic protection" security category.

The effectiveness of the measures applicable to the IT resources in the "very high protection" security category must be subject to periodic reviews.

The authorities subject to this law establish the minimum security requirements applicable to the security categories defined in Art. 17.

All IT resources must meet the minimum requirements of the "basic protection" security category.

The effectiveness of the measures applicable to the IT resources in the "very high protection" security category must be subject to periodic reviews.

The authorities and organizations subject to the present act shall ensure the security of the IT resources that they operate for themselves or on behalf of another authority or organization.

Articles 57i to 57q of the GAOA apply mutatis mutandis to the processing of personal data in the context of network monitoring.

The authorities and organizations subject to the present act shall ensure the security of the IT resources that they operate for themselves or on behalf of another authority or organization.

Articles 57i to 57q of the GAOA apply mutatis mutandis to the processing of personal data in the context of network monitoring.

The authorities and organizations subject to this law shall ensure that individuals accessing information, IT resources, premises, and other infrastructures of the Confederation: a. are carefully selected; b. are identified according to the sensitivity of the activity concerned; c. receive training and continuing education appropriate to their level of responsibility; d. are, if applicable, bound to maintain confidentiality.

They may use biometric verification methods to identify individuals if the sensitivity of the activity concerned requires it. Biometric data shall be destroyed upon the expiration of the access authorization.

They may also systematically use the social security number in accordance with art. 50 c of the Federal Law of 20 December 1946 on Old-Age and Survivors' Insurance as a personal identifier.

The authorities and organizations subject to this law shall ensure that individuals accessing information, IT resources, premises, and other infrastructures of the Confederation: a. are carefully selected; b. are identified according to the sensitivity of the activity concerned; c. receive training and continuing education appropriate to their level of responsibility; d. are, if applicable, bound to maintain confidentiality.

They may use biometric verification methods to identify individuals if the sensitivity of the activity concerned requires it. Biometric data shall be destroyed upon the expiration of the access authorization.

They may also systematically use the social security number in accordance with art. 50 c of the Federal Law of 20 December 1946 on Old-Age and Survivors' Insurance as a personal identifier.

The authorities and organizations subject to this Act shall ensure that access authorizations to information, IT resources, premises, or other infrastructures of the Confederation are granted only to persons who need them to perform their duties.

The authorizations shall be revoked at the end of the employment or contract or as soon as the relevant task has been completed. They may be blocked or revoked without prior notice when concrete indications suggest that security is threatened.

The authorities and organizations subject to this Act shall ensure that access authorizations to information, IT resources, premises, or other infrastructures of the Confederation are granted only to persons who need them to perform their duties.

The authorizations shall be revoked at the end of the employment or contract or as soon as the relevant task has been completed. They may be blocked or revoked without prior notice when concrete indications suggest that security is threatened.

The authorities and organizations subject to this law shall ensure adequate physical protection of the information and IT resources for which they are responsible, against misuse and disruptions.

The authorities and organizations subject to this law shall ensure adequate physical protection of the information and IT resources for which they are responsible, against misuse and disruptions.

Authorities and organizations subject to this Act may establish security zones in premises or areas where: a. classified information marked “confidential” or “secret” is frequently handled, or b. IT systems with security categories “high protection” or “very high protection” are operated.

They may take the following measures: a. prohibit certain objects, particularly imaging and sound recording devices; b. monitor sensitive areas with imaging and sound recording devices; c. conduct searches; d. conduct unannounced inspections of premises, even in the absence of employees.

They may operate, in accordance with Art. 34, para. 1 ter, of the Telecommunications Act of April 30, 1997 (TCA), a jamming device in security zones where classified information marked “secret” is frequently handled or IT systems with the security category “very high protection” are operated.

Special provisions relating to security zones established under international treaties as referred to in Art. 87 and provisions applicable to protection zones of military installations under the legislation on the protection of military installations are reserved.

Authorities and organizations subject to this Act may establish security zones in premises or areas where: a. classified information marked “confidential” or “secret” is frequently handled, or b. IT systems with security categories “high protection” or “very high protection” are operated.

They may take the following measures: a. prohibit certain objects, particularly imaging and sound recording devices; b. monitor sensitive areas with imaging and sound recording devices; c. conduct searches; d. conduct unannounced inspections of premises, even in the absence of employees.

They may operate, in accordance with Art. 34, para. 1 ter, of the Telecommunications Act of April 30, 1997 (TCA), a jamming device in security zones where classified information marked “secret” is frequently handled or IT systems with the security category “very high protection” are operated.

Special provisions relating to security zones established under international treaties as referred to in Art. 87 and provisions applicable to protection zones of military installations under the legislation on the protection of military installations are reserved.

Authorities subject to this Act may operate systems allowing for the centralized management of data used to identify persons who have access to information, IT resources, premises, and other infrastructures (identification data management systems).

The identification data management systems verify the identities and access profiles of individuals, machines, and systems. They transmit the results to the connected information systems for authorization verification.

Authorities subject to this Act must designate a responsible service for each identification data management system.

Authorities subject to this Act may operate systems allowing for the centralized management of data used to identify persons who have access to information, IT resources, premises, and other infrastructures (identification data management systems).

The identification data management systems verify the identities and access profiles of individuals, machines, and systems. They transmit the results to the connected information systems for authorization verification.

Authorities subject to this Act must designate a responsible service for each identification data management system.

Data identification management systems allow for the exchange and harmonization of data with connected information systems, with directories of persons and users, and with other data identification management systems operated by authorities subject to this Act.

The exchange and harmonization are limited to data whose processing is authorized in the concerned system.

Data identification management systems allow for the exchange and harmonization of data with connected information systems, with directories of persons and users, and with other data identification management systems operated by authorities subject to this Act.

The exchange and harmonization are limited to data whose processing is authorized in the concerned system.

The authorities subject to this Act shall issue implementing provisions, particularly in the following areas: a. data protection and security; b. processed personal data; c. the exchange and harmonization of data with other systems; d. the logging and transmission of logging data to connected information systems; e. the periodic review, conducted by an external body, of the processing of personal data.

The authorities subject to this Act shall issue implementing provisions, particularly in the following areas: a. data protection and security; b. processed personal data; c. the exchange and harmonization of data with other systems; d. the logging and transmission of logging data to connected information systems; e. the periodic review, conducted by an external body, of the processing of personal data.

The security check related to individuals aims to determine whether the exercise of a sensitive activity by a person, in the context of their function or mandate, poses a risk to information security.

To this end, the competent services collect relevant security data concerning the lifestyle of the person concerned, particularly their close personal and family relationships, financial situation, and foreign relations.

Data on the exercise of constitutional rights may only be processed if there is a concrete suspicion that the person subject to the check is exercising these rights to prepare for or commit acts likely to significantly harm the interests defined in Art. 1, para. 2.

The security check related to individuals aims to determine whether the exercise of a sensitive activity by a person, in the context of their function or mandate, poses a risk to information security.

To this end, the competent services collect relevant security data concerning the lifestyle of the person concerned, particularly their close personal and family relationships, financial situation, and foreign relations.

Data on the exercise of constitutional rights may only be processed if there is a concrete suspicion that the person subject to the check is exercising these rights to prepare for or commit acts likely to significantly harm the interests defined in Art. 1, para. 2.

The authorities subject to this Act shall establish, each within their area of competence, a list of functions that involve the exercise of sensitive activities. They shall periodically review the accuracy of this list and make any necessary corrections.

The authorities subject to this Act shall establish, each within their area of competence, a list of functions that involve the exercise of sensitive activities. They shall periodically review the accuracy of this list and make any necessary corrections.

Subject to security control are: a. employees of the Confederation, external collaborators, and military personnel who hold a position listed on one of the lists mentioned in Art. 28; b. cantonal employees engaged in sensitive activities; c. third parties executing a mandate for an authority or organization subject to this law that involves engaging in sensitive activities; d. persons subject to security control under an international treaty as per Art. 87.

Any person called upon to undertake sensitive activities on behalf of a foreign authority or international organization is subject to security control, provided that Switzerland has concluded an international treaty as per Art. 87 with the concerned state or international organization.

Persons who hold a position not yet listed in one of the lists mentioned in Art. 28 may, exceptionally, be subjected to a security control with the approval of the relevant authority. The list of positions must be completed as soon as possible.

Candidates for the following functions are not subject to security control: a. Member of the Federal Assembly; b. Member of the Federal Council and Chancellor of the Confederation; c. Judge at a federal court; d. Attorney General of the Confederation; e. Member of the Supervisory Authority of the Office of the Attorney General of the Confederation; ebis. Head of the Federal Data Protection and Information Commissioner; f. General; g. Cantonal magistrate elected by the people or the parliament of the concerned canton.

Subject to security control are: a. employees of the Confederation, external collaborators, and military personnel who hold a position listed on one of the lists mentioned in Art. 28; b. cantonal employees engaged in sensitive activities; c. third parties executing a mandate for an authority or organization subject to this law that involves engaging in sensitive activities; d. persons subject to security control under an international treaty as per Art. 87.

Any person called upon to undertake sensitive activities on behalf of a foreign authority or international organization is subject to security control, provided that Switzerland has concluded an international treaty as per Art. 87 with the concerned state or international organization.

Persons who hold a position not yet listed in one of the lists mentioned in Art. 28 may, exceptionally, be subjected to a security control with the approval of the relevant authority. The list of positions must be completed as soon as possible.

Candidates for the following functions are not subject to security control: a. Member of the Federal Assembly; b. Member of the Federal Council and Chancellor of the Confederation; c. Judge at a federal court; d. Attorney General of the Confederation; e. Member of the Supervisory Authority of the Office of the Attorney General of the Confederation; ebis. Head of the Federal Data Protection and Information Commissioner; f. General; g. Cantonal magistrate elected by the people or the parliament of the concerned canton.

