Ordinance of November 8, 2023, on Security Checks Related to Persons (OSCRP) - Purpose (VPSP)

This ordinance governs the following procedures: a. security checks related to persons (SCP) as referred to in the LSI; b. security checks referred to in art. 41b, para. 2, LEI and 6a, para. 2, LDI; c. loyalty checks referred to in art. 29a LAsi, 20b LPers, 14 LAAM, and 20a LApEl; d. security checks related to persons referred to in art. 23, para. 2, lett. d, and 103, para. 3, lett. d, LAAM; e. the assessment of potential abuse or danger as referred to in art. 113, para. 4, lett. d, LAAM; f. reliability checks referred to in art. 24, para. 1, LENu.

It also governs: a. the organization of the specialized services (SCP specialized services) responsible for conducting the security checks related to persons; b. the security certificate related to persons; c. the responsibilities concerning the protection of data processed in the information system referred to in art. 45 LSI and data security; d. the periodic review by an external body of the processing of personal data in the context of security checks related to persons.

It establishes within the domain of the Federal Council's competence: a. the functions requiring a check as referred to in para. 1; b. the allocation of a degree of control to sensitive activities; c. the services responsible for requesting the check and the decision-making authorities.

This ordinance governs the following procedures: a. security checks related to persons (SCP) as referred to in the LSI; b. security checks referred to in art. 41b, para. 2, LEI and 6a, para. 2, LDI; c. loyalty checks referred to in art. 29a LAsi, 20b LPers, 14 LAAM, and 20a LApEl; d. security checks related to persons referred to in art. 23, para. 2, lett. d, and 103, para. 3, lett. d, LAAM; e. the assessment of potential abuse or danger as referred to in art. 113, para. 4, lett. d, LAAM; f. reliability checks referred to in art. 24, para. 1, LENu.

It also governs: a. the organization of the specialized services (SCP specialized services) responsible for conducting the security checks related to persons; b. the security certificate related to persons; c. the responsibilities concerning the protection of data processed in the information system referred to in art. 45 LSI and data security; d. the periodic review by an external body of the processing of personal data in the context of security checks related to persons.

It establishes within the domain of the Federal Council's competence: a. the functions requiring a check as referred to in para. 1; b. the allocation of a degree of control to sensitive activities; c. the services responsible for requesting the check and the decision-making authorities.

This ordinance applies to: a. the authorities referred to in Art. 2, para. 1, LSI; b. the central federal administration units referred to in Art. 7 of the Ordinance of November 25, 1998, on the Organization of Government and Administration; c. the military; d. the cantons.

The application of this ordinance to the decentralized federal administration units referred to in Art. 2, para. 3, of the Government and Administration Organization Act of March 21, 1997 (LOGA), and to the organizations referred to in Art. 2, para. 4, LOGA is governed by Art. 2, paras. 2 and 3, of the Ordinance of November 8, 2023, on Information Security (OSI).

Exempted from reservation are the implementing provisions referred to in Art. 84, para. 1, LSI enacted by the authorities subject to the LSI, covering: a. functions that involve performing sensitive activities; b. the assignment of a control degree to sensitive activities; c. the services responsible for requesting control and the decision-making bodies.

This ordinance applies to: a. the authorities referred to in Art. 2, para. 1, LSI; b. the central federal administration units referred to in Art. 7 of the Ordinance of November 25, 1998, on the Organization of Government and Administration; c. the military; d. the cantons.

The application of this ordinance to the decentralized federal administration units referred to in Art. 2, para. 3, of the Government and Administration Organization Act of March 21, 1997 (LOGA), and to the organizations referred to in Art. 2, para. 4, LOGA is governed by Art. 2, paras. 2 and 3, of the Ordinance of November 8, 2023, on Information Security (OSI).

Exempted from reservation are the implementing provisions referred to in Art. 84, para. 1, LSI enacted by the authorities subject to the LSI, covering: a. functions that involve performing sensitive activities; b. the assignment of a control degree to sensitive activities; c. the services responsible for requesting control and the decision-making bodies.

The following lists of functions apply to the federal administration and the organizations referred to in Art. 2, para. 4, LOGA: a. for security controls relating to individuals as specified in the LSI: the list in Annex 1; b. for loyalty checks as specified in the LAsi: the list in Annex 2; c. for loyalty checks as specified in the LPers: the list in Annex 3.

The following lists of functions apply to the military: a. for security controls relating to individuals as specified in the LSI: the list in Annex 4; b. for loyalty checks as specified in Art. 14 LAAM: the list in Annex 5.

The list in Annex 6 applies to the functions specified in Art. 20a, para. 1, LApEl.

The project managers of a new nuclear facility, the holders of a general license, a construction permit, or an operating license for a nuclear facility, and the recipients of a decommissioning decision shall maintain a list of functions requiring a reliability check as specified in Art. 24, para. 1, LENu. The Federal Nuclear Safety Inspectorate (FNSI) establishes in guidelines the requirements that these lists and their updates must meet.

The following lists of functions apply to the federal administration and the organizations referred to in Art. 2, para. 4, LOGA: a. for security controls relating to individuals as specified in the LSI: the list in Annex 1; b. for loyalty checks as specified in the LAsi: the list in Annex 2; c. for loyalty checks as specified in the LPers: the list in Annex 3.

The following lists of functions apply to the military: a. for security controls relating to individuals as specified in the LSI: the list in Annex 4; b. for loyalty checks as specified in Art. 14 LAAM: the list in Annex 5.

The list in Annex 6 applies to the functions specified in Art. 20a, para. 1, LApEl.

The project managers of a new nuclear facility, the holders of a general license, a construction permit, or an operating license for a nuclear facility, and the recipients of a decommissioning decision shall maintain a list of functions requiring a reliability check as specified in Art. 24, para. 1, LENu. The Federal Nuclear Safety Inspectorate (FNSI) establishes in guidelines the requirements that these lists and their updates must meet.

