{"id":70782,"date":"2026-09-27T23:29:55","date_gmt":"2026-09-27T21:29:55","guid":{"rendered":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/"},"modified":"2026-09-27T23:42:01","modified_gmt":"2026-09-27T21:42:01","slug":"new-cybersecurity-act-switzerland-what-matters-now","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/","title":{"rendered":"New Cybersecurity Act in Switzerland: what matters now"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">At its meeting of 25 September 2026, the Federal Council instructed the DDPS to draft, by June 2027, a consultation proposal for a new, standalone Cybersecurity Act. The text of the act itself is therefore not yet available, but its direction, the areas affected and part of the operational practice can already be derived today from current law and official communications. Those responsible for governance, risk and compliance can use the time until the consultation for concrete preparatory work.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>On 25 September 2026, the Federal Council instructed the DDPS to prepare a consultation draft for a new Cybersecurity Act by June 2027, bundling three initiatives on products, data and cloud services and taking over the existing reporting obligation for critical infrastructure. Until then, it is worth taking stock of the affected sectors, products, data and reporting channels.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-what-did-the-federal-council-decide-on-2\">What did the Federal Council decide on 25 September 2026?<\/a><\/li>\n<li><a href=\"#a2-which-three-topics-does-the-cybersecurit\">Which three topics does the Cybersecurity Act bundle?<\/a><\/li>\n<li><a href=\"#a3-what-happens-to-the-existing-reporting-o\">What happens to the existing reporting obligation for critical infrastructure?<\/a><\/li>\n<li><a href=\"#a4-what-preparatory-work-can-already-be-don\">What preparatory work can already be done now?<\/a><\/li>\n<li><a href=\"#a5-what-is-the-next-concrete-step\">What is the next concrete step?<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"rc-figures\">\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"24\">24<span class=\"unit\">hrs<\/span><\/div>\n<div class=\"rc-figure-label\">Deadline for reporting a cyber attack on critical infrastructure<\/div>\n<div class=\"rc-figure-src\">NCSC, information on the reporting obligation<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"14\">14<span class=\"unit\">days<\/span><\/div>\n<div class=\"rc-figure-label\">Additional period to complete an initial report<\/div>\n<div class=\"rc-figure-src\">NCSC, information on the reporting obligation<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"164\">164<span class=\"unit\">reports<\/span><\/div>\n<div class=\"rc-figure-label\">Reports from critical infrastructure in the first six months<\/div>\n<div class=\"rc-figure-src\">NCSC, media release, 29 September 2025<\/div>\n<\/div>\n<\/div>\n<h2 id=\"a1-what-did-the-federal-council-decide-on-2\">What did the Federal Council decide on 25 September 2026?<\/h2>\n<p>The Federal Council instructed the DDPS to submit a consultation draft for a new <a href=\"https:\/\/www.admin.ch\/de\/newnsb\/zX9oNK8tuI-Z\" target=\"_blank\" rel=\"noopener nofollow\">Cybersecurity Act<\/a> by June 2027; this emerges from a media release dated 24 September 2026.<\/p>\n<p>The act is intended to implement three parliamentary motions in a single piece of legislation. Originally, separate amendments to the Information Security Act were planned for this purpose, but the three initiatives concern complementary regulatory levels: products, data and digital infrastructure.<\/p>\n<p>The Federal Office for Cyber Security is already working on the underlying legislative projects: the cyber resilience of products with digital elements, the protection of particularly important digital data, and the role of hosting and cloud providers in cyber security.<\/p>\n<h2 id=\"a2-which-three-topics-does-the-cybersecurit\">Which three topics does the Cybersecurity Act bundle?<\/h2>\n<p>The Cybersecurity Act is intended to set binding requirements for manufacturers, importers and distributors of software and hardware products, to regulate the protection of particularly important digital data, and to define obligations for hosting and cloud providers.<\/p>\n<p>For products, the plan provides for a foundation for market surveillance and a sales ban for insecure products. The rule is modelled on the European Cyber Resilience Act and is intended to keep the administrative burden on companies low.<\/p>\n<p>The Federal Council does not intend to touch sector-specific regulations such as the Telecommunications Act, the Electricity Supply Ordinance or the Ordinance on Telecommunications Installations. The Cybersecurity Act is meant to supplement these regulations with cross-cutting obligations, as reported by Netzwoche.<\/p>\n<h2 id=\"a3-what-happens-to-the-existing-reporting-o\">What happens to the existing reporting obligation for critical infrastructure?<\/h2>\n<p>The reporting obligation for cyber attacks on critical infrastructure, in force since 1 April 2025, is to be transferred from the Information Security Act into the new Cybersecurity Act; the Information Security Act will in future govern only the information security of federal authorities.<\/p>\n<p>Operators of critical infrastructure must report cyber attacks to the NCSC within 24 hours of detection. If not all details can be provided in the initial report, a further 14 days are available to complete it.