Ordinance of November 8, 2023, on Information Security in the Federal Administration and the Military (OSI) - Purpose (ISV)

This ordinance governs the tasks, responsibilities, competencies, and procedures that ensure information security within the federal administration and the military.

This ordinance governs the tasks, responsibilities, competencies, and procedures that ensure information security within the federal administration and the military.

This ordinance applies to: a. the Federal Council; b. the departments; c. the Federal Chancellery (ChF), the general secretariats, the groups, and the federal offices; d. the armed forces.

The following provisions of the LSI and this ordinance apply to units of the decentralized federal administration within the meaning of Art. 2, para. 3, of the March 21, 1997, Act on the Organization of the Government and Administration (LOGA) and to the organizations and persons referred to in Art. 2, para. 4, LOGA: a. Articles 5, 6, 9, 10, 12 to 15, 20 to 23, and 27 to 73 LSI and Articles 16, 21, 24, 26, 32, 34, and 35 of this ordinance, when dealing with classified information of the Confederation; b. Articles 5, 6, 9, 10, and 16 to 73 LSI and 10 to 12, 27, and 29 to 35 of this ordinance, when accessing the computer resources of internal service providers referred to in Art. 10 of the April 2, 2025, Ordinance on Digitization (ONum) or delegating the operation of their computer resources to these providers.

The ChF and the departments may, within their area of responsibility, subject the units of the decentralized federal administration that constantly perform sensitive activities to all provisions of the LSI.

The following provisions of this ordinance apply to the cantons, subject to Art. 3, para. 2, LSI: a. the provisions of Section 4, when processing classified information of the Confederation; b. Articles 28 to 30 and 34, when accessing the computer resources of the Confederation.

The Defense Group assumes for the army the tasks, competences, and responsibilities that this ordinance assigns to the administrative units referred to in Art. 2, para. 1, letter c.

This ordinance applies to: a. the Federal Council; b. the departments; c. the Federal Chancellery (ChF), the general secretariats, the groups, and the federal offices; d. the armed forces.

The following provisions of the LSI and this ordinance apply to units of the decentralized federal administration within the meaning of Art. 2, para. 3, of the March 21, 1997, Act on the Organization of the Government and Administration (LOGA) and to the organizations and persons referred to in Art. 2, para. 4, LOGA: a. Articles 5, 6, 9, 10, 12 to 15, 20 to 23, and 27 to 73 LSI and Articles 16, 21, 24, 26, 32, 34, and 35 of this ordinance, when dealing with classified information of the Confederation; b. Articles 5, 6, 9, 10, and 16 to 73 LSI and 10 to 12, 27, and 29 to 35 of this ordinance, when accessing the computer resources of internal service providers referred to in Art. 10 of the April 2, 2025, Ordinance on Digitization (ONum) or delegating the operation of their computer resources to these providers.

The ChF and the departments may, within their area of responsibility, subject the units of the decentralized federal administration that constantly perform sensitive activities to all provisions of the LSI.

The following provisions of this ordinance apply to the cantons, subject to Art. 3, para. 2, LSI: a. the provisions of Section 4, when processing classified information of the Confederation; b. Articles 28 to 30 and 34, when accessing the computer resources of the Confederation.

The Defense Group assumes for the army the tasks, competences, and responsibilities that this ordinance assigns to the administrative units referred to in Art. 2, para. 1, letter c.

The organizations referred to in Art. 2, para. 1, shall collectively ensure the protection of their information and IT resources based on risk and demonstrate appropriate resilience against information security risks.

They shall contribute to improving Switzerland's information security by collaborating and exchanging information with other federal authorities, the cantons, the municipalities, economic sectors, society, the scientific community, and international partners.

They shall work towards the harmonization, on both national and international levels, of security requirements and standards to facilitate the interaction of federal authorities with other Confederation authorities as well as with the cantons, municipalities, and international partners.

The organizations referred to in Art. 2, para. 1, shall collectively ensure the protection of their information and IT resources based on risk and demonstrate appropriate resilience against information security risks.

They shall contribute to improving Switzerland's information security by collaborating and exchanging information with other federal authorities, the cantons, the municipalities, economic sectors, society, the scientific community, and international partners.

They shall work towards the harmonization, on both national and international levels, of security requirements and standards to facilitate the interaction of federal authorities with other Confederation authorities as well as with the cantons, municipalities, and international partners.

Administrative units are responsible for the protection of the information they process or delegate for processing and for the security of the IT resources they operate themselves or have operated by third parties.

They undertake all tasks within their area of competence that this ordinance or other provisions of federal law do not assign to another organization or service.

Employees of the federal administration and military personnel who handle information or use the Confederation's IT resources are responsible for complying with the relevant regulations.

Superiors at all levels are responsible for the information security training of their employees and the military personnel subordinate to them according to their tasks and ensure that they comply with the regulations.

Administrative units are responsible for the protection of the information they process or delegate for processing and for the security of the IT resources they operate themselves or have operated by third parties.

They undertake all tasks within their area of competence that this ordinance or other provisions of federal law do not assign to another organization or service.

Employees of the federal administration and military personnel who handle information or use the Confederation's IT resources are responsible for complying with the relevant regulations.

Superiors at all levels are responsible for the information security training of their employees and the military personnel subordinate to them according to their tasks and ensure that they comply with the regulations.

The administrative units referred to in Art. 2, Para. 1, let. c, shall each establish an Information Security Management System (ISMS).

They shall set objectives for their ISMS, verify annually whether these objectives have been achieved, and collect the necessary indicators for this purpose.

They shall have their ISMS audited at least every three years by an independent service or by their department and ensure the continuous improvement of the system.

They shall coordinate their ISMS with regular risk management, business continuity management, and crisis management.

The administrative units referred to in Art. 2, Para. 1, let. c, shall each establish an Information Security Management System (ISMS).

They shall set objectives for their ISMS, verify annually whether these objectives have been achieved, and collect the necessary indicators for this purpose.

They shall have their ISMS audited at least every three years by an independent service or by their department and ensure the continuous improvement of the system.

They shall coordinate their ISMS with regular risk management, business continuity management, and crisis management.

The administrative units referred to in Art. 2, para. 1, letter c, the departments, and the Confederation's specialized service for information security shall establish and maintain an up-to-date list of the relevant legal bases for their area of competence and their contractual obligations concerning information security.

The administrative units referred to in Art. 2, para. 1, letter c, the departments, and the Confederation's specialized service for information security shall establish and maintain an up-to-date list of the relevant legal bases for their area of competence and their contractual obligations concerning information security.

The administrative units referred to in Art. 2, para. 1, let. c, shall compile and maintain an inventory of their protected objects.

By protected objects, it is understood as independent objects, several objects of the same nature, or related objects: a. collections of information processed for the purpose of executing a business process of the Confederation; b. IT resources referred to in Art. 5, let. a, Information Security Law (LSI).

The inventory shall mention: a. the need for protection of the protected objects; b. the responsibilities linked to the protected objects; c. the involvement of third parties; d. the result of the risk assessment; e. the implementation of security measures and the acceptance of risks that cannot be sufficiently mitigated (residual risks); f. the periodic controls and audits; g. if applicable, the shared use of the protected objects.

The administrative units referred to in Art. 2, para. 1, let. c, shall compile and maintain an inventory of their protected objects.

By protected objects, it is understood as independent objects, several objects of the same nature, or related objects: a. collections of information processed for the purpose of executing a business process of the Confederation; b. IT resources referred to in Art. 5, let. a, Information Security Law (LSI).

The inventory shall mention: a. the need for protection of the protected objects; b. the responsibilities linked to the protected objects; c. the involvement of third parties; d. the result of the risk assessment; e. the implementation of security measures and the acceptance of risks that cannot be sufficiently mitigated (residual risks); f. the periodic controls and audits; g. if applicable, the shared use of the protected objects.