Authorities subject to this act attribute the following levels of control to the sensitive activities defined below: a. basic security control: sensitive activities, the inadequate or non-compliant exercise of which is likely to significantly harm the interests defined in Art. 1, para. 2; b. extended security control: sensitive activities, the inadequate or non-compliant exercise of which is likely to severely harm the interests defined in Art. 1, para. 2.

Authorities subject to this act attribute the following levels of control to the sensitive activities defined below: a. basic security control: sensitive activities, the inadequate or non-compliant exercise of which is likely to significantly harm the interests defined in Art. 1, para. 2; b. extended security control: sensitive activities, the inadequate or non-compliant exercise of which is likely to severely harm the interests defined in Art. 1, para. 2.

The authorities subject to this law and the cantons designate the services with the following competencies: a. initiate the security inspection procedure (services requesting the inspection); b. decide to entrust the sensitive activity (decision-making bodies).

The Federal Council designates one or more specialized services responsible for conducting security checks related to individuals (CSP specialized services). These services carry out the evaluation without any instruction.

The authorities subject to this law and the cantons designate the services with the following competencies: a. initiate the security inspection procedure (services requesting the inspection); b. decide to entrust the sensitive activity (decision-making bodies).

The Federal Council designates one or more specialized services responsible for conducting security checks related to individuals (CSP specialized services). These services carry out the evaluation without any instruction.

No security check may be conducted without the consent of the person subject to the check.

Conscripts, military personnel, and civil protection members may be subjected to a security check without their consent.

The person subject to the check is required to collaborate in the establishment of the facts.

No security check may be conducted without the consent of the person subject to the check.

Conscripts, military personnel, and civil protection members may be subjected to a security check without their consent.

The person subject to the check is required to collaborate in the establishment of the facts.

For individuals referred to in Art. 29, para. 1, let. a and b, the security check procedure must be initiated before the assignment of the position.

For individuals referred to in Art. 29, para. 1, let. a, who must be appointed by the Federal Council, the security check must be completed before the submission of the appointment proposal.

For individuals referred to in Art. 29, para. 1, let. c, the security check must be completed before the sensitive activity is entrusted to them.

For individuals referred to in Art. 29, para. 1, let. d, the security check takes place at the time provided for by the applicable treaty.

For individuals referred to in Art. 29, para. 1, let. a and b, the security check procedure must be initiated before the assignment of the position.

For individuals referred to in Art. 29, para. 1, let. a, who must be appointed by the Federal Council, the security check must be completed before the submission of the appointment proposal.

For individuals referred to in Art. 29, para. 1, let. c, the security check must be completed before the sensitive activity is entrusted to them.

For individuals referred to in Art. 29, para. 1, let. d, the security check takes place at the time provided for by the applicable treaty.

The CSP specialized services can collect the following data regarding an individual for conducting a basic security check: a. criminal record data; b. data on ongoing, closed, or suspended criminal proceedings, by requesting information or files from criminal authorities; c. data necessary for risk assessment from the Confederation's security bodies, the Federal Intelligence Service (FIS), military bodies, and other Confederation bodies; d. data from the registers and files of the cantonal security bodies and police authorities; e. data from the registers of debt collection and bankruptcy offices; f. data from files established during previous security checks; g. data from public information sources.

Additionally, they may collect the following data concerning an individual for conducting an expanded security check: a. data held by federal and cantonal tax authorities; b. data from the population control register; c. data held by financial institutions and banks engaged in business relations with the individual concerned; d. data provided by the individual involved during a hearing.

When concrete indications based on collected data suggest that there is a security risk, or when the collected data is insufficient or does not cover a sufficient period for the check, the CSP specialized services may interview the individual concerned. They may also question third parties provided they have the consent of the person undergoing the security check; they inform the third parties involved that they are free to provide information or not.

Data relating to third parties that cannot be separated from data concerning the person undergoing the security check can be processed if indispensable for carrying out the check. The CSP specialized services inform the third parties concerned about the processing of their data.

The CSP specialized services can collect the following data regarding an individual for conducting a basic security check: a. criminal record data; b. data on ongoing, closed, or suspended criminal proceedings, by requesting information or files from criminal authorities; c. data necessary for risk assessment from the Confederation's security bodies, the Federal Intelligence Service (FIS), military bodies, and other Confederation bodies; d. data from the registers and files of the cantonal security bodies and police authorities; e. data from the registers of debt collection and bankruptcy offices; f. data from files established during previous security checks; g. data from public information sources.

Additionally, they may collect the following data concerning an individual for conducting an expanded security check: a. data held by federal and cantonal tax authorities; b. data from the population control register; c. data held by financial institutions and banks engaged in business relations with the individual concerned; d. data provided by the individual involved during a hearing.

When concrete indications based on collected data suggest that there is a security risk, or when the collected data is insufficient or does not cover a sufficient period for the check, the CSP specialized services may interview the individual concerned. They may also question third parties provided they have the consent of the person undergoing the security check; they inform the third parties involved that they are free to provide information or not.

Data relating to third parties that cannot be separated from data concerning the person undergoing the security check can be processed if indispensable for carrying out the check. The CSP specialized services inform the third parties concerned about the processing of their data.

The authority or organization concerned within the meaning of Art. 34 collects data held by a foreign authority or an international organization. When the collected data provide concrete indications of organized crime or international criminality, the specialized service CSP consults the central criminal police offices of the Confederation. The central offices only communicate to the specialized service CSP the personal data relevant for security.

The authority or organization concerned within the meaning of Art. 34 collects data held by a foreign authority or an international organization. When the collected data provide concrete indications of organized crime or international criminality, the specialized service CSP consults the central criminal police offices of the Confederation. The central offices only communicate to the specialized service CSP the personal data relevant for security.

The public authorities and organizations from which the specialized CSP services may collect data or which are required to participate in the procedure shall provide their assistance free of charge.

Third parties for whom the procedure entails a significant burden shall be compensated.

The Confederation shall bear the costs of the control for cantonal employees referred to in Art. 29, para. 1, let. b.

The public authorities and organizations from which the specialized CSP services may collect data or which are required to participate in the procedure shall provide their assistance free of charge.

Third parties for whom the procedure entails a significant burden shall be compensated.

The Confederation shall bear the costs of the control for cantonal employees referred to in Art. 29, para. 1, let. b.

The specialized CSP services classify the procedure when the concerned person withdraws their consent or is no longer considered for the intended function or mandate execution.

They communicate the classification of the procedure to the concerned person and the service that requested its initiation. The concerned person is deemed not to have been vetted.

The specialized CSP services classify the procedure when the concerned person withdraws their consent or is no longer considered for the intended function or mandate execution.

They communicate the classification of the procedure to the concerned person and the service that requested its initiation. The concerned person is deemed not to have been vetted.

A security risk exists when concrete evidence based on collected data suggests with a high probability that the person being assessed will perform the sensitive activity in an inadequate manner or contrary to regulations.

The probability of inadequate or non-compliant performance of a sensitive activity may be considered high, in particular when concrete evidence indicates that the person exhibits one of the following characteristics: a. they lack integrity or loyalty; b. they are susceptible to blackmail or corruption; c. they do not possess full capacity for judgment or decision-making.

The assessment must be based on facts concerning the personal situation of the person subject to the control, regardless of any fault committed.

A security risk exists when concrete evidence based on collected data suggests with a high probability that the person being assessed will perform the sensitive activity in an inadequate manner or contrary to regulations.

The probability of inadequate or non-compliant performance of a sensitive activity may be considered high, in particular when concrete evidence indicates that the person exhibits one of the following characteristics: a. they lack integrity or loyalty; b. they are susceptible to blackmail or corruption; c. they do not possess full capacity for judgment or decision-making.

The assessment must be based on facts concerning the personal situation of the person subject to the control, regardless of any fault committed.

The CSP specialized services issue one of the following statements, which have the meanings indicated below: a. Security declaration: there is no security risk; b. Security declaration with reservations: there is a security risk, but it can be reduced to an acceptable level by meeting certain conditions; the CSP specialized services recommend the conditions to be set; c. Risk declaration: there is a security risk; d. Finding: the data is insufficient or does not cover a sufficient period to assess the security risk.

In the cases referred to in para. 1, letters b to d, they first provide the person subject to the control with the opportunity to give their opinion.

The CSP specialized services issue one of the following statements, which have the meanings indicated below: a. Security declaration: there is no security risk; b. Security declaration with reservations: there is a security risk, but it can be reduced to an acceptable level by meeting certain conditions; the CSP specialized services recommend the conditions to be set; c. Risk declaration: there is a security risk; d. Finding: the data is insufficient or does not cover a sufficient period to assess the security risk.

In the cases referred to in para. 1, letters b to d, they first provide the person subject to the control with the opportunity to give their opinion.

The specialized CSP services shall communicate in writing to the person concerned and the decision-making authority the statement they have made.

For appointments made by the Federal Council, the specialized CSP services shall communicate their statement to the department proposing the appointment.

They may communicate the statement to another decision-making authority in the following cases: a. the person subject to the check is called to perform another sensitive activity within the meaning of this Act that requires a security check; b. the person is subject to a loyalty check under another federal law; c. the person is subject to an assessment under Art. 113 of the February 3, 1995 Armed Forces Act.

If the specialized CSP services have concrete indications of a security risk before the conclusion of the assessment, they may communicate their interim findings in writing to the authorities and bodies mentioned in paragraphs 1 to 3, and to the person being checked.

The specialized CSP services shall communicate in writing to the person concerned and the decision-making authority the statement they have made.

For appointments made by the Federal Council, the specialized CSP services shall communicate their statement to the department proposing the appointment.

They may communicate the statement to another decision-making authority in the following cases: a. the person subject to the check is called to perform another sensitive activity within the meaning of this Act that requires a security check; b. the person is subject to a loyalty check under another federal law; c. the person is subject to an assessment under Art. 113 of the February 3, 1995 Armed Forces Act.

If the specialized CSP services have concrete indications of a security risk before the conclusion of the assessment, they may communicate their interim findings in writing to the authorities and bodies mentioned in paragraphs 1 to 3, and to the person being checked.

