Ordinance of November 8, 2023, on the Security Procedure Related to Enterprises (OPSEnt) - Purpose and Scope (VBSV)

This ordinance governs: a. the modalities of the security procedure related to enterprises as referred to in Articles 49 to 73 of the LSI; b. the application of the security procedure related to enterprises to subcontractors; c. the tasks and competencies of the specialized service responsible for conducting the security procedure related to enterprises (specialized PSE service); d. the necessary measures to ensure the security of the system's data as referred to in Article 70 of the LSI; e. the modalities of periodic control carried out by an external body on the processing of personal data.

It applies to: a. the authorities referred to in Article 2, paragraph 1, of the LSI; b. the units of the central federal administration as defined in Article 7 of the ordinance of November 25, 1998, on the Organization of the Government and the Administration; c. the army.

The application of this ordinance to the units of the decentralized federal administration referred to in Article 2, paragraph 3, of the March 21, 1997 law on the Organization of the Government and the Administration (LOGA) and to the organizations referred to in Article 2, paragraph 4, LOGA is governed by Article 2, paragraphs 2 and 3, of the ordinance of November 8, 2023, on Information Security (OSI).

This ordinance governs: a. the modalities of the security procedure related to enterprises as referred to in Articles 49 to 73 of the LSI; b. the application of the security procedure related to enterprises to subcontractors; c. the tasks and competencies of the specialized service responsible for conducting the security procedure related to enterprises (specialized PSE service); d. the necessary measures to ensure the security of the system's data as referred to in Article 70 of the LSI; e. the modalities of periodic control carried out by an external body on the processing of personal data.

It applies to: a. the authorities referred to in Article 2, paragraph 1, of the LSI; b. the units of the central federal administration as defined in Article 7 of the ordinance of November 25, 1998, on the Organization of the Government and the Administration; c. the army.

The application of this ordinance to the units of the decentralized federal administration referred to in Article 2, paragraph 3, of the March 21, 1997 law on the Organization of the Government and the Administration (LOGA) and to the organizations referred to in Article 2, paragraph 4, LOGA is governed by Article 2, paragraphs 2 and 3, of the ordinance of November 8, 2023, on Information Security (OSI).

The security procedure referred to in this ordinance is conducted with enterprises whose headquarters are in Switzerland.

The international treaties referred to in Art. 87 LSI govern the execution of the security procedure applicable to enterprises whose headquarters are abroad.

The security procedure referred to in this ordinance is conducted with enterprises whose headquarters are in Switzerland.

The international treaties referred to in Art. 87 LSI govern the execution of the security procedure applicable to enterprises whose headquarters are abroad.

The State Secretariat for Security Policy of the Federal Department of Defense, Civil Protection, and Sports (DDPS) operates the specialized SSE service.

The specialized SSE service coordinates its international activities with those of the Confederation's specialized service for information security (Art. 83 of the Information Security Act).

The State Secretariat for Security Policy of the Federal Department of Defense, Civil Protection, and Sports (DDPS) operates the specialized SSE service.

The specialized SSE service coordinates its international activities with those of the Confederation's specialized service for information security (Art. 83 of the Information Security Act).

Within the jurisdiction of the Federal Council, the information security officers of the administrative units referred to in Art. 37 OSI have the authority to request the opening of the procedure. Art. 13, para. 2, letter c, is reserved.

The authorities referred to in Art. 2, para. 1, LSI shall notify the specialized PSE service, which, within their area of jurisdiction, is responsible for requesting the opening of the procedure.

The request shall include, in particular: a. a description of the construction work, delivery, or service; b. explanations regarding the sensitive nature of the mandate; c. information on the planned procurement procedure.

Within the jurisdiction of the Federal Council, the information security officers of the administrative units referred to in Art. 37 OSI have the authority to request the opening of the procedure. Art. 13, para. 2, letter c, is reserved.

The authorities referred to in Art. 2, para. 1, LSI shall notify the specialized PSE service, which, within their area of jurisdiction, is responsible for requesting the opening of the procedure.

The request shall include, in particular: a. a description of the construction work, delivery, or service; b. explanations regarding the sensitive nature of the mandate; c. information on the planned procurement procedure.

Before initiating the procedure, the PSE specialized service consults the contracting authority, the competent foreign authority, or the international organization.