The administrative units referred to in Art. 2, para. 1, let. c, continuously assess the risks to their assets requiring protection and undertake the following tasks in particular

a. they regularly analyze threats and vulnerabilities and assess their impact on the assets requiring protection;

b. they implement necessary measures and monitor their effects;

c. they ensure compliance with guidelines;

d. they demonstrate acceptance of residual risks.

The specialized service of the Confederation for information security, the Federal Cybersecurity Office (OFCS), the administrative units that provide services, and the security bodies of the Confederation inform the administrative units referred to in Art. 2, para. 1, let. c, and the departments about current threats, vulnerabilities, and the risks affecting them. They recommend risk mitigation measures as necessary.

The administrative units referred to in Art. 2, para. 1, let. c, report on their information security risks within the framework of the usual risk management process in accordance with the guidelines of the Federal Finance Administration.

The administrative units referred to in Art. 2, para. 1, let. c, continuously assess the risks to their assets requiring protection and undertake the following tasks in particular

a. they regularly analyze threats and vulnerabilities and assess their impact on the assets requiring protection;

b. they implement necessary measures and monitor their effects;

c. they ensure compliance with guidelines;

d. they demonstrate acceptance of residual risks.

The specialized service of the Confederation for information security, the Federal Cybersecurity Office (OFCS), the administrative units that provide services, and the security bodies of the Confederation inform the administrative units referred to in Art. 2, para. 1, let. c, and the departments about current threats, vulnerabilities, and the risks affecting them. They recommend risk mitigation measures as necessary.

The administrative units referred to in Art. 2, para. 1, let. c, report on their information security risks within the framework of the usual risk management process in accordance with the guidelines of the Federal Finance Administration.

If an administrative unit is unable to comply with a binding instruction from a general and abstract directive referred to in Art. 85 of the LSI (Information Security Law) concerning a protected object, it must obtain a special authorization from the service that issued the directive.

If an exception within the competence of the Federal Specialist Service for Information Security also concerns directives from the FCh on digital transformation and IT governance, the specialist service shall consult the TNI delegate beforehand.

The administrative units referred to in Art. 2, para. 1, let. c, the departments, and the Federal Specialist Service for Information Security shall establish the list of their current special authorizations.

If an administrative unit is unable to comply with a binding instruction from a general and abstract directive referred to in Art. 85 of the LSI (Information Security Law) concerning a protected object, it must obtain a special authorization from the service that issued the directive.

If an exception within the competence of the Federal Specialist Service for Information Security also concerns directives from the FCh on digital transformation and IT governance, the specialist service shall consult the TNI delegate beforehand.

The administrative units referred to in Art. 2, para. 1, let. c, the departments, and the Federal Specialist Service for Information Security shall establish the list of their current special authorizations.

The administrative units referred to in Art. 2, para. 1, let. c, assess the risks to their objects to be protected during collaboration with third parties and their dependency on third parties. The central procurement services referred to in Art. 5 of the Ordinance of May 1, 2024, on the Organization of Public Procurement for the Federal Administration (Org-OMP) collaborate in the assessment and provide the necessary information. The Federal Office for Information Security, after consulting the OFCS and the Federal Procurement Conference referred to in Art. 30 Org OMP, issues recommendations regarding the information security provisions to be included in all procurement or service contracts of the Confederation.

The administrative units referred to in Art. 2, para. 1, let. c, assess the risks to their objects to be protected during collaboration with third parties and their dependency on third parties. The central procurement services referred to in Art. 5 of the Ordinance of May 1, 2024, on the Organization of Public Procurement for the Federal Administration (Org-OMP) collaborate in the assessment and provide the necessary information. The Federal Office for Information Security, after consulting the OFCS and the Federal Procurement Conference referred to in Art. 30 Org OMP, issues recommendations regarding the information security provisions to be included in all procurement or service contracts of the Confederation.

The administrative units referred to in Art. 2, para. 1, let. c, shall train their employees upon their entry into service and periodically thereafter, ensuring that they can fulfill their responsibilities concerning information security. They shall establish a list of training programs and participants.

The training covers, in particular: a. the correct identification of the need for information protection; b. the safe use of information and IT resources; c. the correct response in the event of a suspected security incident; d. knowledge of the security organization and points of contact for information security-related queries; e. supervisory control tasks; f. the implementation of information security in projects and operations.

The administrative units referred to in Art. 2, para. 1, let. c, the departments, and the Federal Information Security Competence Center shall ensure regular awareness among employees at all levels of the risks to information security.

The Federal Information Security Competence Center shall develop training and awareness tools.

The administrative units referred to in Art. 2, para. 1, let. c, shall train their employees upon their entry into service and periodically thereafter, ensuring that they can fulfill their responsibilities concerning information security. They shall establish a list of training programs and participants.

The training covers, in particular: a. the correct identification of the need for information protection; b. the safe use of information and IT resources; c. the correct response in the event of a suspected security incident; d. knowledge of the security organization and points of contact for information security-related queries; e. supervisory control tasks; f. the implementation of information security in projects and operations.

The administrative units referred to in Art. 2, para. 1, let. c, the departments, and the Federal Information Security Competence Center shall ensure regular awareness among employees at all levels of the risks to information security.

The Federal Information Security Competence Center shall develop training and awareness tools.

The administrative units referred to in Art. 2, para. 1, letter c, shall, in agreement with their service providers, establish the manner in which incidents and security breaches are reported, controlled or addressed. They shall regulate the authority to order immediate measures.

If a service provider discovers incidents or security breaches concerning an administrative unit to which it provides services, it shall immediately report them to the unit and assist in controlling or addressing them.

The Federal Confederation's specialized service for information security and the OFCS may assist the administrative units referred to in Art. 2, para. 1, letter c, and the departments in controlling security incidents and addressing security breaches.

The administrative units referred to in Art. 2, para. 1, letter c, shall verify during the management of security incidents whether it is necessary to report to the Federal Data Protection and Information Commissioner under data protection legislation.

They shall immediately inform their department and the specialized service of the Federal Confederation for information security of the incident or security breach if one of the following conditions is met: a. the operation of the federal administration could be compromised; b. an IT asset subject to the "high protection" or "very high protection" security categories is involved; c. multiple departments could be affected; d. the protection of classified information of a state or an international organization with which the Federal Council has concluded an international treaty pursuant to Art. 87 LSI could be threatened; e. the incident or security breach could have significant political importance; f. the incident or security breach requires measures departing from the procedure set in para. 1.

The Federal Confederation's specialized service for information security shall assess the risk and the required support with the concerned administrative unit.

In the cases referred to in para. 5, it may, in agreement with the concerned administrative unit and department, direct the operations to control the security incident or manage the security breach, or delegate the direction to the OFCS with its approval. In this context, they have the following tasks and competences: a. they may require administrative units, service providers, and relevant third parties to provide all necessary information; b. they may order immediate measures; c. they may seek assistance from external specialists; d. they shall inform the management of the concerned administrative units and departments of the progress of the operations.

When information security has been restored following an incident or security breach and the necessary follow-up work and its funding have been determined, the Federal Confederation's specialized service for information security or the OFCS shall return the direction of operations to the concerned administrative unit.

The administrative units referred to in Art. 2, para. 1, letter c, shall, in agreement with their service providers, establish the manner in which incidents and security breaches are reported, controlled or addressed. They shall regulate the authority to order immediate measures.

If a service provider discovers incidents or security breaches concerning an administrative unit to which it provides services, it shall immediately report them to the unit and assist in controlling or addressing them.

The Federal Confederation's specialized service for information security and the OFCS may assist the administrative units referred to in Art. 2, para. 1, letter c, and the departments in controlling security incidents and addressing security breaches.

The administrative units referred to in Art. 2, para. 1, letter c, shall verify during the management of security incidents whether it is necessary to report to the Federal Data Protection and Information Commissioner under data protection legislation.