The statements from the specialized CSP services hold the value of recommendations.

The service referred to in Art. 31, para. 1, let. b decides, after having reviewed the statement, whether the controlled person can perform the sensitive activity in question.

It may impose conditions on the exercise of the activity.

It communicates its decision to the specialized CSP service.

The statements from the specialized CSP services hold the value of recommendations.

The service referred to in Art. 31, para. 1, let. b decides, after having reviewed the statement, whether the controlled person can perform the sensitive activity in question.

It may impose conditions on the exercise of the activity.

It communicates its decision to the specialized CSP service.

There is no need to conduct a new security check when the person concerned has already obtained a declaration for a level of check that is at least equivalent: a. for another sensitive activity within the meaning of this Act; b. as part of a loyalty check pursuant to another federal law.

There is no need to conduct a new security check when the person concerned has already obtained a declaration for a level of check that is at least equivalent: a. for another sensitive activity within the meaning of this Act; b. as part of a loyalty check pursuant to another federal law.

The security check related to individuals is repeated as follows: a. basic security check: no earlier than five years, no later than ten years; b. extended security check: no earlier than three years, no later than five years.

The Federal Council may stipulate that it is not necessary to repeat the basic security check for persons performing certain functions within the military or civil protection.

When the requesting service or the decision-making body has reasons to believe that new risks have emerged since the last check, they may request the repetition of the security check from the CSP specialized service; they must provide a written justification for their request.

The security check related to individuals is repeated as follows: a. basic security check: no earlier than five years, no later than ten years; b. extended security check: no earlier than three years, no later than five years.

The Federal Council may stipulate that it is not necessary to repeat the basic security check for persons performing certain functions within the military or civil protection.

When the requesting service or the decision-making body has reasons to believe that new risks have emerged since the last check, they may request the repetition of the security check from the CSP specialized service; they must provide a written justification for their request.

The monitored person has a period of 30 days from the receipt of a notice pursuant to Art. 39, para. 1, to: a. inspect the control file; b. request the correction of incorrect data or the destruction of obsolete data; c. request that a mention of its contentious nature be added to a piece of data.

Restrictions on the dissemination of information are governed by Art. 26 FADP.

The notice constitutes a material act within the meaning of Art. 25a of the Federal Act of December 20, 1968, on Administrative Procedure. The monitored person may appeal against a notice pursuant to Art. 39, para. 1, lett. b to d, to the Federal Administrative Court within 30 days from its receipt.

If the decision-making body is the Federal Supreme Court or the Federal Administrative Court, Art. 36, para. 2 and 4, of the Act of March 24, 2000, on the Federal Personnel Act applies by analogy.

The appeal procedure is further governed by the general provisions of federal procedure.

The monitored person has a period of 30 days from the receipt of a notice pursuant to Art. 39, para. 1, to: a. inspect the control file; b. request the correction of incorrect data or the destruction of obsolete data; c. request that a mention of its contentious nature be added to a piece of data.

Restrictions on the dissemination of information are governed by Art. 26 FADP.

The notice constitutes a material act within the meaning of Art. 25a of the Federal Act of December 20, 1968, on Administrative Procedure. The monitored person may appeal against a notice pursuant to Art. 39, para. 1, lett. b to d, to the Federal Administrative Court within 30 days from its receipt.

If the decision-making body is the Federal Supreme Court or the Federal Administrative Court, Art. 36, para. 2 and 4, of the Act of March 24, 2000, on the Federal Personnel Act applies by analogy.

The appeal procedure is further governed by the general provisions of federal procedure.

The specialized CSP services operate an information system. This system serves for the execution of: a. security checks relating to persons; b. assessments of the potential for abuse or danger concerning personal weapons; c. reliability checks; d. loyalty checks.

Each specialized CSP service is responsible for the lawfulness of the processing of personal data it carries out within the information system.

Sensitive data as defined in art. 5, let. c, of the Federal Act on Data Protection (FADP) may be processed in the information system as long as it is necessary for the assessment of security risk.

Profiling as defined by the FADP, including high-risk profiling, may be carried out using the data contained in the information system to analyze, evaluate, assess, or predict the following personal aspects related to a natural person for the purposes cited in para. 1: a. security risk; b. potential for abuse and danger concerning personal weapons.

The information system contains the following data: a. identity data of persons to be checked or who have been checked, including AVS number and passport number; b. the data referred to in arts. 34 and 35; c. data related to the assessment of security risk; d. the evaluation result referred to in art. 39, para. 1; e. the decision of the decision-making authority; f. data and files related to appeal procedures; g. lists and statistics containing the data referred to in let. a to f.

The processing of data referred to in para. 4 outside the information system must be recorded in the system.

The data referred to in para. 4 can be collected automatically and systematically online in the following information systems: a. computer-based criminal record as defined by the Act of June 17, 2016, on the criminal record; b. national police index as defined in art. 17 of the Federal Act of June 13, 2008, on the Confederation's Police Information Systems; c. data indexing system of the SRC as defined in art. 51 of the Federal Act of September 25, 2015, on Intelligence; d. databases of the Central Weapons Office as referred to in art. 32a, para. 1, of the Act of June 20, 1997, on Weapons.

The specialized CSP services operate an information system. This system serves for the execution of: a. security checks relating to persons; b. assessments of the potential for abuse or danger concerning personal weapons; c. reliability checks; d. loyalty checks.

Each specialized CSP service is responsible for the lawfulness of the processing of personal data it carries out within the information system.

Sensitive data as defined in art. 5, let. c, of the Federal Act on Data Protection (FADP) may be processed in the information system as long as it is necessary for the assessment of security risk.

Profiling as defined by the FADP, including high-risk profiling, may be carried out using the data contained in the information system to analyze, evaluate, assess, or predict the following personal aspects related to a natural person for the purposes cited in para. 1: a. security risk; b. potential for abuse and danger concerning personal weapons.

The information system contains the following data: a. identity data of persons to be checked or who have been checked, including AVS number and passport number; b. the data referred to in arts. 34 and 35; c. data related to the assessment of security risk; d. the evaluation result referred to in art. 39, para. 1; e. the decision of the decision-making authority; f. data and files related to appeal procedures; g. lists and statistics containing the data referred to in let. a to f.

The processing of data referred to in para. 4 outside the information system must be recorded in the system.

The data referred to in para. 4 can be collected automatically and systematically online in the following information systems: a. computer-based criminal record as defined by the Act of June 17, 2016, on the criminal record; b. national police index as defined in art. 17 of the Federal Act of June 13, 2008, on the Confederation's Police Information Systems; c. data indexing system of the SRC as defined in art. 51 of the Federal Act of September 25, 2015, on Intelligence; d. databases of the Central Weapons Office as referred to in art. 32a, para. 1, of the Act of June 20, 1997, on Weapons.

The following bodies may access online the data contained in the information system: a. the services requesting the control: the data referred to in Art. 45, para. 4, let. b, which they have input themselves when initiating the control procedure, as well as the data referred to in Art. 45, para. 4, let. a, d, and e; b. the decision-making authorities: the data referred to in Art. 45, para. 4, let. a, d, and e; c. the information security officers within the meaning of Art. 81, for the execution of their control tasks: the data referred to in Art. 45, para. 4, let. a, d, and e; d. the Federal and Cantonal services from which the data referred to in Art. 37 are collected: the data referred to in Art. 45, para. 4, let. a.

The following bodies may access the data contained in the information system: a. the specialized service charged with conducting the security procedure related to enterprises (PSE specialized service) within the meaning of Art. 51, para. 2, through an interface linked to the information system referred to in Art. 70, to conduct the security procedure related to enterprises as per Arts. 49 to 73: the data referred to in Art. 45, para. 4, let. a, d, and e; b. the Defense Group: 1. through an interface linked to the information system referred to in Art. 12 of the Federal Act of October 3, 2008, on Army Information Systems (LSIA), for the purposes defined in Art. 13 LSIA: the data referred to in Art. 45, para. 4, let. a, d, and e, 2. through an interface linked to the information system referred to in Art. 18 LSIA, for the purposes defined in Art. 19 LSIA: the data referred to in Art. 45, para. 4, let. a and e; 3. through an interface linked to the information system referred to in Art. 156 LSIA, for the purpose defined in Art. 157 LSIA: the data referred to in Art. 45, para. 4, let. a and e, 4. through an interface linked to the information system referred to in Art. 162 LSIA, for the purpose defined in Art. 163 LSIA: the data referred to in Art. 45, para. 4, let. a and e; c. the competent service for issuing international security certificates within the meaning of Art. 48, let. c, through an interface: the data referred to in Art. 45, para. 4, let. a, d, and e.

The specialized CSP services may additionally electronically communicate the data referred to in Art. 45, para. 4, let. a and e, to other Confederation services insofar as these data are necessary for controlling access to security areas.

They may communicate to the authorities and organizations subject to the present law the lists and statistics referred to in Art. 45, para. 1, let. g, insofar as they are needed to execute the control tasks provided for by the present law.

The following bodies may access online the data contained in the information system: a. the services requesting the control: the data referred to in Art. 45, para. 4, let. b, which they have input themselves when initiating the control procedure, as well as the data referred to in Art. 45, para. 4, let. a, d, and e; b. the decision-making authorities: the data referred to in Art. 45, para. 4, let. a, d, and e; c. the information security officers within the meaning of Art. 81, for the execution of their control tasks: the data referred to in Art. 45, para. 4, let. a, d, and e; d. the Federal and Cantonal services from which the data referred to in Art. 37 are collected: the data referred to in Art. 45, para. 4, let. a.