The procedure must be initiated when one of the following conditions is met: a. the sensitive contract involves handling information classified as "secret" or the administration, operation, maintenance, or control of IT systems with a security category of "very high protection"; b. the sensitive contract involves handling information classified as "confidential" that concerns multiple authorities or departments; c. the sensitive contract involves the administration, operation, maintenance, or control of IT systems with a security category of "high protection" used for tasks concerning multiple authorities or departments; d. the enterprise bids for a contract whose execution requires an international security certificate as defined in art. 66 LSI.

The PSE specialized service informs the contracting authority as soon as it becomes apparent that the examination of the application will last more than 30 days.

Before initiating the procedure, the PSE specialized service consults the contracting authority, the competent foreign authority, or the international organization.

The procedure must be initiated when one of the following conditions is met: a. the sensitive contract involves handling information classified as "secret" or the administration, operation, maintenance, or control of IT systems with a security category of "very high protection"; b. the sensitive contract involves handling information classified as "confidential" that concerns multiple authorities or departments; c. the sensitive contract involves the administration, operation, maintenance, or control of IT systems with a security category of "high protection" used for tasks concerning multiple authorities or departments; d. the enterprise bids for a contract whose execution requires an international security certificate as defined in art. 66 LSI.

The PSE specialized service informs the contracting authority as soon as it becomes apparent that the examination of the application will last more than 30 days.

When foreign enterprises are considered for the execution of the sensitive mandate, the PSE specialized service forwards the request to the Confederation's specialized service for information security.

The Confederation's specialized service for information security verifies with the competent foreign security authority whether the concerned enterprises hold a valid enterprise security declaration. If this is not the case, it requests the foreign security authority to initiate the enterprise security procedure.

When foreign enterprises are considered for the execution of the sensitive mandate, the PSE specialized service forwards the request to the Confederation's specialized service for information security.

The Confederation's specialized service for information security verifies with the competent foreign security authority whether the concerned enterprises hold a valid enterprise security declaration. If this is not the case, it requests the foreign security authority to initiate the enterprise security procedure.

The information security requirements for the procurement procedure and the execution phase of the mandate are defined in the OSI and in the Ordinance of November 8, 2023, on Security Checks Related to Individuals.

If the procedure is initiated at the request of a foreign authority or an international organization, the information security requirements are governed by the relevant international treaty.

The specialized PSE service, in agreement with the awarding authority, specifies the sensitive tasks that the latter must implement for the procurement procedure and the execution phase of the mandate.

The awarding authority remains responsible for coordinating the processes of the procurement procedure.

The information security requirements for the procurement procedure and the execution phase of the mandate are defined in the OSI and in the Ordinance of November 8, 2023, on Security Checks Related to Individuals.

If the procedure is initiated at the request of a foreign authority or an international organization, the information security requirements are governed by the relevant international treaty.

The specialized PSE service, in agreement with the awarding authority, specifies the sensitive tasks that the latter must implement for the procurement procedure and the execution phase of the mandate.

The awarding authority remains responsible for coordinating the processes of the procurement procedure.

The awarding authority may indicate to the specialized PSE service up to five enterprises under consideration. In justified cases, the specialized PSE service may authorize a higher number upon the request of the awarding authority.

The specialized PSE service verifies whether the enterprises under consideration have consented to the procedure.

It informs the awarding authority when it is foreseeable that the qualification examination will last more than 30 days.

The awarding authority may indicate to the specialized PSE service up to five enterprises under consideration. In justified cases, the specialized PSE service may authorize a higher number upon the request of the awarding authority.

The specialized PSE service verifies whether the enterprises under consideration have consented to the procedure.

It informs the awarding authority when it is foreseeable that the qualification examination will last more than 30 days.

The specialized PSE service collects all relevant security data necessary for the assessment of the enterprise's qualification, including: a. data on ownership structures and planned changes such as mergers, partnerships, or acquisitions; b. data on the composition of the enterprise's management; c. data on the interests and affiliations of the enterprise's management members; d. data on solvency and any seizure or bankruptcy proceedings; e. data on the payment of taxes and social contributions; f. references from previous public contracts; g. data on the enterprise’s relations with foreign states or foreign organizations or other dependency relations.

It collects data from the Federal Intelligence Service that the latter has gathered in the performance of the tasks referred to in Art. 6, para. 1, let. a, of the Federal Act of September 25, 2015, on Intelligence Services.