Upon the request of the departments or the Federal Chancellery, the Federal Department of Defense, Civil Protection, and Sports (DDPS) may decide whether there is a need to amend or supplement the lists of functions included in annexes 1 to 6. It shall first consult the Federal Information Security Service.

Upon the request of the departments or the Federal Chancellery, the Federal Department of Defense, Civil Protection, and Sports (DDPS) may decide whether there is a need to amend or supplement the lists of functions included in annexes 1 to 6. It shall first consult the Federal Information Security Service.

Pursuant to art. 6 of the Act of 18 June 2004 on Official Publications, annexes 1, 4, and 6 shall not be published in the Official Compilation of Federal Legislation. The DDPS retains the lists of functions found in annexes 1, 4, and 6 and communicates them to the services and persons performing tasks provided for by this ordinance.

Pursuant to art. 6 of the Act of 18 June 2004 on Official Publications, annexes 1, 4, and 6 shall not be published in the Official Compilation of Federal Legislation. The DDPS retains the lists of functions found in annexes 1, 4, and 6 and communicates them to the services and persons performing tasks provided for by this ordinance.

The departments and the Federal Chancellery shall verify the relevance of the lists of positions within their area of competence: a. at least every three years; b. in the event of reorganization or the assumption or transfer of duties.

They shall report their verification to the DDPS and, if necessary, submit a request for modification to it in accordance with Art. 4.

The departments and the Federal Chancellery shall verify the relevance of the lists of positions within their area of competence: a. at least every three years; b. in the event of reorganization or the assumption or transfer of duties.

They shall report their verification to the DDPS and, if necessary, submit a request for modification to it in accordance with Art. 4.

The DDPS decides, upon request by the competent department or the Federal Chancellery, on the extraordinary checks referred to in Art. 29, para. 3, FISA. It consults in advance with the Federal Office for Information Security.

The DDPS decides, upon request by the competent department or the Federal Chancellery, on the extraordinary checks referred to in Art. 29, para. 3, FISA. It consults in advance with the Federal Office for Information Security.

The DDPS decides upon the request of the canton if a position within cantonal personnel involves the exercise of a sensitive activity. It consults in advance with the Federal Information Security Specialized Service. Art. 10, para. 2, let. e, is reserved.

The Federal Information Security Specialized Service maintains a list of cantonal functions according to para. 1.

Before subjecting a third party to a security check related to individuals, the following services verify whether they will engage in a sensitive activity: a. as part of the corporate security procedure: the specialized service responsible for conducting the corporate security procedure; b. in all other cases: the information security officer of the requesting service as defined in Art. 2, let. c, of the May 1, 2024, ordinance on the organization of public procurement of the federal administration.

The DDPS decides upon the request of the canton if a position within cantonal personnel involves the exercise of a sensitive activity. It consults in advance with the Federal Information Security Specialized Service. Art. 10, para. 2, let. e, is reserved.

The Federal Information Security Specialized Service maintains a list of cantonal functions according to para. 1.

Before subjecting a third party to a security check related to individuals, the following services verify whether they will engage in a sensitive activity: a. as part of the corporate security procedure: the specialized service responsible for conducting the corporate security procedure; b. in all other cases: the information security officer of the requesting service as defined in Art. 2, let. c, of the May 1, 2024, ordinance on the organization of public procurement of the federal administration.

Positions that meet the conditions outlined in Art. 24, para. 1, LENu only briefly are not listed in the position lists referred to in Art. 3, para. 4. ENSI determines the reliability of the individuals concerned. It may opt not to conduct the reliability check referred to in Art. 24, para. 1, LENu and may rely in particular on information provided by the following entities: a. a Swiss or foreign company for which the individual concerned works or has worked; b. a Swiss or foreign chamber of commerce; c. an authority from the foreign country of which the individual concerned is a native.

Positions that meet the conditions outlined in Art. 24, para. 1, LENu only briefly are not listed in the position lists referred to in Art. 3, para. 4. ENSI determines the reliability of the individuals concerned. It may opt not to conduct the reliability check referred to in Art. 24, para. 1, LENu and may rely in particular on information provided by the following entities: a. a Swiss or foreign company for which the individual concerned works or has worked; b. a Swiss or foreign chamber of commerce; c. an authority from the foreign country of which the individual concerned is a native.

The following sensitive activities referred to in the ISIS require a basic security check: a. the processing of information classified as "confidential"; b. the administration, operation, maintenance, and control of IT resources under the "high protection" security category; c. access to a security zone 1 referred to in Art. 35, para. 1, let. a, of the Ordinance on Security Infrastructure (OSI) or to a protection zone 2 referred to in Art. 3, para. 2, let. b, of the Ordinance of May 2, 1990, on the Protection of Works; d. activities subject to control corresponding to this level of oversight under an international treaty.

The following sensitive activities referred to in the ISIS require an expanded security check: a. the processing of information classified as "secret"; b. the administration, operation, maintenance, and control of IT resources under the "very high protection" security category; c. access to a security zone 2 referred to in Art. 35, para. 1, let. b, OSI or to a protection zone 3 referred to in Art. 3, para. 2, let. c, of the Ordinance on the Protection of Works; d. the sensitive activities of employees of the Confederation and external collaborators: 1. of the Federal Intelligence Service (FIS), 2. of Military Intelligence (MI) and the Army’s Preventive Protection Service (APPS), 3. of the Cyber and Electromagnetic Space Actions service (ACEM), 4. of the independent supervisory authority for intelligence activities (AS-Rens); e. the sensitive activities of employees of the cantonal enforcement authorities referred to in Art. 9, para. 1, of the Federal Intelligence Act of September 25, 2015, (FIA); f. activities subject to control corresponding to this level of oversight under an international treaty.