They shall immediately inform their department and the specialized service of the Federal Confederation for information security of the incident or security breach if one of the following conditions is met: a. the operation of the federal administration could be compromised; b. an IT asset subject to the "high protection" or "very high protection" security categories is involved; c. multiple departments could be affected; d. the protection of classified information of a state or an international organization with which the Federal Council has concluded an international treaty pursuant to Art. 87 LSI could be threatened; e. the incident or security breach could have significant political importance; f. the incident or security breach requires measures departing from the procedure set in para. 1.

The Federal Confederation's specialized service for information security shall assess the risk and the required support with the concerned administrative unit.

In the cases referred to in para. 5, it may, in agreement with the concerned administrative unit and department, direct the operations to control the security incident or manage the security breach, or delegate the direction to the OFCS with its approval. In this context, they have the following tasks and competences: a. they may require administrative units, service providers, and relevant third parties to provide all necessary information; b. they may order immediate measures; c. they may seek assistance from external specialists; d. they shall inform the management of the concerned administrative units and departments of the progress of the operations.

When information security has been restored following an incident or security breach and the necessary follow-up work and its funding have been determined, the Federal Confederation's specialized service for information security or the OFCS shall return the direction of operations to the concerned administrative unit.

The administrative units referred to in Art. 2, para. 1, let. c, and the departments shall establish an annual plan for control and audit, determining how to risk-based control compliance with the provisions of this ordinance and the effectiveness of measures ensuring information security in their area of competence and with third parties engaged.

Audits conducted with third parties possessing a security declaration related to enterprises as referred to in Art. 61 of the Information Security Act (LSI) must be coordinated with the specialized service responsible for carrying out the enterprise security procedure.

The specialized service of the Confederation for information security gathers the need for control and audit to ensure information security throughout the entire federal administration and the military.

It may, in agreement with the Federal Chancellery or the responsible department, conduct audits or assign their execution to the Federal Audit Office.

The administrative units referred to in Art. 2, para. 1, let. c, and the departments shall establish an annual plan for control and audit, determining how to risk-based control compliance with the provisions of this ordinance and the effectiveness of measures ensuring information security in their area of competence and with third parties engaged.

Audits conducted with third parties possessing a security declaration related to enterprises as referred to in Art. 61 of the Information Security Act (LSI) must be coordinated with the specialized service responsible for carrying out the enterprise security procedure.

The specialized service of the Confederation for information security gathers the need for control and audit to ensure information security throughout the entire federal administration and the military.

It may, in agreement with the Federal Chancellery or the responsible department, conduct audits or assign their execution to the Federal Audit Office.

The FCh, the departments, the FOCBS, and the internal IT service providers referred to in Art. 10 ONum report annually to the Confederation’s specialized service for information security on the state of information security in their area of responsibility. They gather the necessary information from the administrative units and their service providers.

The Confederation’s specialized service for information security reports annually to the Federal Council on the state of information security within the Confederation.

It coordinates the reports with the authorities referred to in Art. 2, para. 1, LSI.

The FCh, the departments, the FOCBS, and the internal IT service providers referred to in Art. 10 ONum report annually to the Confederation’s specialized service for information security on the state of information security in their area of responsibility. They gather the necessary information from the administrative units and their service providers.

The Confederation’s specialized service for information security reports annually to the Federal Council on the state of information security within the Confederation.

It coordinates the reports with the authorities referred to in Art. 2, para. 1, LSI.

The specialized federal service for information security issues general and abstract guidelines applicable to all organizations referred to in Art. 2, para. 1 and 3, concerning the minimum requirements that the information security management outlined in Art. 5 to 14 must meet.

The specialized federal service for information security issues general and abstract guidelines applicable to all organizations referred to in Art. 2, para. 1 and 3, concerning the minimum requirements that the information security management outlined in Art. 5 to 14 must meet.

The communication and provision of classified information, as well as the creation of classified information carriers, should be limited as much as possible.

If information is consolidated into a collection, the classification must be reassessed.

The communication and provision of classified information, as well as the creation of classified information carriers, should be limited as much as possible.

If information is consolidated into a collection, the classification must be reassessed.

The administrative units referred to in Art. 2, para. 1, let. c, and the departments establish in a classification catalog the method of classifying information frequently handled within their area of competence and the duration of the classification.

The Confederation's specialized information security service reviews the classification catalogs and issues recommendations if necessary.

After consulting the Conference of Information Security Officers, it sets out in general and abstract guidelines applicable to all organizations referred to in Art. 2, para. 1 to 3, the method of classifying information frequently handled by several departments and the duration of the classification.

The following persons and services are competent to classify and declassify information not listed in the classification catalogs: a. Confederation staff and military personnel; b. contracting authorities, when Confederation information is processed by third parties.

Confederation staff, military personnel, and third parties are responsible for formally marking the information carriers they produce or the information they communicate orally.

The administrative units referred to in Art. 2, para. 1, let. c, and the departments establish in a classification catalog the method of classifying information frequently handled within their area of competence and the duration of the classification.

The Confederation's specialized information security service reviews the classification catalogs and issues recommendations if necessary.

After consulting the Conference of Information Security Officers, it sets out in general and abstract guidelines applicable to all organizations referred to in Art. 2, para. 1 to 3, the method of classifying information frequently handled by several departments and the duration of the classification.

The following persons and services are competent to classify and declassify information not listed in the classification catalogs: a. Confederation staff and military personnel; b. contracting authorities, when Confederation information is processed by third parties.

Confederation staff, military personnel, and third parties are responsible for formally marking the information carriers they produce or the information they communicate orally.

Information that could harm, in the following ways, the interests defined in Art. 1, para. 2, let. a to d, of the Information Security Act (LSI), if disclosed to an unauthorized person, are classified as "internal": a. a significant business process of the Federal Council or the federal administration or a major command process of the military is impeded; b. the fulfillment of commitments by law enforcement authorities, the Federal Intelligence Service (FIS), the military, or other Confederation security bodies is obstructed; c. individuals suffer bodily harm; d. nuclear safety or the security of nuclear facilities or materials is indirectly compromised; e. Switzerland suffers a disadvantage in foreign policy or economic affairs; f. relations between the Confederation and the cantons or between the cantons are disrupted.

Information that allows conclusions to be drawn about information classified as "confidential" or "secret" is also classified as "internal" if disclosed to an unauthorized person.

Information that could harm, in the following ways, the interests defined in Art. 1, para. 2, let. a to d, of the Information Security Act (LSI), if disclosed to an unauthorized person, are classified as "internal": a. a significant business process of the Federal Council or the federal administration or a major command process of the military is impeded; b. the fulfillment of commitments by law enforcement authorities, the Federal Intelligence Service (FIS), the military, or other Confederation security bodies is obstructed; c. individuals suffer bodily harm; d. nuclear safety or the security of nuclear facilities or materials is indirectly compromised; e. Switzerland suffers a disadvantage in foreign policy or economic affairs; f. relations between the Confederation and the cantons or between the cantons are disrupted.

Information that allows conclusions to be drawn about information classified as "confidential" or "secret" is also classified as "internal" if disclosed to an unauthorized person.

Information that can significantly harm the interests defined in Art. 1, para. 2, let. a to d, of the ISI if brought to the attention of unauthorized persons is classified as "confidential": a. the decision-making and operational capacity of the Federal Council, the Parliament, several administrative units, or several army troops are hindered for several days; b. the execution of operations by law enforcement authorities, the FIS, the military, or other federal security organs according to objectives is compromised; c. operational means and methods of intelligence services and federal law enforcement authorities or the identity of sources and exposed individuals are disclosed; d. public safety is compromised for several days or individuals or groups of individuals die; e. nuclear safety or the security of nuclear facilities or materials are compromised; f. the country's economic supply or the operation of critical infrastructures are hindered; g. Switzerland suffers a significant disadvantage in terms of foreign policy or economy, or diplomatic relations with a state or an international organization are broken; h. Switzerland's position is temporarily considerably weakened during negotiations on important foreign policy matters.