The specialized PSE service collects all relevant security data necessary for the assessment of the enterprise's qualification, including: a. data on ownership structures and planned changes such as mergers, partnerships, or acquisitions; b. data on the composition of the enterprise's management; c. data on the interests and affiliations of the enterprise's management members; d. data on solvency and any seizure or bankruptcy proceedings; e. data on the payment of taxes and social contributions; f. references from previous public contracts; g. data on the enterprise’s relations with foreign states or foreign organizations or other dependency relations.

It collects data from the Federal Intelligence Service that the latter has gathered in the performance of the tasks referred to in Art. 6, para. 1, let. a, of the Federal Act of September 25, 2015, on Intelligence Services.

The contracting authority and the specialized PSE service shall inform each other whenever there are indications suggesting that a considered enterprise might be excluded from the award procedure.

The specialized PSE service shall continue the procedure as long as the contracting authority does not exclude the concerned enterprise from the award procedure.

If the contracting authority excludes the enterprise, the security procedure relating to that enterprise is closed.

The contracting authority and the specialized PSE service shall inform each other whenever there are indications suggesting that a considered enterprise might be excluded from the award procedure.

The specialized PSE service shall continue the procedure as long as the contracting authority does not exclude the concerned enterprise from the award procedure.

If the contracting authority excludes the enterprise, the security procedure relating to that enterprise is closed.

During the exchange of information referred to in Art. 10, para. 1, the contracting authority and the specialized PSE service mutually provide each other with all useful information and data necessary for the assessment of qualifications or the verification of facts referred to in Art. 44 of the Federal Act of June 21, 2019, on Public Procurement (PPA), subject to Art. 70, para. 3, and Art. 71, para. 1, let. a, LSI.

During the exchange of information referred to in Art. 10, para. 1, the contracting authority and the specialized PSE service mutually provide each other with all useful information and data necessary for the assessment of qualifications or the verification of facts referred to in Art. 44 of the Federal Act of June 21, 2019, on Public Procurement (PPA), subject to Art. 70, para. 3, and Art. 71, para. 1, let. a, LSI.

The security plan outlines the organizational, personal, technical, and physical measures to ensure the execution of sensitive mandates while considering security risks.

The specialized PSE service sets the guidelines which the security plan must meet following a visual inspection of the company's premises. It takes into account the specific conditions of the enterprise.

If the security plan does not comply with the guidelines of the specialized PSE service, the latter grants the company an appropriate period to make the necessary adjustments.

The specialized PSE service informs the awarding authority if it is foreseeable that the verification of the security plan will take more than 30 days.

The security plan outlines the organizational, personal, technical, and physical measures to ensure the execution of sensitive mandates while considering security risks.

The specialized PSE service sets the guidelines which the security plan must meet following a visual inspection of the company's premises. It takes into account the specific conditions of the enterprise.

If the security plan does not comply with the guidelines of the specialized PSE service, the latter grants the company an appropriate period to make the necessary adjustments.

The specialized PSE service informs the awarding authority if it is foreseeable that the verification of the security plan will take more than 30 days.

Enterprises considered for the execution of the mandate shall designate a security officer and a deputy to the specialized PSE service. The security officer and the deputy must be members of the management or act under its direct mandate.

The security officer performs the following tasks: a. serves as the point of contact for the specialized PSE service for all matters related to information security; b. ensures the implementation of the security plan (Art. 12, para. 1); c. requests the initiation of the security procedure related to enterprises for the subcontractor if the awarding entity has authorized the enterprise to assign a sensitive mandate to a subcontractor.

Enterprises considered for the execution of the mandate shall designate a security officer and a deputy to the specialized PSE service. The security officer and the deputy must be members of the management or act under its direct mandate.

The security officer performs the following tasks: a. serves as the point of contact for the specialized PSE service for all matters related to information security; b. ensures the implementation of the security plan (Art. 12, para. 1); c. requests the initiation of the security procedure related to enterprises for the subcontractor if the awarding entity has authorized the enterprise to assign a sensitive mandate to a subcontractor.

The award is communicated separately for each contract under a framework agreement.

When communicating the award, the awarding authority provides the BSP specialized service with the necessary information for the establishment of the security plan.

The award is communicated separately for each contract under a framework agreement.

When communicating the award, the awarding authority provides the BSP specialized service with the necessary information for the establishment of the security plan.

The specialized PSE service determines the individuals within the company who are subject to a security check related to individuals.

It may authorize the company to initiate the security check procedure independently.

The specialized PSE service determines the individuals within the company who are subject to a security check related to individuals.