The following bodies may access the data contained in the information system: a. the specialized service charged with conducting the security procedure related to enterprises (PSE specialized service) within the meaning of Art. 51, para. 2, through an interface linked to the information system referred to in Art. 70, to conduct the security procedure related to enterprises as per Arts. 49 to 73: the data referred to in Art. 45, para. 4, let. a, d, and e; b. the Defense Group: 1. through an interface linked to the information system referred to in Art. 12 of the Federal Act of October 3, 2008, on Army Information Systems (LSIA), for the purposes defined in Art. 13 LSIA: the data referred to in Art. 45, para. 4, let. a, d, and e, 2. through an interface linked to the information system referred to in Art. 18 LSIA, for the purposes defined in Art. 19 LSIA: the data referred to in Art. 45, para. 4, let. a and e; 3. through an interface linked to the information system referred to in Art. 156 LSIA, for the purpose defined in Art. 157 LSIA: the data referred to in Art. 45, para. 4, let. a and e, 4. through an interface linked to the information system referred to in Art. 162 LSIA, for the purpose defined in Art. 163 LSIA: the data referred to in Art. 45, para. 4, let. a and e; c. the competent service for issuing international security certificates within the meaning of Art. 48, let. c, through an interface: the data referred to in Art. 45, para. 4, let. a, d, and e.

The specialized CSP services may additionally electronically communicate the data referred to in Art. 45, para. 4, let. a and e, to other Confederation services insofar as these data are necessary for controlling access to security areas.

They may communicate to the authorities and organizations subject to the present law the lists and statistics referred to in Art. 45, para. 1, let. g, insofar as they are needed to execute the control tasks provided for by the present law.

The CSP specialized services may record the hearings referred to in Art. 34, para. 2, let. d, and 3, and store the recordings on media.

They retain the data as long as the concerned person carries out the sensitive activity, but for no more than ten years.

The archiving of data is governed by the provisions of the legislation pertaining to archiving.

When the procedure is closed or the CSP specialized services learn that a monitored person does not occupy the intended function or has refused to carry out the intended mandate, these services must destroy all data and files related to the procedure within three months.

The CSP specialized services may record the hearings referred to in Art. 34, para. 2, let. d, and 3, and store the recordings on media.

They retain the data as long as the concerned person carries out the sensitive activity, but for no more than ten years.

The archiving of data is governed by the provisions of the legislation pertaining to archiving.

When the procedure is closed or the CSP specialized services learn that a monitored person does not occupy the intended function or has refused to carry out the intended mandate, these services must destroy all data and files related to the procedure within three months.

The Federal Council regulates: a. the procedures for security clearance related to individuals; b. the organization of the specialized services CSP; c. the procedures for issuing international security certificates; d. the responsibilities concerning the protection of data processed in the information system referred to in Art. 45 and data security; e. the procedures for the periodic review conducted by an external body of personal data processing.

The Federal Council regulates: a. the procedures for security clearance related to individuals; b. the organization of the specialized services CSP; c. the procedures for issuing international security certificates; d. the responsibilities concerning the protection of data processed in the information system referred to in Art. 45 and data security; e. the procedures for the periodic review conducted by an external body of personal data processing.

The security procedure concerning enterprises aims to preserve information security during the execution of public contracts by enterprises, parts of them, or subcontractors (enterprises), insofar as these contracts involve carrying out a sensitive activity (sensitive contracts).

The security procedure concerning enterprises aims to preserve information security during the execution of public contracts by enterprises, parts of them, or subcontractors (enterprises), insofar as these contracts involve carrying out a sensitive activity (sensitive contracts).

The following enterprises may be subject to the security procedure: a. enterprises commissioned to execute a sensitive mandate on behalf of an authority or organization subject to this Act; b. enterprises headquartered in Switzerland that bid for mandates whose execution requires an international security certificate as defined in Art. 66.

The procedure cannot be conducted without the consent of the concerned enterprise.

The enterprises referred to in para. 1, let. b, bear the costs of the procedure.

The following enterprises may be subject to the security procedure: a. enterprises commissioned to execute a sensitive mandate on behalf of an authority or organization subject to this Act; b. enterprises headquartered in Switzerland that bid for mandates whose execution requires an international security certificate as defined in Art. 66.

The procedure cannot be conducted without the consent of the concerned enterprise.

The enterprises referred to in para. 1, let. b, bear the costs of the procedure.

The security procedure is classified in the following cases: a. the company concerned withdraws its consent or does not cooperate with the procedure; b. the company concerned withdraws its offer; c. the company concerned is no longer considered for the execution of the mandate. The specialized service responsible for conducting the security procedure related to companies (PSE specialized service) communicates the classification of the procedure to the company and to the authority or organization awarding the mandate (adjudicator).

The security procedure is classified in the following cases: a. the company concerned withdraws its consent or does not cooperate with the procedure; b. the company concerned withdraws its offer; c. the company concerned is no longer considered for the execution of the mandate. The specialized service responsible for conducting the security procedure related to companies (PSE specialized service) communicates the classification of the procedure to the company and to the authority or organization awarding the mandate (adjudicator).

When authorities and organizations subject to this law contemplate awarding a sensitive mandate, they submit a request to initiate the procedure to the specialized PSE service.

The authorities subject to this law designate the competent services to request the initiation of the procedure.

Foreign authorities or international organizations must themselves submit a request for the companies referred to in Art. 50, para. 1, let. b.

When authorities and organizations subject to this law contemplate awarding a sensitive mandate, they submit a request to initiate the procedure to the specialized PSE service.

The authorities subject to this law designate the competent services to request the initiation of the procedure.

Foreign authorities or international organizations must themselves submit a request for the companies referred to in Art. 50, para. 1, let. b.

The specialized PSE service examines the request and initiates the procedure.

With the agreement of the adjudicator, it may refrain from initiating a procedure if other measures allow for reducing the security risk to an acceptable level. It recommends the measures to be taken.

The specialized PSE service examines the request and initiates the procedure.

With the agreement of the adjudicator, it may refrain from initiating a procedure if other measures allow for reducing the security risk to an acceptable level. It recommends the measures to be taken.

The specialized SIS service sets, in agreement with the awarding authority, the information security requirements for the tendering process and the mandate execution phase.

The specialized SIS service sets, in agreement with the awarding authority, the information security requirements for the tendering process and the mandate execution phase.

The adjudicator informs the specialized PSE service which companies are under consideration for the execution of the sensitive contract.

The specialized PSE service assesses whether the companies in question possess the required qualifications from a security perspective to execute the sensitive contract or if there exists a security risk.

It conducts the assessment without any instruction.

The adjudicator informs the specialized PSE service which companies are under consideration for the execution of the sensitive contract.

The specialized PSE service assesses whether the companies in question possess the required qualifications from a security perspective to execute the sensitive contract or if there exists a security risk.

It conducts the assessment without any instruction.

To assess the qualification of a company, the specialized service PSE may collect data from the following sources: a. the company concerned; b. the SRC; c. any public information source.

It may request foreign or international services to provide it with data. The request is made through the SRC.

To assess the qualification of a company, the specialized service PSE may collect data from the following sources: a. the company concerned; b. the SRC; c. any public information source.

It may request foreign or international services to provide it with data. The request is made through the SRC.

There is a security risk when concrete evidence based on collected data suggests with a high probability that the company will execute the sensitive mandate inadequately or contrary to regulations.

The probability of inadequate or non-compliant execution of the sensitive mandate can be considered high in particular in the following cases: a. the company lacks integrity or loyalty; b. the company is controlled by foreign states or foreign public or private law organizations or is under their influence, when such control or influence is incompatible with the interests defined in Art. 1, para. 2; c. a specialized CSP service has issued a risk declaration for a company staff member, and this person is essential for the execution of the mandate.

The assessment must be based on facts concerning the company's situation, regardless of any fault committed.

There is a security risk when concrete evidence based on collected data suggests with a high probability that the company will execute the sensitive mandate inadequately or contrary to regulations.

The probability of inadequate or non-compliant execution of the sensitive mandate can be considered high in particular in the following cases: a. the company lacks integrity or loyalty; b. the company is controlled by foreign states or foreign public or private law organizations or is under their influence, when such control or influence is incompatible with the interests defined in Art. 1, para. 2; c. a specialized CSP service has issued a risk declaration for a company staff member, and this person is essential for the execution of the mandate.

The assessment must be based on facts concerning the company's situation, regardless of any fault committed.

The PSE specialized service communicates its evaluation to the awarding authority and formally notifies the company.

If the PSE specialized service concludes that the execution of the sensitive mandate by the concerned company poses a security risk, the awarding authority excludes the company from the award procedure.

If all companies under consideration pose a security risk, the awarding authority may nevertheless entrust the mandate to one of them. The PSE specialized service closes the procedure. The awarding authority applies by analogy the measures referred to in Articles 59, 60, 63, and 64.

The PSE specialized service communicates its evaluation to the awarding authority and formally notifies the company.

If the PSE specialized service concludes that the execution of the sensitive mandate by the concerned company poses a security risk, the awarding authority excludes the company from the award procedure.

If all companies under consideration pose a security risk, the awarding authority may nevertheless entrust the mandate to one of them. The PSE specialized service closes the procedure. The awarding authority applies by analogy the measures referred to in Articles 59, 60, 63, and 64.

The awarding entity informs the specialized PSE service of the contractor company.

The company prepares a security plan following the guidelines of the specialized PSE service.

The security plan is subject to review by the specialized PSE service. The latter may collect the necessary data in writing or inspect the company's premises.

The awarding entity informs the specialized PSE service of the contractor company.

The company prepares a security plan following the guidelines of the specialized PSE service.

The security plan is subject to review by the specialized PSE service. The latter may collect the necessary data in writing or inspect the company's premises.

Employees of the company who are assigned to perform sensitive activities are subject to a security check.

The specialized PSE service is responsible for the decision as per Art. 41, para. 2. If the security procedure related to companies is classified according to Art. 58, para. 3, because no company possesses the required qualifications to execute the mandate, the contracting authority makes the decision.

Employees of the company who are assigned to perform sensitive activities are subject to a security check.

The specialized PSE service is responsible for the decision as per Art. 41, para. 2. If the security procedure related to companies is classified according to Art. 58, para. 3, because no company possesses the required qualifications to execute the mandate, the contracting authority makes the decision.

