# BACS Tightens Tone on Reporting Deadlines > Swiss GRC explains how companies document the BACS reporting timeline for cyberattacks on critical infrastructure: initial report within 24 hours, follow-up within 14 days, and fines up to CHF 100,000. For operators preparing for stricter enforcement from mid-2026. - URL: https://swissgrc.com/en/bacs-tightens-tone-on-reporting-deadlines/ - Publisher: SwissGRC® - Published: 2026-08-27 - Last updated: 2026-08-27 ## Key facts - Operators of critical infrastructure must send the initial report of a cyberattack to the Federal Office for Cyber Security (BACS) within 24 hours and complete it with a follow-up report within 14 days. - The 24-hour deadline starts when the attack becomes known, not at the time of the attack and not when the forensic analysis is complete. - Violating the reporting obligation can lead to a fine of up to CHF 100,000, and BACS first contacts the organisation concerned before imposing a sanction. - BACS received 164 reports in the first six months of the reporting obligation, and operators reported on time within 24 hours according to the authority. - Companies should document four timestamps without gaps: detection, internal escalation, initial report and follow-up report. - From 11 September 2026, the EU Cyber Resilience Act additionally requires reporting of actively exploited vulnerabilities and serious security incidents for manufacturers of products with digital elements. The Federal Office for Cyber Security (BACS) initially introduced the reporting obligation for cyberattacks on critical infrastructure in a cooperative manner and tolerated early teething problems. With the end of this transition phase in mid-2026, the trade publication sidd.swiss announces in its analysis of the NCSC/BACS reporting obligation a more consistent enforcement, particularly for repeated violations and reports that only became known late. For companies, one question moves to the foreground: which timeline they must document without gaps in an emergency. In short To prove that a cyber incident was reported to the Federal Office for Cyber Security on time, a company must document without gaps the moment of discovery, the course of internal escalation, the time of the initial report within 24 hours and the time of the follow-up report. What counts is the moment the attack became known, not the completion of the forensic analysis. 24hrs Deadline for the initial report of a cyberattack to BACS BACS, Information on the reporting obligation 14days Deadline to complete the report with a follow-up report BACS, Information on the reporting obligation 100000CHF Maximum fine for failure to report BACS, Six months of the reporting obligation for cyberattacks on critical infrastructure ## What changes at BACS from mid-2026? After the end of the authority’s transition phase, BACS moves from awareness-raising to consistent enforcement, with particular attention to repeated violations and late reports. The legal basis is the federal Information Security Act, whose contribution to strengthening the digital resilience of the federal government anchors the reporting obligation for operators of critical infrastructure. In the months following its introduction, BACS drew a positive balance: operators reported cyberattacks on time, within 24 hours, as the authority noted in its statement on six months of the reporting obligation. In total, 164 reports were received during this period, as BACS stated in the same communication. Anyone who violates the reporting obligation must, according to BACS, expect a fine of up to CHF 100,000, whereby the authority first contacts the organisation concerned before imposing a sanction. With the end of the transition phase, sidd.swiss expects a tougher line in its analysis, above all for repeated violations and for reports that only became known through media coverage. ## When does the reporting deadline start running? What counts is the moment the attack became known, not the completion of the forensic investigation. sidd.swiss states in its practical analysis of the 24-hour reporting obligation that the deadline begins upon discovery, not at the original time of the attack. For companies, the decisive question thus shifts from technology to organisation: from what point is an incident considered sufficiently identified. Once this threshold is reached, the 24-hour deadline for the initial report to BACS starts running, as the authority sets out in its information on the reporting obligation. Anyone who waits for a complete forensic investigation will, as a rule, already have missed the deadline. BACS explicitly expects a structured initial assessment, not finished forensics. Missing details can be added within 14 days in a follow-up report, as BACS states in its fact sheet on the reporting obligation. ## Which timestamps must a company document? At least four points in time must be verifiable: detection, internal escalation, initial report and follow-up report. Without documented timestamps, it is difficult to prove after the fact that a report was made on time. BACS requires details of the date and time of detection as well as of the attack in the report itself. These details only make sense if they come from unbroken internal logging rather than being reconstructed afterwards. How demanding a complete evidence trail can become over several years is shown by the review of a long-running supervisory investigation in the UBS fine case. - Time of the first indication of an incident - Time of discovery by the responsible unit - Time of internal escalation to management and the persons authorised to report - Time of the initial report to BACS, at the latest 24 hours after discovery - Time of the follow-up report with complete details, at the latest 14 days later ## How does the BACS deadline differ from other reporting obligations? Companies subject to several regulations must keep several clocks in view at once; the BACS 24-hour deadline is only one of them. Regulated financial institutions already know a similar logic from FINMA supervisory practice: for serious incidents, the supervisory authority expects an initial report within 24 hours and a follow-up report within 72 hours. The BACS reporting obligation applies alongside this supervisory duty, but does not replace it. For manufacturers of products with digital elements, a further reporting obligation is added on 11 September 2026: from this date, the EU Cyber Resilience Act requires the reporting of actively exploited vulnerabilities and serious security incidents. A separate article examines where concrete gaps still remain in these CRA reporting obligations. Any company that has not clearly determined whether it qualifies as an operator of critical infrastructure or as an entity subject to NIS2 falls behind on every one of these deadlines. How significant this uncertainty is in practice is shown by the registration gap that many companies only close after a subsequent self-assessment. ## What is the first concrete step towards demonstrable compliance? The first verifiable step is a documented test report that runs through the complete timeline from detection to follow-up report. Companies should run through a test report in their internal playbook within the current quarter and log all four timestamps: detection, escalation, initial report and follow-up report. The person responsible for reporting, whether CISO or information security officer, should be named in writing and given the necessary authority. This exercise provides the basis for presenting a complete and verifiable timeline to BACS in an emergency. For practice ## Key points - Document the moment of discovery as the starting point of the 24-hour deadline, not the completion of the forensic analysis. - Name in writing who triggers the initial report to BACS in an emergency. - Prepare templates for the initial and follow-up report so the 14-day deadline does not pass under time pressure. - Check deadlines running in parallel under FINMA supervision, NIS2 and the Cyber Resilience Act, so that no reporting obligation is overlooked. - Test the reporting chain annually with an exercise to credibly demonstrate the timeline in an emergency. FAQ ## Frequently asked questions ### How high is the fine for a late BACS report? Anyone who violates the reporting obligation must, according to BACS, expect a fine of up to CHF 100,000. Before imposing a sanction, the authority first contacts the organisation concerned. With the end of the transition phase in mid-2026, the trade publication sidd.swiss expects more consistent enforcement, particularly for repeated violations and reports that only became known late. ### How many hours does a company have for the initial report to BACS? The initial report to BACS must be made within 24 hours of discovering the attack. What counts is not the time of the attack itself or the completion of the forensic analysis, but the moment at which the responsible unit within the company classifies the incident as sufficiently identified. ### How long is the deadline for the follow-up report to BACS? BACS allows a deadline of 14 days after the initial report for the follow-up report. In this follow-up report, companies can add details that were not yet fully available in the first, structured initial assessment, such as findings from the forensic analysis. ### Does the BACS reporting obligation apply in addition to the FINMA reporting obligation? Yes. Regulated financial institutions already know from FINMA supervision an initial report within 24 hours and a follow-up report within 72 hours. The BACS reporting obligation for operators of critical infrastructure applies alongside this supervisory duty and does not replace it; both deadlines must be observed in parallel. ### From when does the Cyber Resilience Act reporting obligation apply? From 11 September 2026, the EU Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and serious security incidents. This deadline runs in parallel with the BACS reporting obligation and with further reporting obligations such as NIS2. Sources 1. [Informationen zur Meldepflicht](https://www.ncsc.admin.ch/ncsc/de/home/meldepflicht/meldepflicht-info.html)Bundesamt für Cybersicherheit (BACS) 2. [Sechs Monate Meldepflicht für Cyberangriffe auf kritische Infrastrukturen](https://www.bacs.admin.ch/de/newnsb/gezctyF6KYR7UkCjXBC5s)Bundesamt für Cybersicherheit (BACS) 3. [NCSC / BACS: When Swiss Companies Must Report Cyber Incidents](https://www.sidd.swiss/en/insights/ncsc-bacs-reporting-obligation/)sidd.swiss 4. [24-Stunden-Meldepflicht für Spitäler – ISG/BACS in der Praxis](https://www.sidd.swiss/einblicke/kritis-24h-meldepflicht-spital/)sidd.swiss ## Frequently asked questions ### How high is the fine for a late BACS report? According to BACS, a violation of the reporting obligation can result in a fine of up to CHF 100,000. The authority first contacts the organisation concerned before imposing a sanction. ### How many hours does a company have for the initial report to BACS? The initial report must be made within 24 hours of discovering the attack. The deadline does not depend on the time of the attack or on finished forensics, but on the moment the incident is considered sufficiently identified. ### How long is the deadline for the BACS follow-up report? The follow-up report is due within 14 days. It allows companies to add details that were not yet available in the structured initial assessment. ### Does the BACS reporting obligation replace the FINMA reporting obligation? No. The BACS obligation applies alongside FINMA supervisory practice, which expects an initial report within 24 hours and a follow-up report within 72 hours for serious incidents. Both deadlines must be observed in parallel. ### Which timestamps must a company document for a cyber incident? At least four points in time must be verifiable: detection, internal escalation, initial report and follow-up report. These details should come from unbroken internal logging rather than being reconstructed afterwards.