Key facts
Effective since 1 April 2025, critical infrastructure operators must report cyberattacks to the National Cyber Security Centre (NCSC) within 24 hours. For this purpose, the NCSC uses the Cyber Security Hub (CSH) online platform, via which reportable incidents and up-to-date threat and vulnerability data can be exchanged.
The Swiss Federal Audit Office (SFAO) conducted an audit to determine whether the NCSC has a robust cyber reporting platform, both technically and organisationally, and sufficient staffing to perform its statutory tasks in connection with the reporting obligation. It concluded that CSH enables efficient report processing and that the staffing of the incident management team is sufficient.
222
Reports in the first year of mandatory reporting (April to December 2025)
< 1 h
Average report processing time
12
Employees in incident management (GovCERT)
~ 5300
registered users of the Cyber Security Hub (CSH)
Main conclusions
-
Adequate resilience of the CSH
After several outages in 2025, the NCSC migrated the CSH to a new service provider. The new infrastructure has improved availability, but a definitive assessment is not yet possible.
-
Established security processes
Regular penetration tests and code reviews contribute to an appropriate level of security. The NCSC has reduced security risks by automating the management of software components.
-
Lack of redundancy in authentication
Identity and access management remains a potential single point of failure. Plans are in place to integrate additional identity providers.
-
Appropriate technical and organisational security measures
Access controls and communication security are implemented appropriately and meet the statutory requirements.
-
Sufficient staffing
The staffing level and expertise are sufficient for the current reporting volume. Planned staffing increases will create additional capacity for future workload peaks.
-
Efficient processes and rapid initial handling
The defined processes enable structured report processing. The NCSC carries out the initial handling of most incidents promptly.