The following sensitive activities referred to in the ISIS require a basic security check: a. the processing of information classified as "confidential"; b. the administration, operation, maintenance, and control of IT resources under the "high protection" security category; c. access to a security zone 1 referred to in Art. 35, para. 1, let. a, of the Ordinance on Security Infrastructure (OSI) or to a protection zone 2 referred to in Art. 3, para. 2, let. b, of the Ordinance of May 2, 1990, on the Protection of Works; d. activities subject to control corresponding to this level of oversight under an international treaty.

The following sensitive activities referred to in the ISIS require an expanded security check: a. the processing of information classified as "secret"; b. the administration, operation, maintenance, and control of IT resources under the "very high protection" security category; c. access to a security zone 2 referred to in Art. 35, para. 1, let. b, OSI or to a protection zone 3 referred to in Art. 3, para. 2, let. c, of the Ordinance on the Protection of Works; d. the sensitive activities of employees of the Confederation and external collaborators: 1. of the Federal Intelligence Service (FIS), 2. of Military Intelligence (MI) and the Army’s Preventive Protection Service (APPS), 3. of the Cyber and Electromagnetic Space Actions service (ACEM), 4. of the independent supervisory authority for intelligence activities (AS-Rens); e. the sensitive activities of employees of the cantonal enforcement authorities referred to in Art. 9, para. 1, of the Federal Intelligence Act of September 25, 2015, (FIA); f. activities subject to control corresponding to this level of oversight under an international treaty.

The activities referred to in Art. 20b LPers that require a basic security check are as follows: a. activities related to the exercise of public authority referred to in Art. 20b, para. 1, let. a, LPers performed by employees of the Confederation assigned abroad and by employees of the Federal Department of Foreign Affairs subject to transfer discipline; b. activities referred to in Art. 20b, para. 1, let. b, LPers, whose untrustworthy execution could cause damage ranging from 50 million to 500 million Swiss francs; c. activities referred to in Art. 20b, para. 1, let. c, LPers carried out by personnel of the Federal Office of Police (fedpol), the Federal Office of Justice, and the Federal Office of Customs and Border Security, particularly in relation to the means and operational methods of combating crimes or misdemeanors or with the identity of exposed persons.

The activities referred to in Art. 20b LPers that require an expanded security check are as follows: a. activities carried out within the framework of employment relationships whose conclusion, modification, and termination fall under the competence of the Federal Council pursuant to Art. 2, para. 1, of the Ordinance of July 3, 2001, on Confederation Personnel (OPers); b. activities carried out within the framework of employment relationships whose conclusion, modification, and termination fall under the competence of the head of the department pursuant to Art. 2, para. 1bis, OPers; c. activities of those responsible for the decentralized administrative units referred to in Art. 2, para. 1, let. e, LPers; d. activities referred to in Art. 20b, para. 1, let. b, LPers whose untrustworthy execution could cause damage exceeding 500 million Swiss francs; e. activities referred to in Art. 20b, para. 1, let. c, LPers by fedpol personnel whose improper or non-compliant exercise could severely compromise the fight against major crimes under the Confederation's jurisdiction; f. activities of CSP specialized service employees.

The activities referred to in Art. 20b LPers that require a basic security check are as follows: a. activities related to the exercise of public authority referred to in Art. 20b, para. 1, let. a, LPers performed by employees of the Confederation assigned abroad and by employees of the Federal Department of Foreign Affairs subject to transfer discipline; b. activities referred to in Art. 20b, para. 1, let. b, LPers, whose untrustworthy execution could cause damage ranging from 50 million to 500 million Swiss francs; c. activities referred to in Art. 20b, para. 1, let. c, LPers carried out by personnel of the Federal Office of Police (fedpol), the Federal Office of Justice, and the Federal Office of Customs and Border Security, particularly in relation to the means and operational methods of combating crimes or misdemeanors or with the identity of exposed persons.

The activities referred to in Art. 20b LPers that require an expanded security check are as follows: a. activities carried out within the framework of employment relationships whose conclusion, modification, and termination fall under the competence of the Federal Council pursuant to Art. 2, para. 1, of the Ordinance of July 3, 2001, on Confederation Personnel (OPers); b. activities carried out within the framework of employment relationships whose conclusion, modification, and termination fall under the competence of the head of the department pursuant to Art. 2, para. 1bis, OPers; c. activities of those responsible for the decentralized administrative units referred to in Art. 2, para. 1, let. e, LPers; d. activities referred to in Art. 20b, para. 1, let. b, LPers whose untrustworthy execution could cause damage exceeding 500 million Swiss francs; e. activities referred to in Art. 20b, para. 1, let. c, LPers by fedpol personnel whose improper or non-compliant exercise could severely compromise the fight against major crimes under the Confederation's jurisdiction; f. activities of CSP specialized service employees.

The following activities and checks referred to in the LAAM require a basic security check: a. activities conducted in uniform abroad as referred to in Art. 14, para. 1, let. a, LAAM within the framework of the official representation of Switzerland or military diplomacy; b. activities referred to in Art. 14, para. 1, let. b, LAAM, whose improper execution could cause damage ranging from 50 to 500 million Swiss francs; c. checks referred to in Art. 23, para. 2, let. d, LAAM.

A security check related to persons as referred to in Art. 103, para. 3, let. d, LAAM can only be required for candidates if: a. there is a reason justifying the check referred to in para. 1 or in Art. 10 concerning the new role, and b. the minimum period set for repeating the check in Art. 43, para. 1, LSI has expired.

An assessment of the potential for abuse or dangerousness as referred to in Art. 113, para. 4, let. d, LAAM, upon request by the Command of Instruction, concerns: a. all conscripts; b. all members of the Red Cross Service who are equipped with a personal weapon; c. any military person, when suspicions have been communicated indicating: 1. that he or she might use his or her personal weapon in a manner dangerous to themselves or to others, or 2. that he or she might misuse their personal weapon or that others might misuse it.

For conscripts, the control procedures are carried out within the framework of recruitment.

The following activities and checks referred to in the LAAM require a basic security check: a. activities conducted in uniform abroad as referred to in Art. 14, para. 1, let. a, LAAM within the framework of the official representation of Switzerland or military diplomacy; b. activities referred to in Art. 14, para. 1, let. b, LAAM, whose improper execution could cause damage ranging from 50 to 500 million Swiss francs; c. checks referred to in Art. 23, para. 2, let. d, LAAM.

A security check related to persons as referred to in Art. 103, para. 3, let. d, LAAM can only be required for candidates if: a. there is a reason justifying the check referred to in para. 1 or in Art. 10 concerning the new role, and b. the minimum period set for repeating the check in Art. 43, para. 1, LSI has expired.

An assessment of the potential for abuse or dangerousness as referred to in Art. 113, para. 4, let. d, LAAM, upon request by the Command of Instruction, concerns: a. all conscripts; b. all members of the Red Cross Service who are equipped with a personal weapon; c. any military person, when suspicions have been communicated indicating: 1. that he or she might use his or her personal weapon in a manner dangerous to themselves or to others, or 2. that he or she might misuse their personal weapon or that others might misuse it.

For conscripts, the control procedures are carried out within the framework of recruitment.

The reliability checks referred to in Art. 24, para. 1, of the Nuclear Energy Act (NEA) for the following individuals require a basic security check: a. individuals who have access to information classified as "confidential" concerning nuclear facilities or materials; b. individuals engaging in activities whose improper execution could significantly compromise the fulfillment of fundamental protection objectives referred to in Art. 1, let. d, of the DETEC Ordinance of June 17, 2009, on Risk Scenarios and the Evaluation of Protection against Failures in Nuclear Installations; c. individuals working in the field of nuclear facility safety, particularly surveillance personnel. The reliability checks of individuals who have access to information classified as "secret" concerning nuclear facilities or materials require an expanded security check.

The reliability checks referred to in Art. 24, para. 1, of the Nuclear Energy Act (NEA) for the following individuals require a basic security check: a. individuals who have access to information classified as "confidential" concerning nuclear facilities or materials; b. individuals engaging in activities whose improper execution could significantly compromise the fulfillment of fundamental protection objectives referred to in Art. 1, let. d, of the DETEC Ordinance of June 17, 2009, on Risk Scenarios and the Evaluation of Protection against Failures in Nuclear Installations; c. individuals working in the field of nuclear facility safety, particularly surveillance personnel. The reliability checks of individuals who have access to information classified as "secret" concerning nuclear facilities or materials require an expanded security check.

The activities of the national transport network company mentioned in Art. 18 NSESA, whose execution requires access to critical information regarding supply security or to critical applications or infrastructures, require a basic security check.

The activities of the national transport network company whose execution requires access to extremely critical information regarding supply security or to extremely critical applications or infrastructures require an expanded security check.

The activities of the national transport network company mentioned in Art. 18 NSESA, whose execution requires access to critical information regarding supply security or to critical applications or infrastructures, require a basic security check.

The activities of the national transport network company whose execution requires access to extremely critical information regarding supply security or to extremely critical applications or infrastructures require an expanded security check.

The departments and the Federal Chancellery designate, within their area of competence, the services that request checks and the decision-making bodies and inform the specialized CSP services accordingly.

If the competence regarding selection or change of position or function falls under the Federal Council, it acts as the decision-making body.

In case of a decision to forgo the security procedure pursuant to Art. 53, para. 2, LSi, the contracting authority is the service requesting the check and the decision-making body.

For reliability checks referred to in Art. 24, para. 1, LENu, project managers of a new nuclear installation, holders of a general license, construction permit, or operating license for a nuclear installation, or recipients of a decommissioning decision are the services requesting the check and the decision-making bodies. The ENSI issues guidelines concerning the assessment of security risk by the decision-making bodies.

The national transmission network company is the service requesting the check and the decision-making body concerning loyalty checks referred to in Art. 20a LApEl.

Authorities subject to the LSI and the cantons inform the specialized CSP services of the services requesting the check and the decision-making bodies within their area of competence. If a canton does not designate a service requesting the check, the administrative unit of the Confederation responsible for the sensitive activity is tasked with requesting the check.

The service requesting the check is responsible for providing evidence of consent given for the checks, provided that the information system referred to in Art. 45 LSI does not supply it.

The departments and the Federal Chancellery designate, within their area of competence, the services that request checks and the decision-making bodies and inform the specialized CSP services accordingly.

If the competence regarding selection or change of position or function falls under the Federal Council, it acts as the decision-making body.

In case of a decision to forgo the security procedure pursuant to Art. 53, para. 2, LSi, the contracting authority is the service requesting the check and the decision-making body.

For reliability checks referred to in Art. 24, para. 1, LENu, project managers of a new nuclear installation, holders of a general license, construction permit, or operating license for a nuclear installation, or recipients of a decommissioning decision are the services requesting the check and the decision-making bodies. The ENSI issues guidelines concerning the assessment of security risk by the decision-making bodies.

The national transmission network company is the service requesting the check and the decision-making body concerning loyalty checks referred to in Art. 20a LApEl.

Authorities subject to the LSI and the cantons inform the specialized CSP services of the services requesting the check and the decision-making bodies within their area of competence. If a canton does not designate a service requesting the check, the administrative unit of the Confederation responsible for the sensitive activity is tasked with requesting the check.

The service requesting the check is responsible for providing evidence of consent given for the checks, provided that the information system referred to in Art. 45 LSI does not supply it.

CSP specialized services are: a. the CSP specialized service of the Federal Chancellery (CSP Specialized Service FC); b. the CSP specialized service of the DDPS (CSP Specialized Service DDPS).

The CSP Specialized Service DDPS is part of the State Secretariat for Security Policy (SSSP).

The CSP Specialized Service FC is responsible for checking the following individuals: a. individuals elected or appointed by the Federal Council or whose election is approved or confirmed by the Federal Council, with the exception of positions within the Federal Chancellery; b. deputies of state secretaries, office directors, and general secretaries; c. individuals elected or appointed by the senior management of other authorities subject to the LSI and directly subordinate to them; d. employees of the SSSP.

The CSP Specialized Service DDPS is responsible for all other checks.

If there are reasons to suspect a potential conflict of interest in the course of checking a particular individual, and it cannot be satisfactorily resolved through the recusal provided for in Art. 10 of the Federal Act of December 20, 1968, on Administrative Procedure, the CSP specialized services shall jointly agree on the competence.

CSP specialized services are: a. the CSP specialized service of the Federal Chancellery (CSP Specialized Service FC); b. the CSP specialized service of the DDPS (CSP Specialized Service DDPS).

The CSP Specialized Service DDPS is part of the State Secretariat for Security Policy (SSSP).

The CSP Specialized Service FC is responsible for checking the following individuals: a. individuals elected or appointed by the Federal Council or whose election is approved or confirmed by the Federal Council, with the exception of positions within the Federal Chancellery; b. deputies of state secretaries, office directors, and general secretaries; c. individuals elected or appointed by the senior management of other authorities subject to the LSI and directly subordinate to them; d. employees of the SSSP.

The CSP Specialized Service DDPS is responsible for all other checks.

If there are reasons to suspect a potential conflict of interest in the course of checking a particular individual, and it cannot be satisfactorily resolved through the recusal provided for in Art. 10 of the Federal Act of December 20, 1968, on Administrative Procedure, the CSP specialized services shall jointly agree on the competence.

After initiating the procedure, the specialized CSP services verify whether the following formal conditions are met: a. the concerned function appears on the list of functions, or the conditions specified in Art. 7 or 8 are fulfilled; b. the procedure has been initiated by the competent service; c. the person subject to the check has given consent, provided that such consent is necessary; d. all data concerning the person subject to the check necessary for data collection and the conduct of procedures are available.

In the event of an extraordinary repetition of the check, they verify whether this repetition is sufficiently justified.

If any condition is not met, they do not conduct the check and immediately inform the service that requested the check.

After initiating the procedure, the specialized CSP services verify whether the following formal conditions are met: a. the concerned function appears on the list of functions, or the conditions specified in Art. 7 or 8 are fulfilled; b. the procedure has been initiated by the competent service; c. the person subject to the check has given consent, provided that such consent is necessary; d. all data concerning the person subject to the check necessary for data collection and the conduct of procedures are available.

In the event of an extraordinary repetition of the check, they verify whether this repetition is sufficiently justified.

If any condition is not met, they do not conduct the check and immediately inform the service that requested the check.

The person subject to the control must notably: a. provide the documents and data relevant to the control; b. give truthful information.

If the person subject to the control does not fulfill their obligation to collaborate despite a warning, this may be taken into account in the risk assessment.

The person subject to the control must notably: a. provide the documents and data relevant to the control; b. give truthful information.

If the person subject to the control does not fulfill their obligation to collaborate despite a warning, this may be taken into account in the risk assessment.

The specialized CSP services may collect and process the data referred to in Annex 7.

An interview as referred to in Art. 34, para. 2, let. d, LSI is conducted with the following individuals: a. individuals elected or appointed by the Federal Council or whose election is approved or confirmed by the Federal Council; b. the deputies of state secretaries, office directors, and general secretaries; c. individuals performing a role in one of the following services or expected to perform such a role: 1. the SRC, 2. the cantonal enforcement authorities referred to in Art. 9 LRens, 3. the RM and SPPA, 4. ... 5. the AS-Rens, 6. fedpol, 7. the specialized CSP services; d. individuals who, as employees of the Confederation, must handle classified information labeled "secret" and who: 1. thereby have extensive knowledge of significant security policy files upon which they can exert considerable influence, or 2. undertake coordination or oversight tasks concerning the roles referred to in let. c; e. individuals for whom it is prescribed by an international treaty.

It is not necessary to conduct an interview in the event of a repeat security check if the available data is sufficient for assessing the security risk.

The following third parties may be interviewed pursuant to Art. 34, para. 3, LSI or Art. 113, para. 5, let. e, LAAM: a. medical or psychological specialists who are or have been responsible for the person undergoing the check; b. educational institutions where the person undergoing the check has received training; c. the former or current professional or military superiors of the person undergoing the check; d. other individuals likely to have useful information concerning the person undergoing the check.

The specialized CSP services may interview individuals using audiovisual means.

The specialized CSP services may collect and process the data referred to in Annex 7.

An interview as referred to in Art. 34, para. 2, let. d, LSI is conducted with the following individuals: a. individuals elected or appointed by the Federal Council or whose election is approved or confirmed by the Federal Council; b. the deputies of state secretaries, office directors, and general secretaries; c. individuals performing a role in one of the following services or expected to perform such a role: 1. the SRC, 2. the cantonal enforcement authorities referred to in Art. 9 LRens, 3. the RM and SPPA, 4. ... 5. the AS-Rens, 6. fedpol, 7. the specialized CSP services; d. individuals who, as employees of the Confederation, must handle classified information labeled "secret" and who: 1. thereby have extensive knowledge of significant security policy files upon which they can exert considerable influence, or 2. undertake coordination or oversight tasks concerning the roles referred to in let. c; e. individuals for whom it is prescribed by an international treaty.

It is not necessary to conduct an interview in the event of a repeat security check if the available data is sufficient for assessing the security risk.

The following third parties may be interviewed pursuant to Art. 34, para. 3, LSI or Art. 113, para. 5, let. e, LAAM: a. medical or psychological specialists who are or have been responsible for the person undergoing the check; b. educational institutions where the person undergoing the check has received training; c. the former or current professional or military superiors of the person undergoing the check; d. other individuals likely to have useful information concerning the person undergoing the check.

The specialized CSP services may interview individuals using audiovisual means.

Authorities or organizations responsible for collecting data abroad shall transmit the data to the CSP specialized services: a. indicating the source of the data; b. providing an assessment of the reliability of the data and their source.

All data that, in itself or in connection with other data, is likely to provide concrete indications of security risks are considered relevant to security within the meaning of Art. 35, para. 2, of the LSI.

Authorities or organizations responsible for collecting data abroad shall transmit the data to the CSP specialized services: a. indicating the source of the data; b. providing an assessment of the reliability of the data and their source.

All data that, in itself or in connection with other data, is likely to provide concrete indications of security risks are considered relevant to security within the meaning of Art. 35, para. 2, of the LSI.

If an activity requires multiple checks as referred to in Art. 1, para. 1, only one procedure takes place.

If the activity corresponds to several levels of control, the procedure is carried out according to the requirements of the highest level.

If the control falls under both the specialized service CSP ChF and the specialized service CSP DDPS, it is conducted by the specialized service CSP ChF. Assessments of potential abuse or dangerousness as referred to in Art. 113, para. 4, let. d, of the LAAM, which are always performed by the specialized service CSP DDPS, constitute an exception.

The competent specialized CSP service records the result of the evaluation of each check in the declaration referred to in Art. 39, para. 1, of the LSI.

If an activity requires multiple checks as referred to in Art. 1, para. 1, only one procedure takes place.

If the activity corresponds to several levels of control, the procedure is carried out according to the requirements of the highest level.

If the control falls under both the specialized service CSP ChF and the specialized service CSP DDPS, it is conducted by the specialized service CSP ChF. Assessments of potential abuse or dangerousness as referred to in Art. 113, para. 4, let. d, of the LAAM, which are always performed by the specialized service CSP DDPS, constitute an exception.

The competent specialized CSP service records the result of the evaluation of each check in the declaration referred to in Art. 39, para. 1, of the LSI.

The specialized CSP services may recommend to the decision-making authorities: a. to oblige the concerned individual to communicate personal data to the decision-making authority, including: 1. data on relationships with third parties, 2. financial data, including those concerning bank accounts and taxes, 3. data concerning examinations referred to in letter b, 4. data on ongoing procedures at the time of declaration; b. to undergo medical or psychological examinations, particularly regarding the individual's capacity for discernment and decision-making and the consumption of alcohol, drugs, narcotics, or other addictive substances; c. to take the measures referred to in Art. 25 of the LPers; d. to take measures concerning the possession of personal weapons if the individual subject to control is a conscript or military personnel; e. to take other measures that seem capable, in the specific case, of reducing to an acceptable level the security risk that has been identified.

The specialized CSP services may recommend to the decision-making authorities: a. to oblige the concerned individual to communicate personal data to the decision-making authority, including: 1. data on relationships with third parties, 2. financial data, including those concerning bank accounts and taxes, 3. data concerning examinations referred to in letter b, 4. data on ongoing procedures at the time of declaration; b. to undergo medical or psychological examinations, particularly regarding the individual's capacity for discernment and decision-making and the consumption of alcohol, drugs, narcotics, or other addictive substances; c. to take the measures referred to in Art. 25 of the LPers; d. to take measures concerning the possession of personal weapons if the individual subject to control is a conscript or military personnel; e. to take other measures that seem capable, in the specific case, of reducing to an acceptable level the security risk that has been identified.

If a person is subject to various grounds for checks and a CSP specialized service identifies a risk factor during a subsequent check, it communicates its report to the decision-making authorities of the previous checks. Art. 25, para. 2, is reserved.

The CSP specialized services communicate their interim findings if there are security risk indications requiring immediate action. During checks of conscripts or military personnel, these indications may take the following forms: a. the serious signs or indications referred to in Art. 113, para. 1, LAAM; b. signs or indications of limited aptitude for military service, unfitness for military service, or an inability to fulfill duties; c. serious signs or indications suggesting that the individual concerned may pose a danger to themselves or others.

The decision-making authorities specify to the CSP specialized services to which person or service the communications referred to in paras. 1 and 2 should be addressed.

If a person is subject to various grounds for checks and a CSP specialized service identifies a risk factor during a subsequent check, it communicates its report to the decision-making authorities of the previous checks. Art. 25, para. 2, is reserved.

The CSP specialized services communicate their interim findings if there are security risk indications requiring immediate action. During checks of conscripts or military personnel, these indications may take the following forms: a. the serious signs or indications referred to in Art. 113, para. 1, LAAM; b. signs or indications of limited aptitude for military service, unfitness for military service, or an inability to fulfill duties; c. serious signs or indications suggesting that the individual concerned may pose a danger to themselves or others.

The decision-making authorities specify to the CSP specialized services to which person or service the communications referred to in paras. 1 and 2 should be addressed.

The decision-making authority shall communicate its decision regarding the exercise of the activity (Art. 41, para. 2, LSI) to the person being checked and to the competent CSP specialized service within a period of one month.

When a security declaration referred to in Art. 39, para. 1, let. a, LSI is issued, authorization to exercise the activity is presumed. The decision-making authority may choose not to communicate its decision.

The decision-making authority shall communicate its decision regarding the exercise of the activity (Art. 41, para. 2, LSI) to the person being checked and to the competent CSP specialized service within a period of one month.

When a security declaration referred to in Art. 39, para. 1, let. a, LSI is issued, authorization to exercise the activity is presumed. The decision-making authority may choose not to communicate its decision.

If a person is subject to a valid security declaration based on a prior check according to Art. 1, para. 1, the decision-making authority or, if the Federal Council is the decision-making authority, the department submitting the proposal may choose not to conduct a new evaluation: a. if the prior evaluation is based on the same risk factors as the new check, and b. if there is no reason to conduct an extraordinary repetition of the check.

Security risks observed during an evaluation corresponding to a higher level of scrutiny may only be taken into account if: a. these risks can also be detected using the collected data that corresponds to a lower level of scrutiny, or b. the public interests referred to in Art. 1, para. 2, of LSI outweigh the personal rights of the individual being checked.

If a person is subject to a valid security declaration based on a prior check according to Art. 1, para. 1, the decision-making authority or, if the Federal Council is the decision-making authority, the department submitting the proposal may choose not to conduct a new evaluation: a. if the prior evaluation is based on the same risk factors as the new check, and b. if there is no reason to conduct an extraordinary repetition of the check.

Security risks observed during an evaluation corresponding to a higher level of scrutiny may only be taken into account if: a. these risks can also be detected using the collected data that corresponds to a lower level of scrutiny, or b. the public interests referred to in Art. 1, para. 2, of LSI outweigh the personal rights of the individual being checked.

If a security declaration has been made in accordance with Art. 39, para. 1, let. a, LSI, the check must be subject to a regular repetition within the following timeframes: a. for basic security checks: within the three months preceding the expiration of the maximum period of ten years; b. for expanded security checks: within the three months preceding the expiration of the maximum period of five years.

If a declaration or finding referred to in Art. 39, para. 1, let. b to d, LSI has been made, the check must be subject to a regular repetition within the following timeframes: a. for basic security checks: within the three months following the expiration of the minimum period of five years; b. for expanded security checks: within the three months following the expiration of the minimum period of three years.

Timeframes set in an international treaty are reserved.

For military and civil protection functions, the basic security check is not subject to a regular repetition if it is likely that the person subject to the check will exercise their function for a period of less than five years.

Assessments of potential abuse or dangerousness referred to in Art. 113, para. 4, let. d, LAAM are not subject to a regular repetition.

If a security declaration has been made in accordance with Art. 39, para. 1, let. a, LSI, the check must be subject to a regular repetition within the following timeframes: a. for basic security checks: within the three months preceding the expiration of the maximum period of ten years; b. for expanded security checks: within the three months preceding the expiration of the maximum period of five years.

If a declaration or finding referred to in Art. 39, para. 1, let. b to d, LSI has been made, the check must be subject to a regular repetition within the following timeframes: a. for basic security checks: within the three months following the expiration of the minimum period of five years; b. for expanded security checks: within the three months following the expiration of the minimum period of three years.

Timeframes set in an international treaty are reserved.

For military and civil protection functions, the basic security check is not subject to a regular repetition if it is likely that the person subject to the check will exercise their function for a period of less than five years.

Assessments of potential abuse or dangerousness referred to in Art. 113, para. 4, let. d, LAAM are not subject to a regular repetition.

When the decision-making authority has reasons to believe that significant risks have emerged since the last check, which cannot be assessed without a new check, it shall immediately initiate an extraordinary repetition of the check.

If it has reasons to believe that the risks identified during the last check no longer exist, it may initiate an extraordinary repetition of the check.

When the decision-making authority has reasons to believe that significant risks have emerged since the last check, which cannot be assessed without a new check, it shall immediately initiate an extraordinary repetition of the check.

If it has reasons to believe that the risks identified during the last check no longer exist, it may initiate an extraordinary repetition of the check.

The last decision rendered remains valid until the new decision referred to in Art. 41, para. 1, LSI is made.

The last decision rendered remains valid until the new decision referred to in Art. 41, para. 1, LSI is made.

The specialized services of the CSP have the right to appeal to the Federal Court against the decisions of the Federal Administrative Court concerning their statements.

The specialized services of the CSP have the right to appeal to the Federal Court against the decisions of the Federal Administrative Court concerning their statements.

The Federal Office for Information Security is responsible for issuing national and international security certificates.

A security certificate is issued upon request if: a. a check corresponding to the required level of scrutiny has been conducted; b. the person concerned has been authorized to perform the activity, and c. it can be proven that the person concerned has been trained to perform the activity.

If the service requesting the check is not part of the federal administration and requires the security certificate for a reason other than the fulfillment of a Confederation mandate, it bears the costs of the procedure.

The Federal Office for Information Security is responsible for issuing national and international security certificates.

A security certificate is issued upon request if: a. a check corresponding to the required level of scrutiny has been conducted; b. the person concerned has been authorized to perform the activity, and c. it can be proven that the person concerned has been trained to perform the activity.

If the service requesting the check is not part of the federal administration and requires the security certificate for a reason other than the fulfillment of a Confederation mandate, it bears the costs of the procedure.

The CSP DDPS Specialist Service is responsible for the protection and security of the information system referred to in Art. 45 LSI and the data it contains.

The protection and security of data processed outside the information system in accordance with Art. 45, para. 5, LSI is the responsibility of the service tasked with processing them.

Data produced during the security check relating to persons must not be used for other purposes.

The CSP DDPS Specialist Service is responsible for the protection and security of the information system referred to in Art. 45 LSI and the data it contains.