It may authorize the company to initiate the security check procedure independently.

The enterprise security declaration specifies the sensitive activity that the enterprise is authorized to carry out.

The enterprise security declaration specifies the sensitive activity that the enterprise is authorized to carry out.

A change in the area of security includes, in particular: a. a change in the ownership or structures of the company; b. a change in the company's location; c. a change in the composition of the company's management; d. a change in the interest links of the company's management members; e. a change in solvency and possible seizure or bankruptcy proceedings; f. the existence of private or public law disputes or criminal proceedings; g. a change concerning the use of computer resources; h. the hiring of employees involved in sensitive activities; i. a change in the company's relationships with foreign states or foreign organizations, or in other dependency relationships; j. the acceptance of mandates leading to a conflict of interest or creating a dependency relationship with an adjudicator.

An incident in the area of security includes, in particular: a. illicit access to the company; b. misuse of the company's computer resources; c. an attack targeting the company's computer resources, whether successful or not; d. the discovery of security vulnerabilities or flaws; e. the initiation of criminal proceedings or debt collection procedures against company personnel involved in executing the sensitive mandate; f. searches and seizures conducted within the company.

The company must also report changes and incidents in the area of security concerning their suppliers if these changes or incidents are likely to impact the execution of the sensitive mandate.

It informs the specialized CSP service as soon as it is foreseeable that the company's security declaration will expire while the company is executing a sensitive mandate.

A change in the area of security includes, in particular: a. a change in the ownership or structures of the company; b. a change in the company's location; c. a change in the composition of the company's management; d. a change in the interest links of the company's management members; e. a change in solvency and possible seizure or bankruptcy proceedings; f. the existence of private or public law disputes or criminal proceedings; g. a change concerning the use of computer resources; h. the hiring of employees involved in sensitive activities; i. a change in the company's relationships with foreign states or foreign organizations, or in other dependency relationships; j. the acceptance of mandates leading to a conflict of interest or creating a dependency relationship with an adjudicator.

An incident in the area of security includes, in particular: a. illicit access to the company; b. misuse of the company's computer resources; c. an attack targeting the company's computer resources, whether successful or not; d. the discovery of security vulnerabilities or flaws; e. the initiation of criminal proceedings or debt collection procedures against company personnel involved in executing the sensitive mandate; f. searches and seizures conducted within the company.

The company must also report changes and incidents in the area of security concerning their suppliers if these changes or incidents are likely to impact the execution of the sensitive mandate.

It informs the specialized CSP service as soon as it is foreseeable that the company's security declaration will expire while the company is executing a sensitive mandate.

If, during collaboration with the enterprise, the contracting authority notes a change or an incident in the area of security, it shall take the necessary measures without delay and immediately inform the specialized PSE service.

Furthermore, the contracting authority shall inform the specialized PSE service in the following cases: a. it becomes aware, in the course of executing the sensitive mandate, of indications justifying the revocation of the adjudication within the meaning of Art. 44 LMP; b. it intends to proceed with a change in the security area concerning the mandate; c. it intends to assign an additional mandate to the enterprise.

If, during collaboration with the enterprise, the contracting authority notes a change or an incident in the area of security, it shall take the necessary measures without delay and immediately inform the specialized PSE service.

Furthermore, the contracting authority shall inform the specialized PSE service in the following cases: a. it becomes aware, in the course of executing the sensitive mandate, of indications justifying the revocation of the adjudication within the meaning of Art. 44 LMP; b. it intends to proceed with a change in the security area concerning the mandate; c. it intends to assign an additional mandate to the enterprise.

The specialized PSE service charges a fee of 100 francs for issuing an international security certificate.

An additional fee based on the time spent is charged if the issuance of an international security certificate requires a preliminary security procedure for enterprises. The hourly rate ranges from 100 to 400 francs. It depends on the urgency of the task and the position held by the personnel conducting the procedure. For all other matters, the general ordinance of 8 September 2004 on fees applies.

The Confederation's specialized service for information security and the specialized PSE service may, upon request, transmit a copy of the international security certificate to a foreign authority or an international organization.

The specialized PSE service charges a fee of 100 francs for issuing an international security certificate.

An additional fee based on the time spent is charged if the issuance of an international security certificate requires a preliminary security procedure for enterprises. The hourly rate ranges from 100 to 400 francs. It depends on the urgency of the task and the position held by the personnel conducting the procedure. For all other matters, the general ordinance of 8 September 2004 on fees applies.

