{"id":70307,"date":"2026-08-28T09:35:08","date_gmt":"2026-08-28T07:35:08","guid":{"rendered":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/"},"modified":"2026-09-10T18:54:07","modified_gmt":"2026-09-10T16:54:07","slug":"isg-isms-obligation-2026-milestones","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/","title":{"rendered":"ISG ISMS Obligation by End of 2026: What Had to Be Settled Before"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">At the end of 2026, a deadline under the Information Security Act expires whose actual starting point already lies two years in the past. The statutory timetable provides for its own intermediate steps in the years before, which precede the build-up of an information security management system (ISMS) and are the substantive precondition for it. Organisations that have skipped these milestones or only partially completed them face considerable time pressure as the final deadline approaches. This article sets out the sequence of steps and shows what those responsible should still check now.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>The ISMS obligation under the Information Security Act ends at the end of 2026, but it does not start there. As early as the end of 2024, affected organisations had to submit a classification catalogue, and by the end of 2025, a protection needs analysis and classification of their IT. Both milestones provide the basis on which risk assessment and security measures within the ISMS can only then be built. Organisations that have not completed these steps lose time that will be missing before the end of 2026.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-what-does-the-information-security-act-s\">What does the Information Security Act specifically require by the end of 2026?<\/a><\/li>\n<li><a href=\"#a2-which-milestone-already-had-to-be-in-pla\">Which milestone already had to be in place by the end of 2024?<\/a><\/li>\n<li><a href=\"#a3-which-milestone-had-to-be-completed-by-t\">Which milestone had to be completed by the end of 2025?<\/a><\/li>\n<li><a href=\"#a4-why-is-the-reporting-duty-for-cyberattac\">Why is the reporting duty for cyberattacks interlinked with ISMS build-up?<\/a><\/li>\n<li><a href=\"#a5-what-should-those-responsible-still-chec\">What should those responsible still check before the deadline expires?<\/a><\/li>\n<\/ol>\n<\/nav>\n<h2 id=\"a1-what-does-the-information-security-act-s\">What does the Information Security Act specifically require by the end of 2026?<\/h2>\n<p>By the end of 2026, the authorities and organisations subject to the Act must operate a functioning ISMS that identifies and assesses risks and continuously reviews the effectiveness of measures.<\/p>\n<p>The Information Security Act (ISG) governs the obligations of federal bodies, the cantons cooperating with the Confederation, and operators of critical infrastructure in Articles 6 to 23 ISG. At its core is the build-up of an information security management system that brings together protection needs analysis, risk assessment and security measures.<\/p>\n<p>What matters is not a single certificate but demonstrability: organisations that know their risks, define responsibilities and document measures fulfil the statutory management logic regardless of the framework chosen. In practice, most affected organisations orient themselves on ISO 27001, because the standard maps precisely this logic into processes that auditors and supervisory bodies recognise.<\/p>\n<div class=\"rc-callout\">\n<p>The ISG does not require certification, but demonstrability of the management logic.<\/p>\n<\/div>\n<h2 id=\"a2-which-milestone-already-had-to-be-in-pla\">Which milestone already had to be in place by the end of 2024?<\/h2>\n<p>By the end of 2024, affected organisations had to draw up a classification catalogue that forms the basis for all subsequent steps.<\/p>\n<p>Without a categorisation of an organisation&#8217;s own information, neither protection needs nor risk can be assessed meaningfully. The classification catalogue determines how sensitive a given piece of information is and what level of protection it therefore requires.<\/p>\n<p>According to the overview of the <a href=\"https:\/\/www.infosec.ch\/beratung\/informationssicherheit\/das-informationssicherheitsgesetz-des-bundes-isg\/\" target=\"_blank\" rel=\"noopener nofollow\">staggered ISG timetable<\/a> published by Swiss Infosec AG, drawing up this catalogue was the first of three milestones preceding the actual ISMS build-up. Organisations that have not created the catalogue, or have only done so superficially, must now complete it retroactively before the following steps can become reliable.<\/p>\n<figure class=\"rc-shot\"><img src=\"https:\/\/swissgrc.com\/wp-content\/uploads\/sites\/2\/2026\/08\/ISMS-Reporting-1024x608-1.png\" alt=\"ISMS Dashboard mit Risiken, Vorf\u00e4llen und Feststellungen in der SwissGRC Plattform\" loading=\"lazy\" decoding=\"async\"><figcaption>Dashboard f\u00fcr Sicherheitsvorf\u00e4lle und Ereignisse in der SwissGRC\u00ae Plattform<\/figcaption><\/figure>\n<h2 id=\"a3-which-milestone-had-to-be-completed-by-t\">Which milestone had to be completed by the end of 2025?<\/h2>\n<p>By the end of 2025, affected bodies had to carry out a protection needs analysis and classify their IT in accordance with the new law.