The specialized PSE service formally issues a security declaration when the enterprise provides proof that it has implemented the security plan.

It denies the security declaration to the enterprise and dismisses the procedure if the enterprise does not implement the security plan. A formal decision is made accordingly.

Decisions referred to in paras. 1 and 2 are communicated to the contracting authority.

The contracting authority is bound by the decision of the specialized PSE service, subject to Art. 58, para. 3.

The security declaration is valid for five years.

The specialized PSE service formally issues a security declaration when the enterprise provides proof that it has implemented the security plan.

It denies the security declaration to the enterprise and dismisses the procedure if the enterprise does not implement the security plan. A formal decision is made accordingly.

Decisions referred to in paras. 1 and 2 are communicated to the contracting authority.

The contracting authority is bound by the decision of the specialized PSE service, subject to Art. 58, para. 3.

The security declaration is valid for five years.

The contracting authority may allow a company to execute a sensitive mandate only after it has obtained a security clearance.

The contracting authority may allow a company to execute a sensitive mandate only after it has obtained a security clearance.

Companies that have obtained a security declaration must consistently apply the measures outlined in the security plan.

They must immediately inform the specialized security service (PSE) and the contracting authority of any changes and incidents in the field of security.

Companies that have obtained a security declaration must consistently apply the measures outlined in the security plan.

They must immediately inform the specialized security service (PSE) and the contracting authority of any changes and incidents in the field of security.

The specialized PSE service may: a. conduct unannounced inspections in areas where the sensitive mandate is executed; b. review documents related to the mandate.

When concrete indications suggest that information security is threatened within a company, the specialized PSE service may immediately take necessary protection measures, including securing documents and materials.

The specialized PSE service may: a. conduct unannounced inspections in areas where the sensitive mandate is executed; b. review documents related to the mandate.

When concrete indications suggest that information security is threatened within a company, the specialized PSE service may immediately take necessary protection measures, including securing documents and materials.

Companies that have obtained a security declaration are considered qualified when awarding other sensitive contracts. The PSE specialized service examines the necessity of adjusting the security plan.

Companies that have obtained a security declaration are considered qualified when awarding other sensitive contracts. The PSE specialized service examines the necessity of adjusting the security plan.

The specialized PSE service issues an international security certificate upon the request of the company.

The specialized PSE service issues an international security certificate upon the request of the company.

The specialized PSE service revokes the security declaration in the following cases: a. the company has not fulfilled its obligations as per Art. 63; b. a repetition of the procedure has identified a security risk.

It notifies its decision to the company and the contracting authority.

In case of revocation of the security declaration, the contracting authority immediately withdraws the mandate from the company, subject to Art. 58, para. 3. The company is not entitled to any compensation.

The specialized PSE service revokes the security declaration in the following cases: a. the company has not fulfilled its obligations as per Art. 63; b. a repetition of the procedure has identified a security risk.

It notifies its decision to the company and the contracting authority.

In case of revocation of the security declaration, the contracting authority immediately withdraws the mandate from the company, subject to Art. 58, para. 3. The company is not entitled to any compensation.

The security procedure is repeated in the following cases: a. the company's security declaration expires while the company is executing a sensitive mandate; b. significant changes have occurred within the company and concrete indications suggest that these changes have introduced new security risks.

The security procedure is repeated in the following cases: a. the company's security declaration expires while the company is executing a sensitive mandate; b. significant changes have occurred within the company and concrete indications suggest that these changes have introduced new security risks.

The company has 30 days from the notification of the decision by the PSE specialist service to: a. review the control file; b. request the correction of erroneous data or the destruction of obsolete data; c. request that a dispute notation be added to a piece of data; d. appeal to the Federal Administrative Court.

The restrictions on the communication of information are governed by Art. 26 FADP.

The company has 30 days from the notification of the decision by the PSE specialist service to: a. review the control file; b. request the correction of erroneous data or the destruction of obsolete data; c. request that a dispute notation be added to a piece of data; d. appeal to the Federal Administrative Court.

The restrictions on the communication of information are governed by Art. 26 FADP.

The PSE specialized service operates an information system to conduct and manage security procedures related to enterprises.

Sensitive data as per art. 5, let. c, FADP may be processed in the information system to the extent necessary for executing the procedure.

The information system contains the following data: a. the data referred to in arts. 56 and 59, para. 3; b. the result of the evaluation referred to in art. 55, para. 2; c. the result of security checks related to persons referred to in art. 60, para. 1; d. the decision of the PSE specialized service referred to in art. 60, para. 2; e. the registered name of enterprises that have obtained a security declaration; f. the protective measures referred to in art. 64; g. the data and files related to appeal procedures.

The PSE specialized service is responsible for the security of the information system and the legality of the processing of personal data.

The PSE specialized service operates an information system to conduct and manage security procedures related to enterprises.

Sensitive data as per art. 5, let. c, FADP may be processed in the information system to the extent necessary for executing the procedure.

The information system contains the following data: a. the data referred to in arts. 56 and 59, para. 3; b. the result of the evaluation referred to in art. 55, para. 2; c. the result of security checks related to persons referred to in art. 60, para. 1; d. the decision of the PSE specialized service referred to in art. 60, para. 2; e. the registered name of enterprises that have obtained a security declaration; f. the protective measures referred to in art. 64; g. the data and files related to appeal procedures.

The PSE specialized service is responsible for the security of the information system and the legality of the processing of personal data.

The following bodies may consult the data online: a. the awarding authorities: the data referred to in Art. 70, para. 3, let. b and d to g; b. the companies authorized by the Federal Council, pursuant to Art. 31, para. 1, let. a, to initiate security clearance procedures related to individuals within their area of competence: the data referred to in Art. 70, para. 3, let. d. The specialized PSE service may, moreover, communicate the data referred to in Art. 70, para. 3, let. b to d, to other federal services insofar as this data is necessary for information security.

The following bodies may consult the data online: a. the awarding authorities: the data referred to in Art. 70, para. 3, let. b and d to g; b. the companies authorized by the Federal Council, pursuant to Art. 31, para. 1, let. a, to initiate security clearance procedures related to individuals within their area of competence: the data referred to in Art. 70, para. 3, let. d. The specialized PSE service may, moreover, communicate the data referred to in Art. 70, para. 3, let. b to d, to other federal services insofar as this data is necessary for information security.

The specialized PSE service retains data for as long as the concerned enterprise holds a security declaration, but for no more than ten years.

The archiving of data is governed by the provisions of the legislation concerning archiving.

When the procedure is closed, the specialized PSE service destroys all data and files related to the procedure within three months.

The specialized PSE service retains data for as long as the concerned enterprise holds a security declaration, but for no more than ten years.

The archiving of data is governed by the provisions of the legislation concerning archiving.

When the procedure is closed, the specialized PSE service destroys all data and files related to the procedure within three months.

The Federal Council regulates: a. the procedures for security concerning enterprises; b. the application to subcontractors of the security procedure concerning enterprises; c. the organization of the PSE specialized service; d. the necessary measures to ensure the security of data for the system referred to in Art. 70; e. the details of the periodic review conducted by an external body regarding the processing of personal data.

The Federal Council regulates: a. the procedures for security concerning enterprises; b. the application to subcontractors of the security procedure concerning enterprises; c. the organization of the PSE specialized service; d. the necessary measures to ensure the security of data for the system referred to in Art. 70; e. the details of the periodic review conducted by an external body regarding the processing of personal data.

In order to protect Switzerland against cyber threats, the Federal Office for Civil Protection (FOCP) conducts technical analyses to assess and counter cyber incidents and cyber threats, as well as to identify and eliminate vulnerabilities.

Based on these analyses, the FOCP undertakes, in particular, the following tasks: a. raising public awareness about cyber threats and alerting them to such threats; b. alerting the authorities, organizations, and concerned individuals in the event of an immediate cyber threat or an ongoing cyber attack; c. publishing information on cybersecurity and recommendations on preventive and reactive measures to be taken against cyber incidents; d. receiving and processing reports concerning cyber incidents and cyber threats; e. supporting operators of critical infrastructures.

In order to protect Switzerland against cyber threats, the Federal Office for Civil Protection (FOCP) conducts technical analyses to assess and counter cyber incidents and cyber threats, as well as to identify and eliminate vulnerabilities.

Based on these analyses, the FOCP undertakes, in particular, the following tasks: a. raising public awareness about cyber threats and alerting them to such threats; b. alerting the authorities, organizations, and concerned individuals in the event of an immediate cyber threat or an ongoing cyber attack; c. publishing information on cybersecurity and recommendations on preventive and reactive measures to be taken against cyber incidents; d. receiving and processing reports concerning cyber incidents and cyber threats; e. supporting operators of critical infrastructures.

The Federal Office for Civil Protection (OFPC) receives reports concerning cyber incidents and cyber threats. Reports can be submitted anonymously.

The OFPC analyzes the reports with regard to their significance for the protection of Switzerland against cyber threats. Upon request, it issues a recommendation regarding the measures to be taken, provided that no further analysis or clarification is necessary for this purpose.

If the OFPC becomes aware of a vulnerability, it promptly informs the manufacturer of the affected hardware or software and sets an appropriate deadline for its remediation. It informs them that any failure to comply may be sanctioned under public procurement law (art. 44, para. 1, let. f bis, of the Federal Act of 21 June 2019 on Public Procurement) and that upon expiration of the deadline, it may make the vulnerability public in accordance with art. 73 c, para. 2.

The Federal Office for Civil Protection (OFPC) receives reports concerning cyber incidents and cyber threats. Reports can be submitted anonymously.

The OFPC analyzes the reports with regard to their significance for the protection of Switzerland against cyber threats. Upon request, it issues a recommendation regarding the measures to be taken, provided that no further analysis or clarification is necessary for this purpose.