<\/p>\n<p>Since 1 October 2025, violations of the reporting obligation for critical infrastructure can result in fines of up to CHF 100,000; however, the NCSC must first contact operators who are in default, as SwissCybersecurity.net reported on 30 September 2025.<\/p>\n<p>Six months after its introduction, the NCSC counted a total of 164 reports in a <a href=\"https:\/\/www.bacs.admin.ch\/de\/newnsb\/gezctyF6KYR7UkCjXBC5s\" target=\"_blank\" rel=\"noopener nofollow\">review<\/a> dated 29 September 2025, with the financial sector most affected.<\/p>\n<p>In parallel, on 6 May 2026 the Federal Council instructed the DDPS to prepare a separate revision of the Information Security Act; the consultation on this is planned for mid-2027. A working group led by SEPOS is preparing it with the involvement of the Federal Chancellery, the departments, and representatives of other federal authorities and the cantons.<\/p>\n<h2 id=\"a4-what-preparatory-work-can-already-be-don\">What preparatory work can already be done now?<\/h2>\n<p>Even without the text of the act, companies can already check whether they are affected, document their existing reporting practice, and clarify internal responsibility for the three regulatory areas.<\/p>\n<p>Companies that have already structured their own ISMS obligation under the Information Security Act within the existing deadlines can use the same systematic approach for the new areas of the Cybersecurity Act. This concerns in particular the allocation of responsibilities between the CISO, compliance and executive management.<\/p>\n<ul>\n<li>Check whether the company itself falls under one of the nine sectors of critical infrastructure: authorities, energy, waste disposal, finance, health, information and communication, food, public safety, and transport, as described in Article 74b paragraph 1 of the Information Security Act.<\/li>\n<li>Document reporting channels and internal escalation for the 24-hour deadline, regardless of the future text of the act.<\/li>\n<li>Prepare an inventory of which products with digital elements, which data, and which hosting or cloud services could in future fall under the Cybersecurity Act.<\/li>\n<\/ul>\n<h2 id=\"a5-what-is-the-next-concrete-step\">What is the next concrete step?<\/h2>\n<p>Risk owners should prepare an internal overview of the affected products, data and cloud services by the time the consultation draft is published in June 2027, and compare it directly with the draft once the text of the act is available.<\/p>\n<p>A first step is to compile the existing reporting channels and deadlines from practice since 1 April 2025, supplemented by a list of the products, data categories and service providers that could become relevant in the three regulatory areas of the Cybersecurity Act. This overview can be maintained independently of the text of the act and compared with the obligations available in 2027.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>Structure reporting pathways today<\/h3>\n<p>The Information Security solution maps reporting pathways and deadlines for critical infrastructure. It can already be used today to structure future obligations under the Cybersecurity Act in a systematic way.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/en\/information-security-management-isms-software\/\">Information Security <span class=\"rc-pfeil\" aria-hidden=\"true\"><\/span><\/a><\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>The text of the Cybersecurity Act will only be available with the consultation draft in June 2027, but the three regulatory areas of products, data and infrastructure have already been named.<\/li>\n<li>The reporting obligation in force since 1 April 2025, with its 24-hour deadline, will be transferred into the Cybersecurity Act; the Information Security Act will in future remain responsible only for federal authorities.<\/li>\n<li>Companies can already check whether they belong to one of the nine sectors of critical infrastructure under Article 74b of the Information Security Act.<\/li>\n<li>An inventory of products, data and cloud services can be started independently of the text of the act and compared directly once it is available.<\/li>\n<li>Sanctions for violations of the reporting obligation have already been in force since 1 October 2025, with fines of up to CHF 100,000.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">When will the new Cybersecurity Act enter into force?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>A specific date of entry into force has not yet been set. On 25 September 2026, the Federal Council instructed the DDPS to prepare a consultation draft by June 2027. Only after the consultation, parliamentary deliberation and any referendum period can the Cybersecurity Act enter into force; a specific date cannot currently be given.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Which nine sectors count as critical infrastructure in Switzerland?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Article 74b paragraph 1 of the Information Security Act names the sectors authorities, energy, waste disposal, finance, health, information and communication, food, public safety and transport. Companies in these areas are already subject to the reporting obligation for cyber attacks today and should check whether this classification will continue to apply once the Cybersecurity Act is introduced.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Within what deadline must cyber attacks be reported?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Operators of critical infrastructure must report a cyber attack to the NCSC within 24 hours of detection. If not all details can be provided in the initial report, a further 14 days are available to complete it. This rule, in force since 1 April 2025, is to be transferred into the Cybersecurity Act.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What fines apply for violations of the reporting obligation?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Since 1 October 2025, violations of the reporting obligation can result in fines of up to CHF 100,000. However, the NCSC must first contact operators who are in default before a fine can be imposed, as SwissCybersecurity.net reported.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">How does the Cybersecurity Act affect the Information Security Act?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The reporting obligation for critical infrastructure is being transferred from the Information Security Act into the new Cybersecurity Act. In future, the Information Security Act will govern only the information security of federal authorities. In parallel, a working group led by SEPOS is preparing a separate revision of the Information Security Act, with the consultation planned for mid-2027.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/www.admin.ch\/de\/newnsb\/zX9oNK8tuI-Z\" target=\"_blank\" rel=\"noopener nofollow\">Federal Council instructs DDPS to draft Cybersecurity Act<\/a><span class=\"rc-source-pub\">admin.ch<\/span><\/li>\n<li><a href=\"https:\/\/www.bacs.admin.ch\/de\/newnsb\/gezctyF6KYR7UkCjXBC5s\" target=\"_blank\" rel=\"noopener nofollow\">First review of the reporting obligation for critical infrastructure<\/a><span class=\"rc-source-pub\">NCSC<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>On 25 September 2026, the Federal Council instructed the DDPS to prepare a consultation draft for a new Cybersecurity Act by June 2027, bundling three initiatives on products, data and cloud services and taking over the existing reporting obligation for critical infrastructure. Until then, it is worth taking stock of the affected sectors, products, data and reporting channels.<\/p>\n","protected":false},"author":5,"featured_media":70783,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Yahya Mohamed Mao","real_author_title":"Chief Marketing Officer","real_author_bio":"Views GRC through the lens of market, brand and growth. Writes about making complex topics accessible, building trust and what it takes to position and scale a specialized software platform internationally.","real_author_photo":70555,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[141,191,215,216],"class_list":["post-70782","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-information-security-act","tag-cyber-resilience-act-switzerland","tag-reporting-obligation-critical-infrastructure","tag-ncsc-reporting-deadline"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"New Cybersecurity Act Switzerland: what matters now\" \/>\n\t\t<meta property=\"og:description\" content=\"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/09\/new-cybersecurity-act-switzerland-what-matters-now-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/09\/new-cybersecurity-act-switzerland-what-matters-now-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-27T21:29:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-27T21:42:01+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"New Cybersecurity Act Switzerland: what matters now\" \/>\n\t\t<meta name=\"twitter:description\" content=\"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/09\/new-cybersecurity-act-switzerland-what-matters-now-swissgrc.webp\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#blogposting\",\"name\":\"New Cybersecurity Act Switzerland: what matters now\",\"headline\":\"New Cybersecurity Act in Switzerland: what matters now\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/09\\\/new-cybersecurity-act-switzerland-what-matters-now-swissgrc.webp\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract network graphic in deep teal, category Regulation & Supervision\"},\"datePublished\":\"2026-09-27T23:29:55+02:00\",\"dateModified\":\"2026-09-27T23:42:01+02:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, Information Security Act, Cyber Resilience Act Switzerland, Reporting obligation critical infrastructure, NCSC reporting deadline\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#listItem\",\"name\":\"New Cybersecurity Act in Switzerland: what matters now\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#listItem\",\"position\":3,\"name\":\"New Cybersecurity Act in Switzerland: what matters now\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#authorImage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/01\\\/logo-red.svg\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/\",\"name\":\"New Cybersecurity Act Switzerland: what matters now\",\"description\":\"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/09\\\/new-cybersecurity-act-switzerland-what-matters-now-swissgrc.webp\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract network graphic in deep teal, category Regulation & Supervision\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/new-cybersecurity-act-switzerland-what-matters-now\\\/#mainImage\"},\"datePublished\":\"2026-09-27T23:29:55+02:00\",\"dateModified\":\"2026-09-27T23:42:01+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>New Cybersecurity Act Switzerland: what matters now<\/title>\n\n","aioseo_head_json":{"title":"New Cybersecurity Act Switzerland: what matters now","description":"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.","canonical_url":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#blogposting","name":"New Cybersecurity Act Switzerland: what matters now","headline":"New Cybersecurity Act in Switzerland: what matters now","author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/09\/new-cybersecurity-act-switzerland-what-matters-now-swissgrc.webp","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract network graphic in deep teal, category Regulation & Supervision"},"datePublished":"2026-09-27T23:29:55+02:00","dateModified":"2026-09-27T23:42:01+02:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#webpage"},"articleSection":"Regulation &amp; Supervision, Information Security Act, Cyber Resilience Act Switzerland, Reporting obligation critical infrastructure, NCSC reporting deadline"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#listItem","name":"New Cybersecurity Act in Switzerland: what matters now"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#listItem","position":3,"name":"New Cybersecurity Act in Switzerland: what matters now","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/en\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/en\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/en\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#authorImage","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/01\/logo-red.svg","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#webpage","url":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/","name":"New Cybersecurity Act Switzerland: what matters now","description":"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/09\/new-cybersecurity-act-switzerland-what-matters-now-swissgrc.webp","@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#mainImage","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract network graphic in deep teal, category Regulation & Supervision"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/#mainImage"},"datePublished":"2026-09-27T23:29:55+02:00","dateModified":"2026-09-27T23:42:01+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/en\/#website","url":"https:\/\/swissgrc.com\/en\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"en-GB","publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"}}]},"og:locale":"en_GB","og:site_name":"Swiss GRC | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"New Cybersecurity Act Switzerland: what matters now","og:description":"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.","og:url":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/","og:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/09\/new-cybersecurity-act-switzerland-what-matters-now-swissgrc.webp","og:image:secure_url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/09\/new-cybersecurity-act-switzerland-what-matters-now-swissgrc.webp","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-09-27T21:29:55+00:00","article:modified_time":"2026-09-27T21:42:01+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"New Cybersecurity Act Switzerland: what matters now","twitter:description":"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/09\/new-cybersecurity-act-switzerland-what-matters-now-swissgrc.webp","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"7 minutes"},"aioseo_meta_data":{"post_id":"70782","title":"New Cybersecurity Act Switzerland: what matters now","description":"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.","keywords":null,"keyphrases":{"focus":{"keyphrase":"Cybersecurity Act","score":0,"analysis":[]},"additional":[{"keyphrase":"Reporting obligation critical infrastructure","score":0,"analysis":[]},{"keyphrase":"Information Security Act","score":0,"analysis":[]},{"keyphrase":"NCSC reporting deadline","score":0,"analysis":[]},{"keyphrase":"Cyber Resilience Act Switzerland","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"New Cybersecurity Act Switzerland: what matters now","og_description":"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"New Cybersecurity Act Switzerland: what matters now","twitter_description":"The Federal Council is planning a new Cybersecurity Act. Find out which sectors are affected and how to prepare in a targeted way now.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-09-27 21:43:29","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-09-21 12:55:06","updated":"2026-09-27 21:43:29","focus_keyword":"Cybersecurity Act","additional_keywords":[{"word":"Reporting obligation critical infrastructure","score":78,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"Information Security Act","score":78,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"NCSC reporting deadline","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"Cyber Resilience Act Switzerland","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tNew Cybersecurity Act in Switzerland: what matters now\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/en\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/en\/category\/regulation-supervision\/"},{"label":"New Cybersecurity Act in Switzerland: what matters now","link":"https:\/\/swissgrc.com\/en\/new-cybersecurity-act-switzerland-what-matters-now\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70782","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/comments?post=70782"}],"version-history":[{"count":1,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70782\/revisions"}],"predecessor-version":[{"id":70784,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70782\/revisions\/70784"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media\/70783"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media?parent=70782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/categories?post=70782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/tags?post=70782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}