The Confederation's specialized service for information security and the specialized PSE service may, upon request, transmit a copy of the international security certificate to a foreign authority or an international organization.

If the specialized PSE service becomes aware of indications suggesting that there is a reason to revoke the security declaration, it shall, after consulting the awarding authority, set a deadline for the enterprise to remedy the deficiencies.

If the mandate is withdrawn due to the revocation of the security declaration, the awarding authority shall immediately ensure that: a. all sensitive activities are halted without delay and the associated access rights are revoked, and that b. all classified information, all IT resources, and all materials are seized.

Within ten days after being informed of the revocation, the awarding authority shall confirm to the specialized PSE service that it has implemented the measures referred to in paragraph 2.

If the specialized PSE service becomes aware of indications suggesting that there is a reason to revoke the security declaration, it shall, after consulting the awarding authority, set a deadline for the enterprise to remedy the deficiencies.

If the mandate is withdrawn due to the revocation of the security declaration, the awarding authority shall immediately ensure that: a. all sensitive activities are halted without delay and the associated access rights are revoked, and that b. all classified information, all IT resources, and all materials are seized.

Within ten days after being informed of the revocation, the awarding authority shall confirm to the specialized PSE service that it has implemented the measures referred to in paragraph 2.

The specialized PSE (Enterprise Security Procedure) unit is responsible for initiating the repetition of the security procedure related to enterprises.

If the enterprise's security declaration expires while the procedure is being repeated, its validity is extended until a new declaration is issued or until the enterprise security procedure is concluded.

If the enterprise's security declaration is not renewed or if the enterprise security procedure is concluded, Art. 20 applies by analogy. Art. 58, para. 3, LSI is reserved.

The specialized PSE (Enterprise Security Procedure) unit is responsible for initiating the repetition of the security procedure related to enterprises.

If the enterprise's security declaration expires while the procedure is being repeated, its validity is extended until a new declaration is issued or until the enterprise security procedure is concluded.

If the enterprise's security declaration is not renewed or if the enterprise security procedure is concluded, Art. 20 applies by analogy. Art. 58, para. 3, LSI is reserved.

The personal data and the company data recorded in the information system on the security procedure for companies are listed in Appendix 1.

The personal data and the company data recorded in the information system on the security procedure for companies are listed in Appendix 1.

The DDPS ensures that an independent body from the specialized PSE service reviews the legality of the personal data processing by the relevant services at least every five years.

The DDPS ensures that an independent body from the specialized PSE service reviews the legality of the personal data processing by the relevant services at least every five years.

The cantons may request an evaluation of the qualification from the PSE specialized service within the meaning of Articles 55 to 57 of the Information Security Act (ISA) in order to carry out a sensitive mandate according to cantonal law: a. when they have a sufficient legal basis; b. when they intend to carry out assessments similar to those of the Confederation to ensure information security; and c. when they have entered into a service agreement with the Federal Department of Defense, Civil Protection and Sport (DDPS).

The service agreement mentioned in para. 1, letter c, shall govern, in particular: a. the number of evaluations to be conducted; b. the cantonal services authorized to request such evaluations; c. the financing of the services, including its modalities.

The amount of the fees is governed by Article 19, para. 2.

The cantons may request an evaluation of the qualification from the PSE specialized service within the meaning of Articles 55 to 57 of the Information Security Act (ISA) in order to carry out a sensitive mandate according to cantonal law: a. when they have a sufficient legal basis; b. when they intend to carry out assessments similar to those of the Confederation to ensure information security; and c. when they have entered into a service agreement with the Federal Department of Defense, Civil Protection and Sport (DDPS).

The service agreement mentioned in para. 1, letter c, shall govern, in particular: a. the number of evaluations to be conducted; b. the cantonal services authorized to request such evaluations; c. the financing of the services, including its modalities.

The amount of the fees is governed by Article 19, para. 2.

The repeal and amendment of other acts are governed by Annex 2.

The repeal and amendment of other acts are governed by Annex 2.

The former law applies to mandates granted before the entry into force of this ordinance and to the ongoing confidentiality protection procedures at the time this ordinance enters into force.

The former law applies to mandates granted before the entry into force of this ordinance and to the ongoing confidentiality protection procedures at the time this ordinance enters into force.

This ordinance shall enter into force on January 1, 2024.

This ordinance shall enter into force on January 1, 2024.