The protection and security of data processed outside the information system in accordance with Art. 45, para. 5, LSI is the responsibility of the service tasked with processing them.

Data produced during the security check relating to persons must not be used for other purposes.

The DDPS and the Federal Chancellery shall ensure that an independent body reviews at least every five years the lawfulness of personal data processing by their specialized CPS services.

The DDPS and the Federal Chancellery shall ensure that an independent body reviews at least every five years the lawfulness of personal data processing by their specialized CPS services.

As far as possible, communication between the person subject to the check, authorities, third parties, and judicial bodies is conducted electronically.

Individuals who are not employees of the Confederation may request that communication with them be conducted in paper format.

Specialized CSP services may use approved messaging platforms and identity lists.

As far as possible, communication between the person subject to the check, authorities, third parties, and judicial bodies is conducted electronically.

Individuals who are not employees of the Confederation may request that communication with them be conducted in paper format.

Specialized CSP services may use approved messaging platforms and identity lists.

The specialized CSP services collect fees for the checks they conduct for services not belonging to the central federal administration or the military; these fees correspond to the time spent.

The hourly rate ranges from 100 to 400 francs. It depends on the urgency of the task and the position held by the personnel conducting the check.

No fee is charged for security checks related to individuals as specified in the LSI or for loyalty checks as referred to in Art. 20b LPers.

For the rest, the General Ordinance of September 8, 2004, on Fees (OGEmol) applies.

The specialized CSP services collect fees for the checks they conduct for services not belonging to the central federal administration or the military; these fees correspond to the time spent.

The hourly rate ranges from 100 to 400 francs. It depends on the urgency of the task and the position held by the personnel conducting the check.

No fee is charged for security checks related to individuals as specified in the LSI or for loyalty checks as referred to in Art. 20b LPers.

For the rest, the General Ordinance of September 8, 2004, on Fees (OGEmol) applies.

The cantons may utilize the services of the CSP Specialized Service DDPS for their own information security: a. when they possess a sufficient legal basis for the inspections to be conducted under this ordinance; b. when they intend to carry out evaluations similar to those of the Confederation to ensure information security, and c. when they have concluded a service agreement with the DDPS.

The service agreement referred to in para. 1, letter c, particularly regulates: a. the number of controls to be conducted; b. the services requesting the control and the decision-making authorities of the canton; c. the financing of the services, including its terms.

The amount of the fees is calculated based on the time spent. The hourly rate ranges from 100 to 400 francs. It depends on the urgency of the mandate and the position held by the personnel conducting the inspection. Otherwise, the OGEmol applies.

The cantons may utilize the services of the CSP Specialized Service DDPS for their own information security: a. when they possess a sufficient legal basis for the inspections to be conducted under this ordinance; b. when they intend to carry out evaluations similar to those of the Confederation to ensure information security, and c. when they have concluded a service agreement with the DDPS.

The service agreement referred to in para. 1, letter c, particularly regulates: a. the number of controls to be conducted; b. the services requesting the control and the decision-making authorities of the canton; c. the financing of the services, including its terms.

The amount of the fees is calculated based on the time spent. The hourly rate ranges from 100 to 400 francs. It depends on the urgency of the mandate and the position held by the personnel conducting the inspection. Otherwise, the OGEmol applies.

The repeal and amendment of other acts are addressed in annex 8.

The repeal and amendment of other acts are addressed in annex 8.

The LSI and the present ordinance apply to evaluations ongoing at the time of the entry into force of this ordinance. The specialized CSP services verify in collaboration with the services requesting the check whether the conditions to be satisfied for carrying out the check are still met.

Security checks related to persons conducted under the old law correspond during the transitional period referred to in Art. 90, para. 3, LSI to the levels of checks under the new law as follows: a. basic security check under the old law: basic security check under the new law; b. extended security check under the old law: extended security check under the new law; c. extended security check with hearing under the old law: extended security check under the new law.

Persons with functions requiring a first check or a check corresponding to a higher level according to the new law are checked within six months. The decision-making authority determines if the person is authorized to continue engaging in sensitive activities until the decision referred to in Art. 41, para. 2, LSI is rendered. If the ongoing check reveals signs of security risk, the decision-making authority takes the necessary preventive measures.

Security checks that the national transport network company received based on private law before and up to one year after the entry into force of the present ordinance remain applicable as follows within the time limits set for repetitions referred to in Art. 26 and 27: a. security checks for critical functions: as a basic security check according to this ordinance; b. security checks for extremely critical functions: as an extended security check according to this ordinance.

The LSI and the present ordinance apply to evaluations ongoing at the time of the entry into force of this ordinance. The specialized CSP services verify in collaboration with the services requesting the check whether the conditions to be satisfied for carrying out the check are still met.

Security checks related to persons conducted under the old law correspond during the transitional period referred to in Art. 90, para. 3, LSI to the levels of checks under the new law as follows: a. basic security check under the old law: basic security check under the new law; b. extended security check under the old law: extended security check under the new law; c. extended security check with hearing under the old law: extended security check under the new law.

Persons with functions requiring a first check or a check corresponding to a higher level according to the new law are checked within six months. The decision-making authority determines if the person is authorized to continue engaging in sensitive activities until the decision referred to in Art. 41, para. 2, LSI is rendered. If the ongoing check reveals signs of security risk, the decision-making authority takes the necessary preventive measures.

Security checks that the national transport network company received based on private law before and up to one year after the entry into force of the present ordinance remain applicable as follows within the time limits set for repetitions referred to in Art. 26 and 27: a. security checks for critical functions: as a basic security check according to this ordinance; b. security checks for extremely critical functions: as an extended security check according to this ordinance.

This ordinance shall enter into force on 1 January 2024.

This ordinance shall enter into force on 1 January 2024.