If the OFPC becomes aware of a vulnerability, it promptly informs the manufacturer of the affected hardware or software and sets an appropriate deadline for its remediation. It informs them that any failure to comply may be sanctioned under public procurement law (art. 44, para. 1, let. f bis, of the Federal Act of 21 June 2019 on Public Procurement) and that upon expiration of the deadline, it may make the vulnerability public in accordance with art. 73 c, para. 2.

The FCSC may publish information related to cyber incidents provided that it serves the protection against cyber threats. This information may contain data relating to the physical or legal persons concerned only if they consent to it and if these data are identifying features and addressing resources used abusively.

The FCSC may publish information related to vulnerabilities by indicating the affected hardware or software, provided that the manufacturer consents to it or has not addressed the vulnerability within the period referred to in Art. 73b, para. 3.

The FCSC may publish information related to cyber incidents provided that it serves the protection against cyber threats. This information may contain data relating to the physical or legal persons concerned only if they consent to it and if these data are identifying features and addressing resources used abusively.

The FCSC may publish information related to vulnerabilities by indicating the affected hardware or software, provided that the manufacturer consents to it or has not addressed the vulnerability within the period referred to in Art. 73b, para. 3.

The FOSC may transmit information from reports to authorities and organizations active in the field of cybersecurity. Such information may only contain personal data if the individual concerned consents.

If the reporting or analysis of a cyber incident reveals that information is necessary to timely detect and prevent threats to internal or external security, to assess the threat, or to ensure an early warning service to protect critical infrastructures in accordance with Art. 6, para. 1, let. a, 2, and 5, of the Federal Act of September 25, 2015, on Intelligence (IntA), the FOSC shall transmit this information to the FIS.

Notwithstanding Art. 22a, para. 1, of the Federal Act of March 24, 2000, on Federal Personnel, FOSC employees who, in the context of a report or its analysis, obtain information about a potential offense report it exclusively to the director of the FOSC. The director may report this potential offense to the prosecuting authorities if its severity justifies it.

The transmission by the FOSC of legally protected secrets must comply with the requirements set forth in Art. 320 of the Penal Code.

The FOSC may transmit information from reports to authorities and organizations active in the field of cybersecurity. Such information may only contain personal data if the individual concerned consents.

If the reporting or analysis of a cyber incident reveals that information is necessary to timely detect and prevent threats to internal or external security, to assess the threat, or to ensure an early warning service to protect critical infrastructures in accordance with Art. 6, para. 1, let. a, 2, and 5, of the Federal Act of September 25, 2015, on Intelligence (IntA), the FOSC shall transmit this information to the FIS.

Notwithstanding Art. 22a, para. 1, of the Federal Act of March 24, 2000, on Federal Personnel, FOSC employees who, in the context of a report or its analysis, obtain information about a potential offense report it exclusively to the director of the FOSC. The director may report this potential offense to the prosecuting authorities if its severity justifies it.

The transmission by the FOSC of legally protected secrets must comply with the requirements set forth in Art. 320 of the Penal Code.

The FCSC assists operators of critical infrastructures in protecting themselves against cyber threats.

In particular, it provides them, free of charge and for voluntary use, with the following tools: a. a communication system enabling the secure exchange of information; b. technical information on ongoing cyber threats and recommendations on preventive and reactive measures to be taken against cyber incidents; c. technical instruments and instructions for detecting cyber incidents aimed at addressing the increased protection needs of critical infrastructures.

It can advise and support them in managing cyber incidents and eliminating vulnerabilities when the operation of the concerned critical infrastructure is jeopardized and, in the case of private operators, when equivalent support cannot be obtained from the market in a timely manner.

With the consent of the concerned operator, it may access their information and IT resources to analyze a cyber incident.

The FCSC assists operators of critical infrastructures in protecting themselves against cyber threats.

In particular, it provides them, free of charge and for voluntary use, with the following tools: a. a communication system enabling the secure exchange of information; b. technical information on ongoing cyber threats and recommendations on preventive and reactive measures to be taken against cyber incidents; c. technical instruments and instructions for detecting cyber incidents aimed at addressing the increased protection needs of critical infrastructures.

It can advise and support them in managing cyber incidents and eliminating vulnerabilities when the operation of the concerned critical infrastructure is jeopardized and, in the case of private operators, when equivalent support cannot be obtained from the market in a timely manner.

With the consent of the concerned operator, it may access their information and IT resources to analyze a cyber incident.

The authorities and organizations listed in Art. 74b shall ensure that cyberattacks targeting their IT resources are reported to the FOCS.

The FOCS informs the relevant authorities and organizations about their potential obligation to report and, upon request, issues a decision regarding this obligation.

When reporting a cyberattack, the obligated authorities and organizations are entitled to support from the FOCS in managing the incident, as provided for in Art. 74, para. 3.

The obligation to report is solely intended to enable the FOCS to detect, at an early stage, the methods used during attacks targeting critical infrastructures and, thus, to warn potential victims and recommend necessary preventive and responsive measures.

The authorities and organizations listed in Art. 74b shall ensure that cyberattacks targeting their IT resources are reported to the FOCS.

The FOCS informs the relevant authorities and organizations about their potential obligation to report and, upon request, issues a decision regarding this obligation.

When reporting a cyberattack, the obligated authorities and organizations are entitled to support from the FOCS in managing the incident, as provided for in Art. 74, para. 3.

The obligation to report is solely intended to enable the FOCS to detect, at an early stage, the methods used during attacks targeting critical infrastructures and, thus, to warn potential victims and recommend necessary preventive and responsive measures.

The reporting obligation applies to: a. higher education institutions pursuant to Art. 2, para. 2, of the Act of September 30, 2011, on the Promotion and Coordination of Universities; b. federal, cantonal, and communal authorities as well as intercantonal, cantonal, and intercommunal organizations, with the exception of the Defense Group when the military is providing support services or active service according to Art. 67 and 76 of the Armed Forces Act of February 3, 1995; c. organizations tasked with public law duties in the fields of security and rescue, potable water supply, wastewater treatment, and waste disposal; d. companies operating in the fields of energy supply as per Art. 6, para. 1, of the Energy Act of September 30, 2016, as well as in energy trade, measurement, and management, with the exception of holders of a license under the Nuclear Energy Act of March 21, 2003, if a cyberattack targets a nuclear installation; e. companies subject to the Banking Act of November 8, 1934, the Insurance Supervision Act of December 17, 2004, or the Financial Market Infrastructure Act of June 19, 2015; f. health establishments listed on the cantonal hospital list in accordance with Art. 39, para. 1, let. e, of the Federal Act of March 18, 1994, on Health Insurance; g. medical laboratories holding a license under Art. 16, para. 1, of the Epidemics Act of September 28, 2012; h. companies holding a license to manufacture, market, or import medicines according to the Therapeutic Products Act of December 15, 2000; i. organizations providing services intended to cover the consequences of illness, accidents, work and income disability, old age, invalidity, and helplessness; j. the Swiss Broadcasting Corporation; k. national news agencies; l. postal service providers registered with the Post Commission according to Art. 4, para. 1, of the Postal Act of December 17, 2010; m. railway companies referred to in Art. 5 or 8 c of the Federal Act of December 20, 1957, on Railways, as well as companies with cableway, trolleybus, bus, and concessionary navigation systems according to Art. 6 of the Passenger Transport Act of March 20, 2009; n. civil aviation companies holding a license issued by the Federal Office of Civil Aviation and national airports listed in the Sectoral Plan for Aviation Infrastructure; o. companies transporting goods on the Rhine in accordance with the Federal Act of September 23, 1953, on Maritime Navigation under the Swiss Flag and companies performing registration, loading, or unloading of goods at the Basel port; p. companies supplying the population with essential daily goods whose partial or complete failure would lead to severe supply difficulties; q. telecommunication service providers registered with the Federal Office of Communications in accordance with Art. 4, para. 1, Telecommunications Act; r. registries and registrars of Internet domains as per Art. 28 b Telecommunications Act; s. providers and operators of services and infrastructures used to exercise political rights; t. providers and operators of cloud computing, search engines, digital security or trust services, as well as data centers, provided they have a registered seat in Switzerland; u. manufacturers of IT hardware or software whose products are used by critical infrastructures, if the concerned hardware or software have remote maintenance access or are used for any of the following purposes: 1. control and monitoring of systems and technical processes, 2. ensuring public safety.

Authorities and organizations that also carry out activities not covered by para. 1 are not required to report cyberattacks that only affect these activities.

The reporting obligation pursuant to para. 1 applies to cyberattacks that have an effect in Switzerland, even if the concerned IT resources are located abroad.

The reporting obligation applies to: a. higher education institutions pursuant to Art. 2, para. 2, of the Act of September 30, 2011, on the Promotion and Coordination of Universities; b. federal, cantonal, and communal authorities as well as intercantonal, cantonal, and intercommunal organizations, with the exception of the Defense Group when the military is providing support services or active service according to Art. 67 and 76 of the Armed Forces Act of February 3, 1995; c. organizations tasked with public law duties in the fields of security and rescue, potable water supply, wastewater treatment, and waste disposal; d. companies operating in the fields of energy supply as per Art. 6, para. 1, of the Energy Act of September 30, 2016, as well as in energy trade, measurement, and management, with the exception of holders of a license under the Nuclear Energy Act of March 21, 2003, if a cyberattack targets a nuclear installation; e. companies subject to the Banking Act of November 8, 1934, the Insurance Supervision Act of December 17, 2004, or the Financial Market Infrastructure Act of June 19, 2015; f. health establishments listed on the cantonal hospital list in accordance with Art. 39, para. 1, let. e, of the Federal Act of March 18, 1994, on Health Insurance; g. medical laboratories holding a license under Art. 16, para. 1, of the Epidemics Act of September 28, 2012; h. companies holding a license to manufacture, market, or import medicines according to the Therapeutic Products Act of December 15, 2000; i. organizations providing services intended to cover the consequences of illness, accidents, work and income disability, old age, invalidity, and helplessness; j. the Swiss Broadcasting Corporation; k. national news agencies; l. postal service providers registered with the Post Commission according to Art. 4, para. 1, of the Postal Act of December 17, 2010; m. railway companies referred to in Art. 5 or 8 c of the Federal Act of December 20, 1957, on Railways, as well as companies with cableway, trolleybus, bus, and concessionary navigation systems according to Art. 6 of the Passenger Transport Act of March 20, 2009; n. civil aviation companies holding a license issued by the Federal Office of Civil Aviation and national airports listed in the Sectoral Plan for Aviation Infrastructure; o. companies transporting goods on the Rhine in accordance with the Federal Act of September 23, 1953, on Maritime Navigation under the Swiss Flag and companies performing registration, loading, or unloading of goods at the Basel port; p. companies supplying the population with essential daily goods whose partial or complete failure would lead to severe supply difficulties; q. telecommunication service providers registered with the Federal Office of Communications in accordance with Art. 4, para. 1, Telecommunications Act; r. registries and registrars of Internet domains as per Art. 28 b Telecommunications Act; s. providers and operators of services and infrastructures used to exercise political rights; t. providers and operators of cloud computing, search engines, digital security or trust services, as well as data centers, provided they have a registered seat in Switzerland; u. manufacturers of IT hardware or software whose products are used by critical infrastructures, if the concerned hardware or software have remote maintenance access or are used for any of the following purposes: 1. control and monitoring of systems and technical processes, 2. ensuring public safety.