Information that can significantly harm the interests defined in Art. 1, para. 2, let. a to d, of the ISI if brought to the attention of unauthorized persons is classified as "confidential": a. the decision-making and operational capacity of the Federal Council, the Parliament, several administrative units, or several army troops are hindered for several days; b. the execution of operations by law enforcement authorities, the FIS, the military, or other federal security organs according to objectives is compromised; c. operational means and methods of intelligence services and federal law enforcement authorities or the identity of sources and exposed individuals are disclosed; d. public safety is compromised for several days or individuals or groups of individuals die; e. nuclear safety or the security of nuclear facilities or materials are compromised; f. the country's economic supply or the operation of critical infrastructures are hindered; g. Switzerland suffers a significant disadvantage in terms of foreign policy or economy, or diplomatic relations with a state or an international organization are broken; h. Switzerland's position is temporarily considerably weakened during negotiations on important foreign policy matters.

Information that could severely harm the interests defined in Art. 1, para. 2, let. a to d, LSI if disclosed to an unauthorized person are classified as "secret": a. the decision-making and operational capacity of the Federal Council, the Parliament, several administrative units, or multiple army units are nullified for days or impeded for weeks; b. the execution of strategically important operations by law enforcement authorities, the SRC, the army, or other federal security agencies is compromised or impeded significantly for days; c. strategic sources, the identity of particularly exposed individuals, or the strategic means and methods of the intelligence services and federal law enforcement authorities are disclosed; d. public safety is significantly compromised for weeks, or a large number of people die; e. nuclear security or the safety of nuclear facilities or materials is compromised to a particularly significant extent; f. the country’s economic supply or the operation of critical infrastructures is not assured for days; g. Switzerland faces particularly severe consequences in foreign policy or economic terms for weeks, such as embargoes or sanctions; h. Switzerland's position is weakened in negotiations on strategic foreign policy matters for years.

Information that could severely harm the interests defined in Art. 1, para. 2, let. a to d, LSI if disclosed to an unauthorized person are classified as "secret": a. the decision-making and operational capacity of the Federal Council, the Parliament, several administrative units, or multiple army units are nullified for days or impeded for weeks; b. the execution of strategically important operations by law enforcement authorities, the SRC, the army, or other federal security agencies is compromised or impeded significantly for days; c. strategic sources, the identity of particularly exposed individuals, or the strategic means and methods of the intelligence services and federal law enforcement authorities are disclosed; d. public safety is significantly compromised for weeks, or a large number of people die; e. nuclear security or the safety of nuclear facilities or materials is compromised to a particularly significant extent; f. the country’s economic supply or the operation of critical infrastructures is not assured for days; g. Switzerland faces particularly severe consequences in foreign policy or economic terms for weeks, such as embargoes or sanctions; h. Switzerland's position is weakened in negotiations on strategic foreign policy matters for years.

The Confederation’s specialized service for information security issues general and abstract guidelines applicable to all organizations referred to in Art. 2, para. 1 to 3, that pertain to the handling of classified information, and sets the minimum security requirements regarding organization, personnel, construction, as well as technical aspects. In doing so, it takes into account the relevant international standards.

It consults the following services in advance: a. the Federal Office for Civil Protection (OFCS); b. the Army’s Cryptographic Service; c. the Federal Office for Armaments (armasuisse); d. the bodies of the federal administration and the army responsible for object security.

The Federal Chancellery regulates the handling of the Federal Council's classified matters.

The handling of classified information from abroad is governed by the regulations corresponding to the foreign classification level. Different provisions set forth in an international treaty referred to in Art. 87 of the Information Security Law (LSI) are reserved.

The Confederation’s specialized service for information security issues general and abstract guidelines applicable to all organizations referred to in Art. 2, para. 1 to 3, that pertain to the handling of classified information, and sets the minimum security requirements regarding organization, personnel, construction, as well as technical aspects. In doing so, it takes into account the relevant international standards.

It consults the following services in advance: a. the Federal Office for Civil Protection (OFCS); b. the Army’s Cryptographic Service; c. the Federal Office for Armaments (armasuisse); d. the bodies of the federal administration and the army responsible for object security.

The Federal Chancellery regulates the handling of the Federal Council's classified matters.

The handling of classified information from abroad is governed by the regulations corresponding to the foreign classification level. Different provisions set forth in an international treaty referred to in Art. 87 of the Information Security Law (LSI) are reserved.

If classified information is processed within the framework of an engagement or operation and is accessible only to a clearly identifiable circle of users, the following persons may, after consulting the Federal Information Security Specialist Service, establish specific directives for the engagement or operation aimed at simplifying the processing: a. the Director of the Federal Police Office; b. the Director of the SRC; c. the Chief of the Armed Forces; d. the Chief of the Operations Command; e. the Director of the Federal Office of Customs and Border Security.

The persons referred to in para. 1 shall ensure that it is clearly indicated on the information carriers that the simplified processing prescriptions apply.

The directives relating to processing referred to in Art. 21 apply outside the circle of users and to the preservation of information for archival purposes.

If classified information is processed within the framework of an engagement or operation and is accessible only to a clearly identifiable circle of users, the following persons may, after consulting the Federal Information Security Specialist Service, establish specific directives for the engagement or operation aimed at simplifying the processing: a. the Director of the Federal Police Office; b. the Director of the SRC; c. the Chief of the Armed Forces; d. the Chief of the Operations Command; e. the Director of the Federal Office of Customs and Border Security.

The persons referred to in para. 1 shall ensure that it is clearly indicated on the information carriers that the simplified processing prescriptions apply.

The directives relating to processing referred to in Art. 21 apply outside the circle of users and to the preservation of information for archival purposes.

IT equipment is certified for security purposes before being put into operation if it is necessary for national or international collaboration.

The security certification is carried out by the Federal Information Security Service, after consultation with the army's cryptographic service and armasuisse.

It certifies that the IT equipment meets the minimum requirements corresponding to the relevant classification level and that the residual risks are acceptable based on the current state of technical knowledge.

It is repeated in the event of significant changes concerning the risks or the IT equipment.

The Federal Department of Defence, Civil Protection and Sport (DDPS) establishes the procedure for security certification, taking into account international standards in this field.

IT equipment is certified for security purposes before being put into operation if it is necessary for national or international collaboration.

The security certification is carried out by the Federal Information Security Service, after consultation with the army's cryptographic service and armasuisse.

It certifies that the IT equipment meets the minimum requirements corresponding to the relevant classification level and that the residual risks are acceptable based on the current state of technical knowledge.

It is repeated in the event of significant changes concerning the risks or the IT equipment.

The Federal Department of Defence, Civil Protection and Sport (DDPS) establishes the procedure for security certification, taking into account international standards in this field.

Anyone who becomes aware that classified information has been compromised, has disappeared, or has been misused, or that information has not been classified when it should have been, or has been incorrectly classified, shall take the necessary protective measures.

They shall immediately inform the author of the classification and the relevant security bodies.

Anyone who becomes aware that classified information has been compromised, has disappeared, or has been misused, or that information has not been classified when it should have been, or has been incorrectly classified, shall take the necessary protective measures.

They shall immediately inform the author of the classification and the relevant security bodies.

The authors of the classification shall review the protection needs of their classified information and the circle of authorized persons at least every five years and systematically examine them when the information is submitted to the Federal Archives.

The authors of the classification shall review the protection needs of their classified information and the circle of authorized persons at least every five years and systematically examine them when the information is submitted to the Federal Archives.

The archiving of classified information is governed by the provisions of federal archiving legislation.

The Federal Archives ensure that the information security addressed in this ordinance is guaranteed.

The archives cease to be classified once the protection period has expired. The extension of the protection period is governed by Art. 14 of the Ordinance of 8 September 1999 on Archiving.

The archiving of classified information is governed by the provisions of federal archiving legislation.

