ICT minimum standard
ICT minimum standards protect critical infrastructure against cyber risks. These standards are mandatory in the electricity and gas sectors, and are recommended for all other sectors. To strengthen ICT resilience, the NCSC provides sector-specific standards.
The increasing digitalisation of all areas of life presents Switzerland with significant economic and social opportunities. However, digitalisation also creates new risks that must be addressed quickly and consistently.
The businesses and organisations concerned are primarily responsible for protecting their own systems. Wherever the functioning of critical infrastructure is affected, the state also has a responsibility to provide protection (AS 2017 3097; Federal Act on the National Economic Supply, National Economic Supply Act, NESA) . The ICT minimum standard is an expression of the state's responsibility to protect citizens, the economy, institutions and public administration.
Recommendations and obligations by sector
All operators of critical infrastructures are advised to implement the respective ICT minimum standards. These standards have been mandatory for electricity providers since 1 July 2024 and for gas providers since 1 July 2025. However, the standards also offer guidance to all other companies and organisations on how to improve their own ICT resilience.
The Federal Office for National Economic Supply (FONES) has developed preventive measures to strengthen the resilience of critical ICT infrastructure and has drawn up sector-specific ICT minimum standards for this purpose.
Responsibilities were reallocated as part of the strategy review and the establishment of the National Cyber Security Centre (NCSC). Since March 2024, the NCSC has been responsible for the ICT minimum standards.
Industry standards
The NCSC collaborates with industry associations to develop minimum ICT standards tailored to different critical sectors. The standards for each sector are listed below: