DE
EN
FR
IT
Contents 5
- What does the Information Security Act specifically require by the end of 2026?
- Which milestone already had to be in place by the end of 2024?
- Which milestone had to be completed by the end of 2025?
- Why is the reporting duty for cyberattacks interlinked with ISMS build-up?
- What should those responsible still check before the deadline expires?
At the end of 2026, a deadline under the Information Security Act expires whose actual starting point already lies two years in the past. The statutory timetable provides for its own intermediate steps in the years before, which precede the build-up of an information security management system (ISMS) and are the substantive precondition for it. Organisations that have skipped these milestones or only partially completed them face considerable time pressure as the final deadline approaches. This article sets out the sequence of steps and shows what those responsible should still check now.
The ISMS obligation under the Information Security Act ends at the end of 2026, but it does not start there. As early as the end of 2024, affected organisations had to submit a classification catalogue, and by the end of 2025, a protection needs analysis and classification of their IT. Both milestones provide the basis on which risk assessment and security measures within the ISMS can only then be built. Organisations that have not completed these steps lose time that will be missing before the end of 2026.
What does the Information Security Act specifically require by the end of 2026?
By the end of 2026, the authorities and organisations subject to the Act must operate a functioning ISMS that identifies and assesses risks and continuously reviews the effectiveness of measures.
The Information Security Act (ISG) governs the obligations of federal bodies, the cantons cooperating with the Confederation, and operators of critical infrastructure in Articles 6 to 23 ISG. At its core is the build-up of an information security management system that brings together protection needs analysis, risk assessment and security measures.
What matters is not a single certificate but demonstrability: organisations that know their risks, define responsibilities and document measures fulfil the statutory management logic regardless of the framework chosen. In practice, most affected organisations orient themselves on ISO 27001, because the standard maps precisely this logic into processes that auditors and supervisory bodies recognise.
The ISG does not require certification, but demonstrability of the management logic.
Which milestone already had to be in place by the end of 2024?
By the end of 2024, affected organisations had to draw up a classification catalogue that forms the basis for all subsequent steps.
Without a categorisation of an organisation’s own information, neither protection needs nor risk can be assessed meaningfully. The classification catalogue determines how sensitive a given piece of information is and what level of protection it therefore requires.
According to the overview of the staggered ISG timetable published by Swiss Infosec AG, drawing up this catalogue was the first of three milestones preceding the actual ISMS build-up. Organisations that have not created the catalogue, or have only done so superficially, must now complete it retroactively before the following steps can become reliable.
Which milestone had to be completed by the end of 2025?
By the end of 2025, affected bodies had to carry out a protection needs analysis and classify their IT in accordance with the new law.
The protection needs analysis builds directly on the classification catalogue: only once it is established how sensitive a piece of information is can the level of protection required for the associated IT resources be assessed. This classification determines which security measures will later need to apply within the ISMS.
If this classification is missing, the risk catalogue within the ISMS remains incomplete, because risks cannot be prioritised appropriately without a known level of protection need. Only with a complete classification can the build-up of an ISMS be planned so that the remaining time is actually sufficient.
Why is the reporting duty for cyberattacks interlinked with ISMS build-up?
Because the reporting duty presupposes incident management that must be anchored in the ISMS anyway: detection, assessment and reporting of an event within the statutory deadline.
Operators of critical infrastructure must report a cyberattack to the Federal Office for Cybersecurity within the statutory 24-hour reporting deadline after its discovery. This deadline can only be met if detection, escalation and reporting are already defined as a process within the ISMS, rather than improvised only once an incident occurs.
Supervisory practice regarding reporting deadlines has since become stricter, for instance with the reporting duty for cyberattacks. Organisations that only build up their ISMS after the 2024 and 2025 milestones have lapsed risk that their reporting processes, too, will be in place too late.
What should those responsible still check before the deadline expires?
They should honestly compare their own status of classification catalogue, protection needs analysis and ISMS build-up before the remaining time for rework becomes too short.
Where the classification catalogue or the protection needs analysis is missing or outdated, this can no longer simply be made up within the ISMS build-up, but only worked through in parallel with it. This further shortens the already tight remaining period.
Security officers should therefore take stock of the milestones completed so far before the end of the year, and record open points in central documentation for the ISMS build-up rather than spreading them across various spreadsheets. This first step shows how much time actually remains for the ISMS build-up itself.
Bundle evidence for ISMS milestones centrally
The Information Security solution maps classification, protection needs and risk assessment within a shared structure. It supports the documentation of the individual ISG milestones through to ISMS evidence.
Information SecurityFrequently asked questions
From when does the ISMS obligation under the Information Security Act apply?
The Information Security Act requires a functioning ISMS by the end of 2026 that identifies and assesses risks and continuously reviews the effectiveness of measures. This deadline applies to federal bodies, cantons cooperating with the Confederation and operators of critical infrastructure, which previously already had to draw up a classification catalogue and a protection needs analysis.
Who is affected by the Information Security Act?
The Information Security Act governs the obligations of federal bodies, the cantons cooperating with the Confederation and operators of critical infrastructure in Articles 6 to 23 ISG. These organisations must build up an information security management system that brings together protection needs analysis, risk assessment and security measures.
Does the ISG require certification to ISO 27001?
No, the Information Security Act does not require certification, but demonstrability of the statutory management logic: knowing risks, defining responsibilities and documenting measures. Many organisations orient themselves on ISO 27001, because the standard maps this logic into processes that auditors and supervisory bodies recognise.
What happens if the classification catalogue was not drawn up by the end of 2024?
Organisations that have not created the classification catalogue, or have only done so superficially, must now complete it retroactively before the following milestones, such as the protection needs analysis and ISMS build-up, can become reliable. This further shortens the time remaining before the end of 2026, since later steps cannot be built appropriately without this foundation.
Why must the reporting duty for cyberattacks be anchored in the ISMS?
The statutory reporting duty requires a cyberattack to be reported to the Federal Office for Cybersecurity within 24 hours of its discovery. This deadline can only be met if detection, escalation and reporting are already defined as a fixed process within the ISMS, rather than being improvised when an incident occurs.
- Staggered timetable for the ISGSwiss Infosec AG
- Information on the reporting dutyFederal Office for Cybersecurity (BACS)