The Federal Archives ensure that the information security addressed in this ordinance is guaranteed.

The archives cease to be classified once the protection period has expired. The extension of the protection period is governed by Art. 14 of the Ordinance of 8 September 1999 on Archiving.

The administrative units referred to in Art. 2, para. 1, letter c, must demonstrate the need for protection of their assets and their importance for continuity of business management.

They implement the minimum guidelines for the various security categories and verify whether additional security measures are necessary.

They demonstrate the residual risks.

The information security officers (Art. 36) decide if the residual risks are acceptable. They may delegate this decision to other members of management.

The security procedure is repeated in case of significant changes concerning threats, technology, tasks, or the organization’s situation.

The administrative units referred to in Art. 2, para. 1, letter c, check annually if a significant change has occurred.

The Federal Specialist Service for Information Security issues general and abstract guidelines applicable to all organizations referred to in Art. 2, para. 1 to 3, addressing the security procedure mentioned in Art. 16 LSI.

The administrative units referred to in Art. 2, para. 1, letter c, must demonstrate the need for protection of their assets and their importance for continuity of business management.

They implement the minimum guidelines for the various security categories and verify whether additional security measures are necessary.

They demonstrate the residual risks.

The information security officers (Art. 36) decide if the residual risks are acceptable. They may delegate this decision to other members of management.

The security procedure is repeated in case of significant changes concerning threats, technology, tasks, or the organization’s situation.

The administrative units referred to in Art. 2, para. 1, letter c, check annually if a significant change has occurred.

The Federal Specialist Service for Information Security issues general and abstract guidelines applicable to all organizations referred to in Art. 2, para. 1 to 3, addressing the security procedure mentioned in Art. 16 LSI.

The security category "High Protection" is assigned to an IT resource when a security breach is likely to cause harm as specified in Art. 19 or a damage ranging from 50 to 500 million francs.

The security category "Very High Protection" is assigned to an IT resource when a security breach is likely to cause harm as specified in Art. 20 or damage exceeding 500 million francs.

The security category "High Protection" is assigned to an IT resource when a security breach is likely to cause harm as specified in Art. 19 or a damage ranging from 50 to 500 million francs.

The security category "Very High Protection" is assigned to an IT resource when a security breach is likely to cause harm as specified in Art. 20 or damage exceeding 500 million francs.

The specialized service of the Confederation for information security issues general and abstract directives applicable to all organizations referred to in Art. 2, para. 1 to 3, concerning the minimum requirements for the security categories referred to in Art. 17 LSI.

It takes into account the requirements regarding the security of personal data according to data protection legislation, as well as other information that the Confederation must protect under its legal or contractual obligations.

The effectiveness of the security measures applicable to the following IT resources must be verified before being put into operation, as well as during operation in case of significant changes in risks, but at least every five years: a. IT resources of the "high protection" security category used for tasks exceeding the scope of an authority or a department; b. IT resources of the "very high protection" security category.

The Federal Chancellery (ChF) and the departments integrate their "very high protection" security category IT resources into their continuity management.

The specialized service of the Confederation for information security issues general and abstract directives applicable to all organizations referred to in Art. 2, para. 1 to 3, concerning the minimum requirements for the security categories referred to in Art. 17 LSI.

It takes into account the requirements regarding the security of personal data according to data protection legislation, as well as other information that the Confederation must protect under its legal or contractual obligations.

The effectiveness of the security measures applicable to the following IT resources must be verified before being put into operation, as well as during operation in case of significant changes in risks, but at least every five years: a. IT resources of the "high protection" security category used for tasks exceeding the scope of an authority or a department; b. IT resources of the "very high protection" security category.

The Federal Chancellery (ChF) and the departments integrate their "very high protection" security category IT resources into their continuity management.

The administrative units referred to in Art. 2, para. 1, let. c, ensure that the responsibilities concerning information security at the operational level are documented in the project agreements and performance agreements concluded with internal service providers.

The internal service providers make available to the administrative units referred to in Art. 2, para. 1, let. c, the departments, and the Confederation's specialized service for information security, the information they require to ensure information security.

They ensure that they have, in terms of personnel and finances, the necessary capacities and skills for the early detection, technical analysis, control, or handling of incidents and security breaches that concern them or concern the beneficiaries of their services within the framework of the agreements and conventions referred to in para. 1.

They monitor the use of their IT infrastructure and regularly examine it for threats and technical vulnerabilities. They may assign third parties to conduct this examination.

The processing of personal data within the framework of the monitoring and examination referred to in para. 4 is governed by the Ordinance of February 22, 2012, on the Processing of Personal Data and Data of Legal Entities when Using the Confederation's Electronic Infrastructure.

The administrative units referred to in Art. 2, para. 1, let. c, ensure that the responsibilities concerning information security at the operational level are documented in the project agreements and performance agreements concluded with internal service providers.

The internal service providers make available to the administrative units referred to in Art. 2, para. 1, let. c, the departments, and the Confederation's specialized service for information security, the information they require to ensure information security.

They ensure that they have, in terms of personnel and finances, the necessary capacities and skills for the early detection, technical analysis, control, or handling of incidents and security breaches that concern them or concern the beneficiaries of their services within the framework of the agreements and conventions referred to in para. 1.

They monitor the use of their IT infrastructure and regularly examine it for threats and technical vulnerabilities. They may assign third parties to conduct this examination.

The processing of personal data within the framework of the monitoring and examination referred to in para. 4 is governed by the Ordinance of February 22, 2012, on the Processing of Personal Data and Data of Legal Entities when Using the Confederation's Electronic Infrastructure.

After consultation with the TNI delegate, the Federal Office specializing in information security may issue general and abstract directives applicable to all organizations referred to in Art. 2, para. 1 to 3, concerning the minimum technical requirements that must be met for the risk-based verification of the identity of persons and machines requiring access to information, IT resources, premises, and other Confederation infrastructures.

The processing of personal data carried out during identity verification in the identification data management systems referred to in Art. 24 LSI is governed by the provisions of the Ordinance of October 19, 2016, on the identification data management systems and directory services of the Confederation.

After consultation with the TNI delegate, the Federal Office specializing in information security may issue general and abstract directives applicable to all organizations referred to in Art. 2, para. 1 to 3, concerning the minimum technical requirements that must be met for the risk-based verification of the identity of persons and machines requiring access to information, IT resources, premises, and other Confederation infrastructures.

The processing of personal data carried out during identity verification in the identification data management systems referred to in Art. 24 LSI is governed by the provisions of the Ordinance of October 19, 2016, on the identification data management systems and directory services of the Confederation.

The administrative units referred to in Art. 2, para. 1, let. c, shall ensure that employees subject to a security check relating to persons, as specified in the Ordinance of November 8, 2023, on Security Checks Relating to Persons (OCSP), are made aware annually of the critical sensitive activities and the associated risks.

These employees are required to report to their employer any private or professional circumstances that may prevent them from performing their sensitive activities in compliance with the regulations.

The administrative units referred to in Art. 2, para. 1, let. c, shall ensure that employees subject to a security check relating to persons, as specified in the Ordinance of November 8, 2023, on Security Checks Relating to Persons (OCSP), are made aware annually of the critical sensitive activities and the associated risks.

These employees are required to report to their employer any private or professional circumstances that may prevent them from performing their sensitive activities in compliance with the regulations.

When a breach of information security regulations appears to simultaneously constitute an offense, the Federal Chancellery and the departments forward the investigation file and the hearing transcripts to the Office of the Attorney General of Switzerland or to the Chief Auditor of the Swiss Armed Forces.

They seize items that may serve as evidence in a proceeding.

When a breach of information security regulations appears to simultaneously constitute an offense, the Federal Chancellery and the departments forward the investigation file and the hearing transcripts to the Office of the Attorney General of Switzerland or to the Chief Auditor of the Swiss Armed Forces.