<\/p>\n<p>The protection needs analysis builds directly on the classification catalogue: only once it is established how sensitive a piece of information is can the level of protection required for the associated IT resources be assessed. This classification determines which security measures will later need to apply within the ISMS.<\/p>\n<p>If this classification is missing, the risk catalogue within the ISMS remains incomplete, because risks cannot be prioritised appropriately without a known level of protection need. Only with a complete classification can the build-up of an ISMS be planned so that the remaining time is actually sufficient.<\/p>\n<h2 id=\"a4-why-is-the-reporting-duty-for-cyberattac\">Why is the reporting duty for cyberattacks interlinked with ISMS build-up?<\/h2>\n<p>Because the reporting duty presupposes incident management that must be anchored in the ISMS anyway: detection, assessment and reporting of an event within the statutory deadline.<\/p>\n<p>Operators of critical infrastructure must report a cyberattack to the Federal Office for Cybersecurity within the statutory <a href=\"https:\/\/www.ncsc.admin.ch\/ncsc\/de\/home\/meldepflicht\/meldepflicht-info.html\" target=\"_blank\" rel=\"noopener nofollow\">24-hour reporting deadline<\/a> after its discovery. This deadline can only be met if detection, escalation and reporting are already defined as a process within the ISMS, rather than improvised only once an incident occurs.<\/p>\n<p>Supervisory practice regarding reporting deadlines has since become stricter, for instance with the reporting duty for cyberattacks. Organisations that only build up their ISMS after the 2024 and 2025 milestones have lapsed risk that their reporting processes, too, will be in place too late.<\/p>\n<h2 id=\"a5-what-should-those-responsible-still-chec\">What should those responsible still check before the deadline expires?<\/h2>\n<p>They should honestly compare their own status of classification catalogue, protection needs analysis and ISMS build-up before the remaining time for rework becomes too short.<\/p>\n<p>Where the classification catalogue or the protection needs analysis is missing or outdated, this can no longer simply be made up within the ISMS build-up, but only worked through in parallel with it. This further shortens the already tight remaining period.<\/p>\n<p>Security officers should therefore take stock of the milestones completed so far before the end of the year, and record open points in central documentation for the ISMS build-up rather than spreading them across various spreadsheets. This first step shows how much time actually remains for the ISMS build-up itself.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>Bundle evidence for ISMS milestones centrally<\/h3>\n<p>The Information Security solution maps classification, protection needs and risk assessment within a shared structure. It supports the documentation of the individual ISG milestones through to ISMS evidence.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/en\/information-security-management-isms-software\/\">Information Security <span class=\"rc-pfeil\" aria-hidden=\"true\"><\/span><\/a><\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>Check whether the classification catalogue from the first milestone is complete before continuing with the protection needs analysis.<\/li>\n<li>Complete the protection needs analysis and the classification of your IT, as they form the basis for risk assessment within the ISMS.<\/li>\n<li>Anchor the reporting duty for cyberattacks as a fixed process within the ISMS, rather than improvising it when an incident occurs.<\/li>\n<li>Carry out an honest stocktake of all three milestones before the end of the year to realistically assess the time remaining.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">From when does the ISMS obligation under the Information Security Act apply?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The Information Security Act requires a functioning ISMS by the end of 2026 that identifies and assesses risks and continuously reviews the effectiveness of measures. This deadline applies to federal bodies, cantons cooperating with the Confederation and operators of critical infrastructure, which previously already had to draw up a classification catalogue and a protection needs analysis.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Who is affected by the Information Security Act?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The Information Security Act governs the obligations of federal bodies, the cantons cooperating with the Confederation and operators of critical infrastructure in Articles 6 to 23 ISG. These organisations must build up an information security management system that brings together protection needs analysis, risk assessment and security measures.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Does the ISG require certification to ISO 27001?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>No, the Information Security Act does not require certification, but demonstrability of the statutory management logic: knowing risks, defining responsibilities and documenting measures. Many organisations orient themselves on ISO 27001, because the standard maps this logic into processes that auditors and supervisory bodies recognise.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What happens if the classification catalogue was not drawn up by the end of 2024?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Organisations that have not created the classification catalogue, or have only done so superficially, must now complete it retroactively before the following milestones, such as the protection needs analysis and ISMS build-up, can become reliable. This further shortens the time remaining before the end of 2026, since later steps cannot be built appropriately without this foundation.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Why must the reporting duty for cyberattacks be anchored in the ISMS?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The statutory reporting duty requires a cyberattack to be reported to the Federal Office for Cybersecurity within 24 hours of its discovery. This deadline can only be met if detection, escalation and reporting are already defined as a fixed process within the ISMS, rather than being improvised when an incident occurs.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/www.infosec.ch\/beratung\/informationssicherheit\/das-informationssicherheitsgesetz-des-bundes-isg\/\" target=\"_blank\" rel=\"noopener nofollow\">Staggered timetable for the ISG<\/a><span class=\"rc-source-pub\">Swiss Infosec AG<\/span><\/li>\n<li><a href=\"https:\/\/www.ncsc.admin.ch\/ncsc\/de\/home\/meldepflicht\/meldepflicht-info.html\" target=\"_blank\" rel=\"noopener nofollow\">Information on the reporting duty<\/a><span class=\"rc-source-pub\">Federal Office for Cybersecurity (BACS)<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The ISMS obligation under the Information Security Act ends at the end of 2026, but it does not start there. As early as the end of 2024, affected organisations had to submit a classification catalogue, and by the end of 2025, a protection needs analysis and classification of their IT. Both milestones provide the basis on which risk assessment and security measures within the ISMS can only then be built. Organisations that have not completed these steps lose time that will be missing before the end of 2026.<\/p>\n","protected":false},"author":5,"featured_media":70308,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Fari Ganji","real_author_title":"Chief Information Officer","real_author_bio":"Responsible for the infrastructure behind the platform for GRC, BPM and CLM across Europe, MEA and APAC, and reads security as an operational matter first. ISO 27001, ISO 27017 and ISO 27701 mark the bar he sets for architecture and availability.","real_author_photo":55641,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[144,145,141,142,143],"class_list":["post-70307","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-isms-build-up","tag-reporting-duty-cyberattacks","tag-information-security-act","tag-classification-catalogue","tag-protection-needs-analysis"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance\" \/>\n\t\t<meta property=\"og:description\" content=\"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/isg-isms-obligation-2026-milestones-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/isg-isms-obligation-2026-milestones-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-08-28T07:35:08+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-10T16:54:07+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance\" \/>\n\t\t<meta name=\"twitter:description\" content=\"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/isg-isms-obligation-2026-milestones-swissgrc.webp\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#blogposting\",\"name\":\"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance\",\"headline\":\"ISG ISMS Obligation by End of 2026: What Had to Be Settled Before\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/08\\\/isg-isms-obligation-2026-milestones-swissgrc.webp\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract timeline graphic in magenta, category Regulation & Supervision\"},\"datePublished\":\"2026-08-28T09:35:08+02:00\",\"dateModified\":\"2026-09-10T18:54:07+02:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, ISMS build-up, reporting duty cyberattacks, Information Security Act, classification catalogue, protection needs analysis\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#listItem\",\"name\":\"ISG ISMS Obligation by End of 2026: What Had to Be Settled Before\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#listItem\",\"position\":3,\"name\":\"ISG ISMS Obligation by End of 2026: What Had to Be Settled Before\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#authorImage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/01\\\/logo-red.svg\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/\",\"name\":\"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance\",\"description\":\"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/08\\\/isg-isms-obligation-2026-milestones-swissgrc.webp\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract timeline graphic in magenta, category Regulation & Supervision\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/isg-isms-obligation-2026-milestones\\\/#mainImage\"},\"datePublished\":\"2026-08-28T09:35:08+02:00\",\"dateModified\":\"2026-09-10T18:54:07+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>ISG ISMS Obligation 2026: Timetable and Milestones at a Glance<\/title>\n\n","aioseo_head_json":{"title":"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance","description":"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in","canonical_url":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#blogposting","name":"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance","headline":"ISG ISMS Obligation by End of 2026: What Had to Be Settled Before","author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/isg-isms-obligation-2026-milestones-swissgrc.webp","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract timeline graphic in magenta, category Regulation & Supervision"},"datePublished":"2026-08-28T09:35:08+02:00","dateModified":"2026-09-10T18:54:07+02:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#webpage"},"articleSection":"Regulation &amp; Supervision, ISMS build-up, reporting duty cyberattacks, Information Security Act, classification catalogue, protection needs analysis"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#listItem","name":"ISG ISMS Obligation by End of 2026: What Had to Be Settled Before"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#listItem","position":3,"name":"ISG ISMS Obligation by End of 2026: What Had to Be Settled Before","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/en\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/en\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/en\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#authorImage","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/01\/logo-red.svg","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#webpage","url":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/","name":"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance","description":"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/isg-isms-obligation-2026-milestones-swissgrc.webp","@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#mainImage","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract timeline graphic in magenta, category Regulation & Supervision"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/#mainImage"},"datePublished":"2026-08-28T09:35:08+02:00","dateModified":"2026-09-10T18:54:07+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/en\/#website","url":"https:\/\/swissgrc.com\/en\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"en-GB","publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"}}]},"og:locale":"en_GB","og:site_name":"Swiss GRC | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance","og:description":"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in","og:url":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/","og:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/isg-isms-obligation-2026-milestones-swissgrc.webp","og:image:secure_url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/isg-isms-obligation-2026-milestones-swissgrc.webp","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-08-28T07:35:08+00:00","article:modified_time":"2026-09-10T16:54:07+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance","twitter:description":"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/isg-isms-obligation-2026-milestones-swissgrc.webp","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"7 minutes"},"aioseo_meta_data":{"post_id":"70307","title":"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance","description":"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in","keywords":null,"keyphrases":{"focus":{"keyphrase":"ISMS","score":0,"analysis":[]},"additional":[{"keyphrase":"Information Security Act","score":0,"analysis":[]},{"keyphrase":"classification catalogue","score":0,"analysis":[]},{"keyphrase":"protection needs analysis","score":0,"analysis":[]},{"keyphrase":"ISMS build-up","score":0,"analysis":[]},{"keyphrase":"reporting duty cyberattacks","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance","og_description":"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"ISG ISMS Obligation 2026: Timetable and Milestones at a Glance","twitter_description":"The ISMS obligation under the Information Security Act ends in 2026. The classification catalogue and protection needs analysis already had to be in place in","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-08-28 08:40:36","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":null,"created":"2026-08-28 09:35:08","updated":"2026-09-11 07:37:50","focus_keyword":"ISMS","additional_keywords":[{"word":"Information Security Act","score":94,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"classification catalogue","score":83,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"protection needs analysis","score":83,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"ISMS build-up","score":100,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":9}}},{"word":"reporting duty cyberattacks","score":83,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tISG ISMS Obligation by End of 2026: What Had to Be Settled Before\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/en\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/"},{"label":"ISG ISMS Obligation by End of 2026: What Had to Be Settled Before","link":"https:\/\/swissgrc.com\/en\/isg-isms-obligation-2026-milestones\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/comments?post=70307"}],"version-history":[{"count":6,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70307\/revisions"}],"predecessor-version":[{"id":70327,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70307\/revisions\/70327"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media\/70308"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media?parent=70307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/categories?post=70307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/tags?post=70307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}