BACS Tightens Tone on Reporting Deadlines

The Federal Office for Cyber Security (BACS) initially introduced the reporting obligation for cyberattacks on critical infrastructure in a cooperative manner and tolerated early teething problems. With the end of this transition phase in mid-2026, the trade publication sidd.swiss announces in its analysis of the NCSC/BACS reporting obligation a more consistent enforcement, particularly for repeated violations and reports that only became known late. For companies, one question moves to the foreground: which timeline they must document without gaps in an emergency.

What changes at BACS from mid-2026?

After the end of the authority’s transition phase, BACS moves from awareness-raising to consistent enforcement, with particular attention to repeated violations and late reports.

The legal basis is the federal Information Security Act, whose contribution to strengthening the digital resilience of the federal government anchors the reporting obligation for operators of critical infrastructure. In the months following its introduction, BACS drew a positive balance: operators reported cyberattacks on time, within 24 hours, as the authority noted in its statement on six months of the reporting obligation. In total, 164 reports were received during this period, as BACS stated in the same communication.

Anyone who violates the reporting obligation must, according to BACS, expect a fine of up to CHF 100,000, whereby the authority first contacts the organisation concerned before imposing a sanction. With the end of the transition phase, sidd.swiss expects a tougher line in its analysis, above all for repeated violations and for reports that only became known through media coverage.

When does the reporting deadline start running?

What counts is the moment the attack became known, not the completion of the forensic investigation.

sidd.swiss states in its practical analysis of the 24-hour reporting obligation that the deadline begins upon discovery, not at the original time of the attack. For companies, the decisive question thus shifts from technology to organisation: from what point is an incident considered sufficiently identified. Once this threshold is reached, the 24-hour deadline for the initial report to BACS starts running, as the authority sets out in its information on the reporting obligation.

Anyone who waits for a complete forensic investigation will, as a rule, already have missed the deadline. BACS explicitly expects a structured initial assessment, not finished forensics. Missing details can be added within 14 days in a follow-up report, as BACS states in its fact sheet on the reporting obligation.

Which timestamps must a company document?

At least four points in time must be verifiable: detection, internal escalation, initial report and follow-up report.

Without documented timestamps, it is difficult to prove after the fact that a report was made on time. BACS requires details of the date and time of detection as well as of the attack in the report itself. These details only make sense if they come from unbroken internal logging rather than being reconstructed afterwards.

How demanding a complete evidence trail can become over several years is shown by the review of a long-running supervisory investigation in the UBS fine case.

• Time of the first indication of an incident
• Time of discovery by the responsible unit
• Time of internal escalation to management and the persons authorised to report
• Time of the initial report to BACS, at the latest 24 hours after discovery
• Time of the follow-up report with complete details, at the latest 14 days later

How does the BACS deadline differ from other reporting obligations?

Companies subject to several regulations must keep several clocks in view at once; the BACS 24-hour deadline is only one of them.

Regulated financial institutions already know a similar logic from FINMA supervisory practice: for serious incidents, the supervisory authority expects an initial report within 24 hours and a follow-up report within 72 hours. The BACS reporting obligation applies alongside this supervisory duty, but does not replace it.

For manufacturers of products with digital elements, a further reporting obligation is added on 11 September 2026: from this date, the EU Cyber Resilience Act requires the reporting of actively exploited vulnerabilities and serious security incidents. A separate article examines where concrete gaps still remain in these CRA reporting obligations.

Any company that has not clearly determined whether it qualifies as an operator of critical infrastructure or as an entity subject to NIS2 falls behind on every one of these deadlines. How significant this uncertainty is in practice is shown by the registration gap that many companies only close after a subsequent self-assessment.

What is the first concrete step towards demonstrable compliance?

The first verifiable step is a documented test report that runs through the complete timeline from detection to follow-up report.

Companies should run through a test report in their internal playbook within the current quarter and log all four timestamps: detection, escalation, initial report and follow-up report. The person responsible for reporting, whether CISO or information security officer, should be named in writing and given the necessary authority. This exercise provides the basis for presenting a complete and verifiable timeline to BACS in an emergency.