They seize items that may serve as evidence in a proceeding.

After consulting the relevant federal administration and armed forces bodies responsible for security of objects, the Confederation's specialized service for information security may issue general and abstract directives applicable to all organizations referred to in Art. 2, para. 1 to 3, concerning the minimum requirements for the physical protection of information and IT resources. In doing so, it takes into account: a. the entire life cycle of information and IT resources; b. the specific requirements of the workplace; c. the hosting strategies and plans of the federal administration and the armed forces.

After consulting the relevant federal administration and armed forces bodies responsible for security of objects, the Confederation's specialized service for information security may issue general and abstract directives applicable to all organizations referred to in Art. 2, para. 1 to 3, concerning the minimum requirements for the physical protection of information and IT resources. In doing so, it takes into account: a. the entire life cycle of information and IT resources; b. the specific requirements of the workplace; c. the hosting strategies and plans of the federal administration and the armed forces.

The administrative units referred to in Art. 2, para. 1, letter c, may establish the following security zones: a. security zone 1: premises and spaces where information classified as "confidential" is frequently processed, or IT resources with the security category "high protection" are operated; b. security zone 2: premises and spaces where information classified as "secret" is frequently processed, or IT resources with the security category "very high protection" are operated.

These premises and spaces are considered security zones only if the federal administration or military body responsible for the security of the facilities confirms before they are put into operation, and subsequently at least every five years, that the security requirements are met.

After consulting the federal administration and military bodies responsible for the security of the facilities, the Confederation's specialized service for information security issues general and abstract guidelines applying to all organizations referred to in Art. 2, para. 1 to 3, concerning security requirements for security zones and their establishment.

The administrative units referred to in Art. 2, para. 1, letter c, can take measures around the security zones to identify and protect against acts of electromagnetic espionage.

The administrative units referred to in Art. 2, para. 1, letter c, may establish the following security zones: a. security zone 1: premises and spaces where information classified as "confidential" is frequently processed, or IT resources with the security category "high protection" are operated; b. security zone 2: premises and spaces where information classified as "secret" is frequently processed, or IT resources with the security category "very high protection" are operated.

These premises and spaces are considered security zones only if the federal administration or military body responsible for the security of the facilities confirms before they are put into operation, and subsequently at least every five years, that the security requirements are met.

After consulting the federal administration and military bodies responsible for the security of the facilities, the Confederation's specialized service for information security issues general and abstract guidelines applying to all organizations referred to in Art. 2, para. 1 to 3, concerning security requirements for security zones and their establishment.

The administrative units referred to in Art. 2, para. 1, letter c, can take measures around the security zones to identify and protect against acts of electromagnetic espionage.

The Federal Chancellor, the secretaries-general, and the directors of the administrative units referred to in Art. 2, para. 1, let. c, are responsible for information security within their area of competence.

They may delegate the responsibility for information security to a member of management if that person has the necessary authority to implement, monitor, and correct measures.

The information security officers of the administrative units referred to in Art. 2, para. 1, let. c, specifically assume the following tasks: a. they ensure the establishment, operation, monitoring, and continuous improvement of the ISMS within their area of competence and issue the necessary directives; b. they make all decisions that have a decisive impact on information security within their area of competence, particularly regarding organization, processes, risk acceptance, and security objectives; c. they decide on necessary measures, especially regarding training and awareness-raising; d. they approve the annual audit and control planning and provide the necessary resources.

The Federal Chancellor, the secretaries-general, and the directors of the administrative units referred to in Art. 2, para. 1, let. c, assign tasks to their information security officers referred to in Art. 37 and ensure: a. that they possess the appropriate skills and resources; and b. that they are not assigned any tasks that could lead to a conflict of interest with the tasks referred to in Art. 37.

The Federal Chancellor, the secretaries-general, and the directors of the administrative units referred to in Art. 2, para. 1, let. c, are responsible for information security within their area of competence.

They may delegate the responsibility for information security to a member of management if that person has the necessary authority to implement, monitor, and correct measures.

The information security officers of the administrative units referred to in Art. 2, para. 1, let. c, specifically assume the following tasks: a. they ensure the establishment, operation, monitoring, and continuous improvement of the ISMS within their area of competence and issue the necessary directives; b. they make all decisions that have a decisive impact on information security within their area of competence, particularly regarding organization, processes, risk acceptance, and security objectives; c. they decide on necessary measures, especially regarding training and awareness-raising; d. they approve the annual audit and control planning and provide the necessary resources.

The Federal Chancellor, the secretaries-general, and the directors of the administrative units referred to in Art. 2, para. 1, let. c, assign tasks to their information security officers referred to in Art. 37 and ensure: a. that they possess the appropriate skills and resources; and b. that they are not assigned any tasks that could lead to a conflict of interest with the tasks referred to in Art. 37.

The administrative units referred to in Art. 2, para. 1, let. c, designate one or more information security officers and their deputies.

The information security officers perform the following tasks and assume the following responsibilities: a. they operate the ISMS of the administrative unit on behalf of the person responsible for information security; b. they develop the necessary decision-making bases for the information security officer and propose measures to be taken; c. they are the main points of contact for the administrative unit regarding information security issues and advise responsible persons and services, assisting them in fulfilling their tasks and obligations in the field of information security; d. they ensure the implementation of information security directives and the application of the security procedures referred to in Art. 27; e. they oversee the list of legal bases, the inventory of objects to be protected, and the list of exceptional authorizations; f. they oversee the planning of training and awareness-raising referred to in Art. 11 and propose additional training and awareness measures to the person responsible for information security; g. they request the initiation of the security procedure related to enterprises as referred to in Art. 4 of the Ordinance of November 8, 2023, on the Security Procedure Related to Enterprises (OPSEnt); h. they coordinate the management of security incidents and the handling of security breaches within the administrative unit and with mandated third parties; i. they prepare the annual control and audit planning and submit it to the person responsible for information security for approval; j. they periodically check the presence of information carriers classified as "secret" and their security within their area of competence; k. on behalf of the person responsible for information security, they can inspect or have inspected the use of information at open, shared, or non-lockable workstations and within the IT resources of the administrative unit; l. they report semi-annually to the person responsible for information security on the information security status.

The administrative units referred to in Art. 2, para. 1, let. c, designate one or more information security officers and their deputies.

The information security officers perform the following tasks and assume the following responsibilities: a. they operate the ISMS of the administrative unit on behalf of the person responsible for information security; b. they develop the necessary decision-making bases for the information security officer and propose measures to be taken; c. they are the main points of contact for the administrative unit regarding information security issues and advise responsible persons and services, assisting them in fulfilling their tasks and obligations in the field of information security; d. they ensure the implementation of information security directives and the application of the security procedures referred to in Art. 27; e. they oversee the list of legal bases, the inventory of objects to be protected, and the list of exceptional authorizations; f. they oversee the planning of training and awareness-raising referred to in Art. 11 and propose additional training and awareness measures to the person responsible for information security; g. they request the initiation of the security procedure related to enterprises as referred to in Art. 4 of the Ordinance of November 8, 2023, on the Security Procedure Related to Enterprises (OPSEnt); h. they coordinate the management of security incidents and the handling of security breaches within the administrative unit and with mandated third parties; i. they prepare the annual control and audit planning and submit it to the person responsible for information security for approval; j. they periodically check the presence of information carriers classified as "secret" and their security within their area of competence; k. on behalf of the person responsible for information security, they can inspect or have inspected the use of information at open, shared, or non-lockable workstations and within the IT resources of the administrative unit; l. they report semi-annually to the person responsible for information security on the information security status.

The IT Security Delegate is responsible for ensuring information security in centrally provided IT resources by the IT sector.

He appoints one or more Information Security Officers and their deputies.

The Information Security Officers perform the tasks outlined in Art. 37, para. 2, for centrally provided IT resources by the IT sector and inform the federal administration and the army about information security risks.

