Switzerland's 24 hour cyber reporting duty, explained.

The Swiss Information Security Act (Informationssicherheitsgesetz, ISG, SR 128) is Switzerland's framework law for information security in the federal sphere and for the protection of critical infrastructure. In force since 1 January 2024, it introduced, through its cybersecurity provisions, a legal obligation on operators of critical infrastructure to report cyberattacks to the Federal Office for Cyber Security (BACS) within twenty four hours of discovery, applicable since 1 April 2025.

The mechanics are precise. The clock starts when the attack is discovered, not when it is understood. The initial report is made via the Cyber Security Hub, and the operator then has fourteen days to complete it as the picture clarifies. Since 1 October 2025 non compliance is enforceable with fines of up to CHF 100,000. The scope covers the operators the country depends on, with transport undertakings expressly included, which places airports, railways and logistics operators squarely inside the duty.

The uncomfortable truth about a twenty four hour deadline is that no organisation meets it for the first time during a real crisis. Meeting it requires detection that works, an escalation path that has been rehearsed, clarity on who reports and on what authority, and a crisis structure that can produce an accurate initial picture while the technical response is still running. The reporting duty is, in effect, a legal test of your incident capability.