## 1cheea2025005-source-pdf

## Source details

**Canonical URL:** [1cheea2025005-source-pdf](https://www.imf.org/-/media/files/publications/cr/2025/english/1cheea2025005-source-pdf.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2025/english/1cheea2025005-source-pdf.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2025/english/1cheea2025005-source-pdf.pdf.json)

---

### EXECUTIVE SUMMARY — Major Findings
- Cyber security is recognized as one of the major risks in Switzerland by both authorities and financial market players.
- With digitalization, cyber incidents have been increasing in frequency and sophistication, including in the financial sector.
- The Swiss National Bank (SNB) and the Swiss Financial Market Supervisory Authority (FINMA) tag cyber risk as a significant threat to the financial sector.
- The Financial Sector–Cyber Security Centre (FS-CSC), a new public-private partnership, supports threat intelligence sharing, cyber exercises and tests, incident response assistance, and active information sharing.
- The National Cyber Security Center (NCSC) was established in 2020 to coordinate cyber security matters at the country level.
- Key regulatory initiatives include the Operational Risks and Resilience Circular from 2022 and FINMA’s Guidance from 2020 and 2024, which cover the duty to report cyberattacks.
- Amendments to the Information Security Act (ISA) for incident reporting requirements on critical infrastructure are effective in 2025.
- Third-party related cyber incidents accounted for fifty percent and thirty percent of the reported incidents in 2023 and 2024, respectively.
- Reporting by individuals to GovCERT accounted for 90 percent of cases; the rest was from corporates.
- Cyber incidents reported to GovCERT have increased significantly over the years, although reporting is on a voluntary basis and the actual number of incidents could be much higher.
- Switzerland’s cyber maturity rankings: 27th place in the National Cyber Security Index; 42nd place (2020 report) in the Cyber Security Index by the International Telecom Union; September 2024 Cyber Security Index places Switzerland in the second tier—"Advancing Category," whereas the first tier already has 45 countries.

### Progress and Shortcomings
- The cyber risk management framework has recently been strengthened, but several major changes are still to be implemented over the next two to three years.
- Several provisions in the Operational Risk and Resilience Circular, issued in 2023, have a significant transition time (1–2 years).
- Several assessments (GCSCC/University of Oxford; GCSCC’s Cyber Security Capacity Maturity Model for Nations) identify gaps and make recommendations; more work is needed despite progress.
- Banks’ cyber risk supervision relies heavily on external audit firms and to a lesser extent on FINMA’s direct onsite supervision; offsite supervision is limited.
- The “Cyber Risk Management” procedures were updated in November 2023 and became operational in 2024.
- Testing practices can be further improved by developing a framework and conducting tests more regularly.
- There is a need for stricter regulation, more effective supervision, and increased coordination across authorities.
- The financial system is only as strong as its weakest link; expanding regulatory scope beyond banks to encompass the entire financial sector would increase cyber preparedness and the attractiveness of the Swiss Financial Center (SFC).

### Institutional and Coordination Observations
- FINMA is the unified supervisor of banks, insurance companies, securities firms, asset managers, many of which are large, complex, and globally active. Switzerland is home to a G-SIB (UBS) and major internationally active insurers (Swiss Re Group, Zurich Insurance Group). The systemically important financial market infrastructure is SIX Group.
- Coordination is fragmented:
  - SNB is mandated for financial stability analysis and cyber resilience stress testing;
  - FINMA coordinates supervision of individual entities;
  - Prosecution of cybercrime is the responsibility of cantonal authorities;
  - Cyber security is addressed by both federal and cantonal authorities.
- Enhancing coordination between FINMA, NCSC, and the Federal Data Protection Agency (FDPA) regarding incident reporting frameworks, and formalizing arrangements between FINMA and FDPA, would reinforce the cyber risk oversight framework.
- GovCERT’s mandate could be expanded; consideration of legal measures to empower GovCERT to investigate systemic cyber incidents is a medium-term option.

### Supervisory and Resourcing Needs
- FINMA should gradually increase its direct onsite supervision and reduce dependence on external auditors.
- FINMA, SNB, and NCSC staff resources should be reinforced substantially to adequately monitor cyber risks.
- FINMA should strengthen off-site supervision by collecting key risk indicators and data for mapping.
- SNB should augment resources to have a complete understanding of the cyber risk profile of Systemically Important Financial Market Infrastructures (SFMI).
- FINMA should augment resources in the Banking-Operational, Cyber, and IT risk unit to improve cyber risk supervision.

### Testing and Resilience Recommendations
- Develop a testing framework appropriate for the Switzerland market to achieve consistency in results across institutions.
- Conduct stress tests with severe but plausible cyber scenarios to assess impact on the financial sector.
- Conduct cyber resilience stress tests for the financial sector.

### Legal and Regulatory Context
- Cyberattacks are criminalized under the Swiss Criminal Act; Article 143 sets unauthorized access to data processing systems with a maximum penalty of three years or a monetary penalty.
- Various legal acts empower FINMA to supervise financial institutions and market infrastructures and require boards to identify, mitigate, and monitor all material risks; FINMA can use these provisions to supervise cyber risks even without standalone cyber regulation.
- Article 3 (f)(2) of the Banking Act requires financial groups and conglomerates to be organized to specifically detect, mitigate, and monitor all material risks.
- The Financial Market Infrastructure Act (Fin MIA): Article 14 requires systemically important FMIs to operate IT systems protecting confidentiality and integrity of information regarding participants and transactions; Article 23 requires special requirements to protect against risks they pose to financial stability, as determined by the SNB.

### Key Recommendations (Table 1: Switzerland: 2025 FSAP: Key Recommendations)
- Legal and Regulatory Framework
  - 1. Strengthen legal measures to facilitate effective supervision of critical third-party service providers to the financial sector (¶18). — FINMA, SIF, NCSC — ST
  - 2. Consider introducing legal measures to empower GovCERT to investigate systemic cyber incidents (¶18). — NCSC — MT
  - 3. Provide adequate resources to GovCERT to ensure effective functioning, including to support the financial sector (¶25). — NCSC — I
  - 4. Extend ICT / cyber and outsourcing regulations to all parts of the financial sector (¶36). — FINMA — ST
  - 5. Consider options to limit further concentration in the SIX group and to de-risk the existing levels of concentration (¶44). — SNB, FINMA — ST
- Institutional Elements
  - 6. Enhance coordination between FINMA, FDPA, and NCSC regarding incident reporting frameworks (¶54). — FINMA, FDPA, NCSC — ST
  - 7. Formalize arrangements between the FDPA and FINMA to enhance further cooperation (¶64). — FINMA, FDPA — ST
- Supervisory Arrangements
  - 8. Reduce the dependence on external auditors and correspondingly increase on-site examinations (¶84). — FINMA — ST
  - 9. Review the on-site supervision policy with an aim to increase FINMA’s on-site activity, explore synergies between IT and cyber risk examination units, and strengthen off-site supervision by collecting key risk indicators and data for mapping (¶85). — FINMA — ST
  - 10. Introduce regular reporting to the Board covering the analysis of the threat landscape, type and trend of incidents, regulatory environment, supervisory actions, and material gaps in the preparedness (¶ 85). — FINMA — I
  - 11. Collect, in the form of a regular off-site report, a summary of cyber incidents comprising all categories to better understand the overall threat landscape (¶93). — FINMA — ST
  - 12. Revise the incident reporting regulation to address the gaps, consider the Format for Incident Reporting and Exchange (FIRE) format to make incident reporting template comprehensive, and issue a circular on the topic (¶92). — FINMA — ST
  - 13. Augment resources within SNB to have a complete understanding of the cyber risk profile of Systemically Important Financial Market Infrastructures (SFMI) (¶99). — SNB — I
  - 14. Augment resources in the FINMA Banking-Operational, Cyber, and IT risk unit to improve cyber risk supervision (¶98). — FINMA — I
- Financial Sector Resilience
  - 15. Develop a testing framework that is appropriate for the Switzerland market to achieve consistency in the results across institutions (¶108). — FINMA — MT
  - 16. Conduct stress tests with severe but plausible cyber scenarios to assess impact on the financial sector (¶110). — SNB, FINMA — ST
  - 17. Conduct cyber resilience stress tests for the financial sector (¶110). — SNB, FINMA — ST
- Selected Cyber Security Considerations at SNB and FINMA
  - 18. Assess the impact of the Information Security Act (ISA) and take necessary action to comply with its provisions (¶113). — SNB — I