The IT Security Delegate is responsible for ensuring information security in centrally provided IT resources by the IT sector.

He appoints one or more Information Security Officers and their deputies.

The Information Security Officers perform the tasks outlined in Art. 37, para. 2, for centrally provided IT resources by the IT sector and inform the federal administration and the army about information security risks.

The departments are responsible for the management and oversight of information security within their areas of competence. In this regard, they perform the following tasks, among others: a. they determine the information security policy and the department's security organization, including the technical management of the information security officers referred to in Art. 37; b. they issue the necessary directives and oversee their implementation; c. they monitor the ISMS of the administrative units referred to in Art. 2, para. 1, letter c, and collect the necessary indicators for this purpose; d. they set annual security objectives for the administrative units referred to in Art. 2, para. 1, letter c, and verify that they have been achieved; e. they approve the department's annual control and audit planning and provide the necessary resources; f. they assign tasks to their information security officers referred to in Art. 40 and ensure: 1. that they have the appropriate skills and resources, and 2. that they are not assigned any tasks that may lead to a conflict of interest with the tasks referred to in Art. 40. They may establish security requirements for their areas of competence that exceed the minimum requirements of the Federal Information Security Service. Unless otherwise decided by the head of department, the responsibility for information security within the department lies with the Secretary-General, who acts under his or her mandate.

The departments are responsible for the management and oversight of information security within their areas of competence. In this regard, they perform the following tasks, among others: a. they determine the information security policy and the department's security organization, including the technical management of the information security officers referred to in Art. 37; b. they issue the necessary directives and oversee their implementation; c. they monitor the ISMS of the administrative units referred to in Art. 2, para. 1, letter c, and collect the necessary indicators for this purpose; d. they set annual security objectives for the administrative units referred to in Art. 2, para. 1, letter c, and verify that they have been achieved; e. they approve the department's annual control and audit planning and provide the necessary resources; f. they assign tasks to their information security officers referred to in Art. 40 and ensure: 1. that they have the appropriate skills and resources, and 2. that they are not assigned any tasks that may lead to a conflict of interest with the tasks referred to in Art. 40. They may establish security requirements for their areas of competence that exceed the minimum requirements of the Federal Information Security Service. Unless otherwise decided by the head of department, the responsibility for information security within the department lies with the Secretary-General, who acts under his or her mandate.

Departmental Information Security Officers carry out the following tasks in addition to those specified in Art. 81, para. 2, LSI: a. they ensure interdepartmental coordination of information security; b. they develop the necessary decision-making foundations for the Information Security Officer and propose measures to be taken; c. they coordinate the management of security incidents and the handling of security breaches involving multiple administrative units as mentioned in Art. 2, para. 1, let. c; d. they establish the department's annual control and audit planning and submit it to the Information Security Officer for approval; e. they represent the department within specialized bodies; f. they are consulted in the selection of the Information Security Officers of the administrative units referred to in Art. 37; g. they periodically verify, and in the event of a change or departure of a member of the Federal Council or the Federal Chancellor, that all classified "secret" information carriers are present and complete; h. they report annually to the Information Security Officer of the department on the state of information security within the department.

Departmental Information Security Officers carry out the following tasks in addition to those specified in Art. 81, para. 2, LSI: a. they ensure interdepartmental coordination of information security; b. they develop the necessary decision-making foundations for the Information Security Officer and propose measures to be taken; c. they coordinate the management of security incidents and the handling of security breaches involving multiple administrative units as mentioned in Art. 2, para. 1, let. c; d. they establish the department's annual control and audit planning and submit it to the Information Security Officer for approval; e. they represent the department within specialized bodies; f. they are consulted in the selection of the Information Security Officers of the administrative units referred to in Art. 37; g. they periodically verify, and in the event of a change or departure of a member of the Federal Council or the Federal Chancellor, that all classified "secret" information carriers are present and complete; h. they report annually to the Information Security Officer of the department on the state of information security within the department.

The DDPS appoints the Federal Council Information Security Officer and their deputy.

The DDPS appoints the Federal Council Information Security Officer and their deputy.

The Federal Office for Information Security undertakes the following tasks and assumes the following competences for the federal administration and the armed forces

a. it develops strategies on topics relevant to security;

b. it may request information, issue opinions, and propose modifications concerning projects in the field of security;

c. it participates in the training of members of the security organization;

d. it prepares templates and aids;

e. it assists information security officers in auditing classified information carriers marked as "secret";

f. it assumes responsibility for certified security solutions used throughout the federal administration and the armed forces.

It consults the Conference of Information Security Officers when carrying out these tasks and those referred to in Art. 83, para. 1, LSI.

It represents Switzerland in international relations as the national security authority and assumes the following tasks in this context

a. it develops international treaties referred to in Art. 87 LSI and oversees their implementation;

b. it ensures that security incidents concerning classified information from partner states are appropriately clarified;

c. it executes or ensures the execution of the inspections stipulated in international treaties;

d. it represents Switzerland in specialized international bodies;

e. it authorizes the arrival of foreigners in Switzerland to participate in classified projects and the dispatch of persons abroad to participate in classified projects;

f. it issues the security certificates referred to in Art. 30 OCSP.

It is part of the State Secretariat for Security Policy of the DDPS.

The Federal Office for Information Security undertakes the following tasks and assumes the following competences for the federal administration and the armed forces

a. it develops strategies on topics relevant to security;

b. it may request information, issue opinions, and propose modifications concerning projects in the field of security;

c. it participates in the training of members of the security organization;

d. it prepares templates and aids;

e. it assists information security officers in auditing classified information carriers marked as "secret";

f. it assumes responsibility for certified security solutions used throughout the federal administration and the armed forces.

It consults the Conference of Information Security Officers when carrying out these tasks and those referred to in Art. 83, para. 1, LSI.

It represents Switzerland in international relations as the national security authority and assumes the following tasks in this context

a. it develops international treaties referred to in Art. 87 LSI and oversees their implementation;

b. it ensures that security incidents concerning classified information from partner states are appropriately clarified;

c. it executes or ensures the execution of the inspections stipulated in international treaties;

d. it represents Switzerland in specialized international bodies;

e. it authorizes the arrival of foreigners in Switzerland to participate in classified projects and the dispatch of persons abroad to participate in classified projects;

f. it issues the security certificates referred to in Art. 30 OCSP.

It is part of the State Secretariat for Security Policy of the DDPS.

The OFCS performs the following tasks and assumes the following competences: a. it advises the federal administration and the army, as well as the security bodies referred to in Arts. 81 to 83 LSI, on all matters related to technical information security; b. it participates in the Conference of Information Security Officers referred to in Art. 82 LSI; c. to evaluate and improve the technical information security situation of the Confederation, it may identify threats and technical vulnerabilities on the Internet or, in coordination with information security officers and service providers, within the IT infrastructure of the federal administration; it may assign this task to other federal administration services or third parties. It coordinates its activities with those of the federal specialized service for information security.

The OFCS performs the following tasks and assumes the following competences: a. it advises the federal administration and the army, as well as the security bodies referred to in Arts. 81 to 83 LSI, on all matters related to technical information security; b. it participates in the Conference of Information Security Officers referred to in Art. 82 LSI; c. to evaluate and improve the technical information security situation of the Confederation, it may identify threats and technical vulnerabilities on the Internet or, in coordination with information security officers and service providers, within the IT infrastructure of the federal administration; it may assign this task to other federal administration services or third parties. It coordinates its activities with those of the federal specialized service for information security.

Decentralized information security costs are part of project and operational costs.

The administrative units referred to in Art. 2, para. 1, let. c, ensure that the costs are sufficiently considered and demonstrated during planning.

The Confederation's specialized service for information security charges a fee of 100 francs for issuing and sending the security certificates referred to in Art. 30 OCSP for people who do not perform sensitive tasks for the Confederation.

Decentralized information security costs are part of project and operational costs.