Authorities and organizations that also carry out activities not covered by para. 1 are not required to report cyberattacks that only affect these activities.

The reporting obligation pursuant to para. 1 applies to cyberattacks that have an effect in Switzerland, even if the concerned IT resources are located abroad.

The Federal Council exempts authorities and organizations from the reporting obligation referred to in Art. 74b when the disruptions caused by cyberattacks have only a limited impact on the functioning of the economy or the well-being of the population.

The Federal Council exempts authorities and organizations from the reporting obligation referred to in Art. 74b when the disruptions caused by cyberattacks have only a limited impact on the functioning of the economy or the well-being of the population.

A cyber attack must be reported when it: a. jeopardizes the operation of the relevant critical infrastructure; b. has led to the manipulation or leakage of information; c. went undetected for an extended period, particularly if there are indications that it was carried out to prepare for other cyber attacks, or d. is accompanied by acts of extortion, threats, or coercion.

A cyber attack must be reported when it: a. jeopardizes the operation of the relevant critical infrastructure; b. has led to the manipulation or leakage of information; c. went undetected for an extended period, particularly if there are indications that it was carried out to prepare for other cyber attacks, or d. is accompanied by acts of extortion, threats, or coercion.

The report must be made within 24 hours following the detection of the cyberattack.

It must contain information about the authority or organization subject to the reporting obligation, the type and execution of the cyberattack, its effects, the measures taken, and, if known, the planned measures.

If all the required information is not known at the time of reporting, the authority or organization subject to the obligation must complete the report as soon as new information becomes available.

The person responsible for the reporting obligation for an authority or organization is not required, within the scope of the report, to provide information that would expose them to criminal prosecution.

The OFIS informs the authority or organization subject to the obligation as soon as all data necessary to satisfy the reporting obligation is available.

The report must be made within 24 hours following the detection of the cyberattack.

It must contain information about the authority or organization subject to the reporting obligation, the type and execution of the cyberattack, its effects, the measures taken, and, if known, the planned measures.

If all the required information is not known at the time of reporting, the authority or organization subject to the obligation must complete the report as soon as new information becomes available.

The person responsible for the reporting obligation for an authority or organization is not required, within the scope of the report, to provide information that would expose them to criminal prosecution.

The OFIS informs the authority or organization subject to the obligation as soon as all data necessary to satisfy the reporting obligation is available.

The FOSC provides a secure system that allows cyberattack reports to be communicated to it electronically.

The system must allow the authorities or subject organizations to simultaneously communicate all or part of the cyberattack report or its effects to other authorities.

If information beyond what is stipulated in Art. 74e is necessary for fulfilling a reporting obligation to other authorities, the system must enable the authorities or subject organizations to directly communicate such information to the concerned authorities, without the FOSC having access.

The FOSC provides a secure system that allows cyberattack reports to be communicated to it electronically.

The system must allow the authorities or subject organizations to simultaneously communicate all or part of the cyberattack report or its effects to other authorities.

If information beyond what is stipulated in Art. 74e is necessary for fulfilling a reporting obligation to other authorities, the system must enable the authorities or subject organizations to directly communicate such information to the concerned authorities, without the FOSC having access.

If there are indications suggesting a violation of the reporting obligation, the FOSC shall inform the subject authority or organization and set an appropriate deadline for it to fulfill its obligation.

If the concerned authority or organization fails to fulfill its obligation within this deadline, the FOSC shall issue a decision in which it sets a new deadline and informs it that it is threatened with a fine in accordance with Art. 74h.

If there are indications suggesting a violation of the reporting obligation, the FOSC shall inform the subject authority or organization and set an appropriate deadline for it to fulfill its obligation.

If the concerned authority or organization fails to fulfill its obligation within this deadline, the FOSC shall issue a decision in which it sets a new deadline and informs it that it is threatened with a fine in accordance with Art. 74h.

Anyone who intentionally fails to comply with a decision that has come into force, which the OFCS has notified them of under the threat of the fine provided for in this article or a decision of the appeals bodies, is liable to a fine of up to 100,000 francs.

Non-compliance with the decisions referred to in para. 1 within a company is subject to Art. 6 of the Federal Act of 22 March 1974 on Administrative Criminal Law (ACLA).

If the foreseeable amount of the fine does not exceed 20,000 francs and an investigation into punishable persons under Art. 6 ACLA involves investigative measures disproportionate to the penalty incurred, the authority may forego prosecuting these persons and sentence the company to pay the fine.

In the event of non-compliance with an OFCS decision, prosecution and judgment fall within the jurisdiction of the cantons.

Anyone who intentionally fails to comply with a decision that has come into force, which the OFCS has notified them of under the threat of the fine provided for in this article or a decision of the appeals bodies, is liable to a fine of up to 100,000 francs.

Non-compliance with the decisions referred to in para. 1 within a company is subject to Art. 6 of the Federal Act of 22 March 1974 on Administrative Criminal Law (ACLA).

If the foreseeable amount of the fine does not exceed 20,000 francs and an investigation into punishable persons under Art. 6 ACLA involves investigative measures disproportionate to the penalty incurred, the authority may forego prosecuting these persons and sentence the company to pay the fine.

In the event of non-compliance with an OFCS decision, prosecution and judgment fall within the jurisdiction of the cantons.

To fulfill its tasks, the FOSC may process personal data, including addressing resources as defined in Art. 3, let. f, of the LTC and any sensitive data related thereto, which contain information on: a. religious, philosophical, or political opinions; the processing of data is only permissible to the extent that it is necessary for assessing specific threats and dangers in the field of cybersecurity; b. criminal or administrative prosecutions or sanctions.

When processing personal data or in the event of a founded suspicion of identity theft or misuse of addressing resources, the FOSC informs the persons concerned unless this would involve disproportionate effort and no overriding public interest opposes it.

To fulfill its tasks, the FOSC may process personal data, including addressing resources as defined in Art. 3, let. f, of the LTC and any sensitive data related thereto, which contain information on: a. religious, philosophical, or political opinions; the processing of data is only permissible to the extent that it is necessary for assessing specific threats and dangers in the field of cybersecurity; b. criminal or administrative prosecutions or sanctions.

When processing personal data or in the event of a founded suspicion of identity theft or misuse of addressing resources, the FOSC informs the persons concerned unless this would involve disproportionate effort and no overriding public interest opposes it.

The FISC and infrastructure operators may exchange personal data with each other to the extent necessary for protection against cyber threats.

The FISC and telecommunications service providers may exchange addressing resources and related personal data with each other to the extent necessary for protection against cyber threats.

The FISC and infrastructure operators may exchange personal data with each other to the extent necessary for protection against cyber threats.

The FISC and telecommunications service providers may exchange addressing resources and related personal data with each other to the extent necessary for protection against cyber threats.

The FCSC supports the FIS by providing periodic assessments of the number, type, and magnitude of cyberattacks, as well as technical analyses of cyber threats upon request.

It grants the FIS access to information regarding the identity or modus operandi of cyberattack perpetrators in order to timely detect and prevent threats to internal or external security, assess threats, or ensure an early warning service to protect critical infrastructures as defined in Art. 6, para. 1, let. a, 2, and 5, NISA.

It grants law enforcement authorities access to information regarding the identity and modus operandi of cyberattack perpetrators.

It grants cantonal cybersecurity services access to information necessary to protect against cyber threats.

The FCSC supports the FIS by providing periodic assessments of the number, type, and magnitude of cyberattacks, as well as technical analyses of cyber threats upon request.

It grants the FIS access to information regarding the identity or modus operandi of cyberattack perpetrators in order to timely detect and prevent threats to internal or external security, assess threats, or ensure an early warning service to protect critical infrastructures as defined in Art. 6, para. 1, let. a, 2, and 5, NISA.

It grants law enforcement authorities access to information regarding the identity and modus operandi of cyberattack perpetrators.

It grants cantonal cybersecurity services access to information necessary to protect against cyber threats.

The FIOC may exchange information with foreign or international cybersecurity services that enable them to ascertain the identity or methods of cyberattack perpetrators if needed to perform functions comparable to those of the FIOC. If the exchange of information also includes personal data, Articles 16 and 17 of the FADP apply.

The exchange of information as referred to in paragraph 1 is only authorized if the foreign or international services ensure that the data will be used in accordance with the intended purposes.

The FIOC may exchange information with foreign or international cybersecurity services that enable them to ascertain the identity or methods of cyberattack perpetrators if needed to perform functions comparable to those of the FIOC. If the exchange of information also includes personal data, Articles 16 and 17 of the FADP apply.

The exchange of information as referred to in paragraph 1 is only authorized if the foreign or international services ensure that the data will be used in accordance with the intended purposes.

