Emergency planning is the key to cyber resilience

Cyberattacks that paralyse public services or result in the disclosure of sensitive data can undermine the public's trust in government institutions. Past incidents and the "2025 Myni Gmeind" survey on cybersecurity demonstrate that many communes could enhance their preparedness for cyberincidents. To help communes and organisations in Switzerland strengthen their cyber resilience in a simple and hands-on way, the NCSC has launched a project together with its partner network. As part of this project, an emergency planning model was developed to provide practical guidance on enhancing cyber resilience.

Emergency plans are a vital part of effective risk management. They enable organisations to analyse potential problems and their impacts, and address them proactively. By considering possible risks at an early stage, emergency plans enable organisations to identify and implement preventive measures. The topics covered include crisis organisation, crisis communication, key emergency contacts and concrete measures. Together, these elements form the basis of a coordinated and appropriate response in time-critical situations.

Emergency plan: four phases

Cyberattacks are now commonplace and affect not only large companies, but also communes, public administrations and SMEs. A cyberattack can quickly escalate into a crisis and create uncertainty. That is why every organisation needs an emergency plan. This type of plan has four phases, starting before an attack ever happens.

Phase 1: Incident preparedness

Phase 1 is about preparing for a possible cyberincident. The focus here is on baseline protection: a defined minimum set of technical and organisational security measures that an organisation should implement. This includes incident response plans to prevent incidents from escalating into crises. Key processes must also be defined for emergencies and crises. It is equally important to monitor your supply chain.

Important resources:

Phase 2: An incident occurs

When a cyberincident occurs, every minute counts. Phase 2 begins. This is when the emergency checklist comes into play: it specifies who must be notified of a cyberincident and how the incident should be described.

Phase 3: Incident response

Phase 3 deals with incident response. If the incident cannot be contained quickly or if the impact is serious, the emergency and crisis plan is activated. Clearly defined responsibilities are crucial here. The emergency organisation – and, in the case of a crisis, a crisis management unit – coordinates measures, brings in external support if needed, and takes charge of internal and external communication.

Further information:

Phase 4: Debriefing

In phase 4, the cyberincident and its response are analysed. A structured debriefing helps draw lessons and continuously improve incident, emergency and crisis planning.

Online brownbag lunch: Emergency Planning for SMEs (September 2026)

The NCSC will host two online brownbag lunch sessions for Swiss SMEs on 2 and 9 September, each from 12–1pm, to present the contents of the emergency planning model and the associated resources. The sessions will be held in German and French and will be published on the NCSC's YouTube channel.

To register for the event, visit:
MS Teams: Online brownbag lunch in French on 2 September, 12–1pm
MS Teams: Online brownbag lunch in German on 9 September, 12–1pm

Feedback form

Feedback on the project is collected on an ongoing basis via the feedback form.

Feedback form