The administrative units referred to in Art. 2, para. 1, let. c, ensure that the costs are sufficiently considered and demonstrated during planning.

The Confederation's specialized service for information security charges a fee of 100 francs for issuing and sending the security certificates referred to in Art. 30 OCSP for people who do not perform sensitive tasks for the Confederation.

Six years after the enforcement of the present ordinance and subsequently every ten years, the specialized federal service for information security shall request the Federal Audit Office to evaluate the legislation on information security within the Confederation.

Six years after the enforcement of the present ordinance and subsequently every ten years, the specialized federal service for information security shall request the Federal Audit Office to evaluate the legislation on information security within the Confederation.

The organizations referred to in Art. 2, paras. 1 to 3, and the security bodies of the Confederation may process information relevant to information security, including personal data. They may exchange information, including personal data referred to in para. 1, among themselves and with national, international, or foreign public or private law organizations, provided that: a. it is useful for information security; b. no legal or contractual obligation of confidentiality is breached; c. the provisions of federal data protection legislation are respected, and d. these organizations perform legal tasks in the field of information security which correspond to those of the authority or organization communicating the information. As far as necessary to address a security incident or handle a security breach, they may also process and exchange sensitive data referred to in Art. 5, let. c, of the Federal Act of September 25, 2020, on Data Protection of persons who have or may have participated in the incident or security breach, or who are or may be affected by the incident or breach. If, during a security incident occurring within the Confederation or with third parties collaborating with the Confederation, Confederation information is stolen and published on the Internet, they may download and analyze this information in order to assess the impact on the Confederation and to implement necessary protection measures. They may not process data that is not useful for this assessment. They may apply these measures in case of a concrete suspicion.

The organizations referred to in Art. 2, paras. 1 to 3, and the security bodies of the Confederation may process information relevant to information security, including personal data. They may exchange information, including personal data referred to in para. 1, among themselves and with national, international, or foreign public or private law organizations, provided that: a. it is useful for information security; b. no legal or contractual obligation of confidentiality is breached; c. the provisions of federal data protection legislation are respected, and d. these organizations perform legal tasks in the field of information security which correspond to those of the authority or organization communicating the information. As far as necessary to address a security incident or handle a security breach, they may also process and exchange sensitive data referred to in Art. 5, let. c, of the Federal Act of September 25, 2020, on Data Protection of persons who have or may have participated in the incident or security breach, or who are or may be affected by the incident or breach. If, during a security incident occurring within the Confederation or with third parties collaborating with the Confederation, Confederation information is stolen and published on the Internet, they may download and analyze this information in order to assess the impact on the Confederation and to implement necessary protection measures. They may not process data that is not useful for this assessment. They may apply these measures in case of a concrete suspicion.

The organizations mentioned in Art. 2, para. 1 to 3, may operate an information system to manage information security (ISMS application).

They may process in the ISMS application all information related to the management of information security under this ordinance and the sensitive data referred to in Art. 46, para. 3.

They may connect their ISMS applications and exchange information relevant to information security through automated interfaces.

The organizations mentioned in Art. 2, para. 1 to 3, may operate an information system to manage information security (ISMS application).

They may process in the ISMS application all information related to the management of information security under this ordinance and the sensitive data referred to in Art. 46, para. 3.

They may connect their ISMS applications and exchange information relevant to information security through automated interfaces.

The specialized federal service for information security may operate electronic form services and link them to its ISMS application for the following purposes: a. to manage movements referred to in Art. 42, para. 3, letter e; b. to issue and send international security certificates referred to in Art. 30 OCSP; c. to issue and send international security certificates referred to in Art. 66 LSI.

Personal data listed in Annex 1 may be processed using the form services referred to in para. 1. They may be retained for a maximum of ten years.

The organizations referred to in Art. 2, paras. 1 to 3, may operate electronic form services to report incidents and security breaches and link them to their ISMS application.

Using the form services referred to in para. 3, they may process personal data, including sensitive data referred to in Art. 46, para. 3, which are necessary for managing security incidents and handling security breaches. They must delete these data from the form service immediately after their communication. They may temporarily record them before sending for a maximum of 24 hours.

The specialized federal service for information security may operate electronic form services and link them to its ISMS application for the following purposes: a. to manage movements referred to in Art. 42, para. 3, letter e; b. to issue and send international security certificates referred to in Art. 30 OCSP; c. to issue and send international security certificates referred to in Art. 66 LSI.

Personal data listed in Annex 1 may be processed using the form services referred to in para. 1. They may be retained for a maximum of ten years.

The organizations referred to in Art. 2, paras. 1 to 3, may operate electronic form services to report incidents and security breaches and link them to their ISMS application.

Using the form services referred to in para. 3, they may process personal data, including sensitive data referred to in Art. 46, para. 3, which are necessary for managing security incidents and handling security breaches. They must delete these data from the form service immediately after their communication. They may temporarily record them before sending for a maximum of 24 hours.

The DDPS may make dated versions of the general and abstract directives referred to in Art. 17, para. 3, Art. 21, para. 1, Art. 29, para. 1, and Art. 34, para. 1 binding for the cantons.

The DDPS may make dated versions of the general and abstract directives referred to in Art. 17, para. 3, Art. 21, para. 1, Art. 29, para. 1, and Art. 34, para. 1 binding for the cantons.

The repeal and amendment of other acts are governed in Annex 2.

The repeal and amendment of other acts are governed in Annex 2.

The IT security guidelines issued by the National Center for Cybersecurity (NCSC) and the exceptions it authorized before the entry into force of this ordinance remain valid for no more than three years after the entry into force of this ordinance.

The Federal Confederation's specialized service for information security or the NCSC makes decisions regarding changes to the guidelines and exceptions authorized by the NCSC before the entry into force of this ordinance.

The information protection guidelines issued by the Conference of Secretaries-General or the coordination body for the protection of information within the Confederation before the entry into force of this ordinance remain valid for no more than two years after the entry into force of this ordinance.

The administrative units referred to in Art. 2, para. 1, letter c, must implement their Information Security Management System (ISMS) (Art. 5) within three years after the entry into force of this ordinance.

The classification catalogs (Art. 17) must be established no later than one year after the entry into force of this ordinance.

The OFCS assumes until June 30, 2025, the tasks and competencies of the Federal Confederation's specialized service for information security referred to in Art. 9, para. 2 and 3, 11, para. 3 and 4, 12, para. 3 and 6 to 8, 15, 27, para. 7, 29, para. 1, and 31, para. 1.

The guidelines issued by the OFCS pursuant to para. 6 remain valid for no more than two years after the entry into force of this ordinance.

The IT security guidelines issued by the National Center for Cybersecurity (NCSC) and the exceptions it authorized before the entry into force of this ordinance remain valid for no more than three years after the entry into force of this ordinance.

The Federal Confederation's specialized service for information security or the NCSC makes decisions regarding changes to the guidelines and exceptions authorized by the NCSC before the entry into force of this ordinance.

The information protection guidelines issued by the Conference of Secretaries-General or the coordination body for the protection of information within the Confederation before the entry into force of this ordinance remain valid for no more than two years after the entry into force of this ordinance.

The administrative units referred to in Art. 2, para. 1, letter c, must implement their Information Security Management System (ISMS) (Art. 5) within three years after the entry into force of this ordinance.

The classification catalogs (Art. 17) must be established no later than one year after the entry into force of this ordinance.

The OFCS assumes until June 30, 2025, the tasks and competencies of the Federal Confederation's specialized service for information security referred to in Art. 9, para. 2 and 3, 11, para. 3 and 4, 12, para. 3 and 6 to 8, 15, 27, para. 7, 29, para. 1, and 31, para. 1.

The guidelines issued by the OFCS pursuant to para. 6 remain valid for no more than two years after the entry into force of this ordinance.

This ordinance shall enter into force on January 1, 2024.

This ordinance shall enter into force on January 1, 2024.