The FOSC retains personal data as long as they are useful for detecting cyber threats or managing cyber incidents, but for no more than five years from their last use for this purpose. For sensitive data, the period is two years.

The archiving of data is governed by the provisions of the legislation related to archiving.

The FOSC retains personal data as long as they are useful for detecting cyber threats or managing cyber incidents, but for no more than five years from their last use for this purpose. For sensitive data, the period is two years.

The archiving of data is governed by the provisions of the legislation related to archiving.

The following authorities and organizations shall each designate an information security officer and a deputy within their field of competence: a. the Federal Council; b. the Administrative Delegation of the Federal Assembly; c. the Federal Courts; d. the Office of the Attorney General of Switzerland; e. the Swiss National Bank; f. the federal departments and the Federal Chancellery.

Information security officers shall perform the following tasks: a. advise and assist within their field of competence the competent services in fulfilling the tasks and obligations incumbent upon them under this Act; b. manage, on mandate from the authority or organization to which they are subordinate, the specialized organization responsible for information security and risk management; c. verify, on mandate from the authority or organization to which they are subordinate, compliance with information security regulations, provide reports, and propose necessary measures; d. voluntarily report incidents in the field of information security to the Confederation’s specialized information security service and the services referred to in Art. 74, para. 5.

No task that could potentially conflict with any of the tasks specified in para. 2 may be assigned to the information security officers.

The following authorities and organizations shall each designate an information security officer and a deputy within their field of competence: a. the Federal Council; b. the Administrative Delegation of the Federal Assembly; c. the Federal Courts; d. the Office of the Attorney General of Switzerland; e. the Swiss National Bank; f. the federal departments and the Federal Chancellery.

Information security officers shall perform the following tasks: a. advise and assist within their field of competence the competent services in fulfilling the tasks and obligations incumbent upon them under this Act; b. manage, on mandate from the authority or organization to which they are subordinate, the specialized organization responsible for information security and risk management; c. verify, on mandate from the authority or organization to which they are subordinate, compliance with information security regulations, provide reports, and propose necessary measures; d. voluntarily report incidents in the field of information security to the Confederation’s specialized information security service and the services referred to in Art. 74, para. 5.

No task that could potentially conflict with any of the tasks specified in para. 2 may be assigned to the information security officers.

The Conference of Information Security Officers consists of the information security officers as referred to in Art. 81, para. 1, two representatives from the cantons, and the Federal Data Protection and Transparency Officer.

It performs the following tasks: a. promote the uniform implementation of this Act; b. contribute to the standardization of the requirements and measures referred to in Art. 85; c. advise the Confederation’s specialized information security service on all aspects of coordination of implementation and on all strategically important issues; d. ensure the exchange of information, particularly on risk management and on problems and incidents in the field of information security; e. guarantee coordination with other services that perform tasks in the field of information security.

It enacts its internal regulations.

The Conference of Information Security Officers consists of the information security officers as referred to in Art. 81, para. 1, two representatives from the cantons, and the Federal Data Protection and Transparency Officer.

It performs the following tasks: a. promote the uniform implementation of this Act; b. contribute to the standardization of the requirements and measures referred to in Art. 85; c. advise the Confederation’s specialized information security service on all aspects of coordination of implementation and on all strategically important issues; d. ensure the exchange of information, particularly on risk management and on problems and incidents in the field of information security; e. guarantee coordination with other services that perform tasks in the field of information security.

It enacts its internal regulations.

The Specialized Information Security Service of the Confederation: a. advises and supports the authorities subject to this Act, their information security officers, and the cantons in implementing this Act; b. may recommend measures if the information security of the Confederation is threatened; c. may conduct audits at the request of the authorities subject to this Act; d. may assess, upon request of the authorities subject to this Act, the risks associated with the use of new technologies; e. may examine, upon request of the authorities and organizations subject to this Act, the adequacy of their processes, resources, facilities, objects, and services in relation to information security requirements; f. may manage and coordinate, at the request of the authorities subject to this Act, information security issues when significant projects involve multiple authorities; g. serves as a contact point for specialized interactions with national, foreign, or international services; h. reports annually to the Federal Council on the state of information security within the Confederation.

The Federal Council's Information Security Officer leads the Specialized Information Security Service of the Confederation.

The Federal Council regulates the organization of the Specialized Information Security Service of the Confederation. It may assign it additional tasks on behalf of the federal administration or the military.

The Specialized Information Security Service of the Confederation: a. advises and supports the authorities subject to this Act, their information security officers, and the cantons in implementing this Act; b. may recommend measures if the information security of the Confederation is threatened; c. may conduct audits at the request of the authorities subject to this Act; d. may assess, upon request of the authorities subject to this Act, the risks associated with the use of new technologies; e. may examine, upon request of the authorities and organizations subject to this Act, the adequacy of their processes, resources, facilities, objects, and services in relation to information security requirements; f. may manage and coordinate, at the request of the authorities subject to this Act, information security issues when significant projects involve multiple authorities; g. serves as a contact point for specialized interactions with national, foreign, or international services; h. reports annually to the Federal Council on the state of information security within the Confederation.

The Federal Council's Information Security Officer leads the Specialized Information Security Service of the Confederation.

The Federal Council regulates the organization of the Specialized Information Security Service of the Confederation. It may assign it additional tasks on behalf of the federal administration or the military.

The authorities subject to this law shall enact the implementing provisions. The Federal Council may mandate the Federal Chancellery to enact implementing provisions for the matters of the Federal Council.

The powers conferred by this law to the authorities subject to this law are exercised, for the Federal Assembly, by the Administrative Delegation of the Federal Assembly.

The implementing provisions of the Federal Council apply analogously to the authorities subject to this law if they do not enact their own implementing provisions.

The authorities subject to this law shall enact the implementing provisions. The Federal Council may mandate the Federal Chancellery to enact implementing provisions for the matters of the Federal Council.

The powers conferred by this law to the authorities subject to this law are exercised, for the Federal Assembly, by the Administrative Delegation of the Federal Assembly.

The implementing provisions of the Federal Council apply analogously to the authorities subject to this law if they do not enact their own implementing provisions.

The Federal Council sets standard security requirements and defines standard measures regarding organization, personnel, construction, as well as technical measures, to ensure information security; it takes into account advancements in knowledge and technology for this purpose.

It may delegate this task.

The Federal Council's standard requirements and measures hold the value of recommendations, unless the authorities subject to this Act declare them mandatory.

The Federal Council sets standard security requirements and defines standard measures regarding organization, personnel, construction, as well as technical measures, to ensure information security; it takes into account advancements in knowledge and technology for this purpose.

It may delegate this task.

The Federal Council's standard requirements and measures hold the value of recommendations, unless the authorities subject to this Act declare them mandatory.

The cantons shall ensure the periodic review of the implementation and effectiveness of the information security referred to in Art. 3.

They shall inform the Confederation's specialized information security service of the results of the reviews referred to in para. 1.

They shall designate the service that acts as the point of contact for the authorities subject to this law concerning information security matters.

The Federal Council shall define the cases in which the cantons may call upon the services of the specialized services referred to in this law to ensure their own information security. These services are subject to fees. The amount of these fees is determined by the Federal Council.

The cantons shall ensure the periodic review of the implementation and effectiveness of the information security referred to in Art. 3.

They shall inform the Confederation's specialized information security service of the results of the reviews referred to in para. 1.

They shall designate the service that acts as the point of contact for the authorities subject to this law concerning information security matters.

The Federal Council shall define the cases in which the cantons may call upon the services of the specialized services referred to in this law to ensure their own information security. These services are subject to fees. The amount of these fees is determined by the Federal Council.

The Federal Council may conclude international treaties in the field of information security concerning the following subjects: a. the exchange of information on threats, vulnerabilities, and incidents in the field of information security, particularly within critical infrastructures; b. the exchange of classified information; c. the conduct of security checks related to individuals and security procedures related to enterprises; d. the recognition of security declarations; e. the execution of controls.

The Federal Council may conclude international treaties in the field of information security concerning the following subjects: a. the exchange of information on threats, vulnerabilities, and incidents in the field of information security, particularly within critical infrastructures; b. the exchange of classified information; c. the conduct of security checks related to individuals and security procedures related to enterprises; d. the recognition of security declarations; e. the execution of controls.

The Federal Council shall ensure that the implementation, adequacy, effectiveness, and efficiency of this Act are periodically reviewed by an independent body, particularly by the Swiss Federal Audit Office.

It shall report regularly to the competent committees of the Federal Assembly.

The Federal Council shall ensure that the implementation, adequacy, effectiveness, and efficiency of this Act are periodically reviewed by an independent body, particularly by the Swiss Federal Audit Office.

It shall report regularly to the competent committees of the Federal Assembly.

The amendment of other acts is governed in Annex 1.

The amendment of other acts is governed in Annex 1.

Classified information according to the former law shall be adapted to the classification rules of the new law upon their first handling following the entry into force of this Act.

Information technology systems must be classified within two years from the entry into force of this Act. Technical measures to ensure information security must be implemented within six years from the entry into force of this Act.

Declarations concerning personal security and declarations concerning corporate security rendered under the former law remain valid for five years from their issuance.

Classified information according to the former law shall be adapted to the classification rules of the new law upon their first handling following the entry into force of this Act.

Information technology systems must be classified within two years from the entry into force of this Act. Technical measures to ensure information security must be implemented within six years from the entry into force of this Act.

Declarations concerning personal security and declarations concerning corporate security rendered under the former law remain valid for five years from their issuance.

The coordination of this Act with other statutes is governed in Annex 2.

The coordination of this Act with other statutes is governed in Annex 2.

This law is subject to a referendum.

The Federal Council determines the date of entry into force. Date of entry into force: Art. 87: May 1, 2022 Other provisions: January 1, 2024

This law is subject to a referendum.

The Federal Council determines the date of entry into force. Date of entry into force: Art. 87: May 1, 2022 Other provisions: January 1, 2024