Ordinance on IT Security - Scope

1. This regulation applies to the state administration according to Article 1 of the State Administration Act of June 16, 1994, excluding autonomous public-law institutions.

2. It is applied appropriately to courts and other judicial authorities insofar as they do not act in a judicial capacity.

1. Information systems are protected against external influences and unauthorized access through appropriate organizational and technical measures.

1. The following terms mean

a) Information Systems: Devices and facilities, along with the associated infrastructure, operating software, and information applications used for the electronic processing of data, including the processed data.

b) Information Applications: Programs that enable the use of information systems for the fulfillment or support of specific tasks.

c) Data: All digital information processed by information systems.

d) Event: A breach of information security that leads to financial loss or damage to reputation, or results in a significant reduction in the availability of the affected information systems.

e) Normal Operation: Operation of information systems under normal circumstances.

f) Emergency Operation: Operation of the affected information systems following the occurrence of an event.

1. The Conference of Departmental IT Officers establishes the security measures, graded according to the risks, in a catalogue of measures. The security measures serve to reduce the risks.

2. The agencies assess the risks, determine the security levels, ascertain the necessary security measures, and ensure their implementation.

3. Departments and the Service for IT Planning monitor the classification of IT systems and applications.

1. Departmental Information Technology Officers and the IT Planning Service advise the offices on risk assessment, the determination of security levels, the identification of security measures, as well as their implementation and monitoring.

1. Offices shall individually determine the threat to their information technology systems and applications by classifying the data managed therein.

2. They shall consider risks arising from careless or malicious behavior of employees and outsiders, from technical defects in equipment and buildings, as well as from fire and natural events.

1. Data is considered "confidential" if it consists of personal data worthy of particular protection, personality profiles, data whose misuse could significantly disadvantage the affected person societally and economically, or data protected by contractual obligations.

2. Data is considered "restricted" if it involves personal data, data whose misuse could disadvantage the affected person societally and economically, data of financial relevance, or data subject to archiving requirements.

3. All other data is classified as non-classified concerning confidentiality.

1. The requirement of "high availability" is applied to data whose unavailability jeopardizes life or whose importance to task fulfillment is so significant that availability must be restored on the relevant IT system within one day. The same requirement for availability applies to data that cannot be recovered and whose loss would cause significant financial damage or reputational harm to the public.

2. The requirement of "medium availability" is applied to data whose importance to task fulfillment is so significant that availability must be restored on the relevant IT system within three days. The same requirement for availability applies to data that can be recovered but whose loss would cause moderate financial damage or reputational harm within the administration.

3. All other data are classified as unclassified in terms of availability.

1. In the classification "confidential" or "high availability," a high level of protection for the IT systems and applications is ensured.

2. In the classification "confidential" or "medium availability," a medium level of protection for the IT systems and applications is ensured.

3. If the data is classified as non-classified, a basic level of protection for the IT systems and applications is ensured.

1. A catalog of measures, following the classification of data, establishes the IT security measures for the IT systems and applications with regard to

a) Prevention of unauthorized access to data (confidentiality);

b) Prevention of unauthorized modification of data or access rights (integrity and authenticity);

c) Maximum allowable duration of an outage (availability).

2. The Conference of Departmental IT Officers is responsible for the creation and maintenance of the catalog of measures.

1. The authorities establish an Information Security Organization.

2. The person responsible for the Information Security Organization

a) takes the necessary precautionary measures;

b) ensures the continuation of business operations after an incident by utilizing the information systems and their return to normal operations.

1. The departmental IT manager is responsible for interdepartmental coordination within the department or the state chancellery.

1. The Information Planning Service ensures inter-departmental coordination. For this purpose, it appoints a cantonal Information Security Officer.

2. The cantonal Information Security Officer is operational both in normal operations and in emergency operations.

1. The Cantonal Command Staff appoints a Sub-Staff for Information Technology.

2. The Sub-Staff for Information Technology is deployed during major events, emergencies, and disasters when IT security is at risk.

1. The authorities classify existing IT systems and applications according to the classification of the data and ensure the implementation of the required security measures.

1. During the acquisition of new or replacement information technology systems and applications, the offices shall establish and implement the necessary information technology security measures as part of the implementation projects.

1. The offices inform the employees about the security measures that they must observe.

2. They are responsible for the training.

1. When an office processes data through other offices or exchanges data with them, the security levels and measures, as well as the responsibilities for implementation, shall be jointly determined.

1. If an agency has data processed by entities not subject to this regulation, the cooperation agreement shall stipulate which measures the agent is required to take and how compliance with these measures will be monitored.

1. Data exchange over public networks is only permitted through secured access points. All networks outside of the KOMSG communications network of the canton are considered public.

2. Access from public networks to the internal cantonal network occurs via the secured gateways provided by the network operator.

3. The network operator may grant exceptions.

1. The conditions under which data processing outside of the office premises and the use of data on private devices are permissible are regulated by a service directive.

1. The offices periodically review the compliance and adequacy of the information technology security measures.

2. If the responsibilities, organization or the information technology systems or applications used by an office change, they review the security levels and protection objectives as well as the adequacy of the information technology security measures.

1. For information systems and applications classified as "high availability" or "confidential," offices shall have the IT security measures periodically reviewed by independent internal or external entities.

2. The cantonal IT security officer may initiate random inspections.

3. For information systems and applications classified as "high availability," a contingency plan shall be established and periodically tested.

1. The Ordinance on the Department for Data Processing and Organization of April 22, 1975, is repealed.

1. For the existing information systems and applications, the offices shall assess the risks and determine the security levels, information security measures, as well as the schedule for their implementation within two years from the commencement of enforcement of this regulation.

1. This Decree shall be applied from March 1, 2004.