- Footnote on timeframes: I Immediate (within 1 year); ST Short term (within 1-2 years); MT Medium Term (within 3−5 years).

### Scope of the Technical Note
- Focus: cyber risk regulatory and supervisory practices within the financial sector broadly, with specific attention to systemically important banks (SIBs), insurance companies, and financial market infrastructure (FMI).
- Assessment considered institutional arrangements, legal, organizational, coordination measures, cyber risk regulations, licensing practices, supervisory practices covering governance, risk management, cyber security, incident reporting, and testing arrangements.
- Also considered enabling initiatives: information sharing, awareness building, and public-private partnerships.
- The assessment relied on answers from SNB, FINMA, State Secretariat of International Finance (SIF), and NCSC; interviews and discussions with stakeholders; and review of certain confidential documents provided in a trust room.

### DUTY TO PROVIDE INFORMATION AND INCIDENT REPORTING FRAMEWORK (Article 29 FINMASA and ISA)
- Article 29 of FINMASA requires that the supervised entities and their audit companies immediately report to FINMA any incident of substantial importance.
- Reporting requirement extends to third parties to whom essential functions of a bank are outsourced; per Article 23 of the Banking Act, FINMA can carry out checks on these outsourced entities at any time.
- Equivalent check powers are not available for other non-bank supervised entities, constraining FINMA’s powers.
- ISA (2024) covers federal and cantonal authorities and critical infrastructures in private and public sectors. Financial sector is identified as critical infrastructure.
- Four ordinances drawing from ISA: Information Security Ordinance (ISO); Ordinance on Security Checks on Persons (VPSP); Ordinance on the Company Security Procedure (VBSV); Ordinance on Federal Identity Management Systems and Directory Services (IAMV).
- A cyber security ordinance specifying reporting requirements for critical infrastructures under the ISA is scheduled to come into force on April 1, 2025.
- ISA amended to include cyber incident reporting obligation for all identified critical infrastructures, which came into force in January 2025.
- ISA incorporated amendments in other laws: Federal Law on Public Procurement; Data Protection Act; Financial Market Supervision Act (enabling FINMA to share non-publicly available information with other supervisors, NCSC, and SNB).
- Data Protection Act (FADP, 2020) revision: proposed amendment to strengthen equivalence with EU GDPR; requires prompt notification to the FDPIC in the event of a data security breach.

### Recommended Legal Strengthenings (from assessment)
- Vest powers with GovCERT (NCSC) to investigate systemic cyber incidents:
  - Current ISA empowers GovCERT to receive incident reports but does not empower it to investigate a systemic cyber incident if the victim company does not seek help.
  - Recommendation: Vest GovCERT with powers to take proactive steps without delay where incidents have contagion potential to the whole sector or protective measures are needed and the victim does not request or cooperate.
- Strengthen powers of financial sector regulators to effectively supervise critical third parties:
  - Third-party providers pose significant risk; recent incidents targeted third parties to steal information from federal agencies and the financial sector.
  - Recommendation: Appropriate legal measures to strengthen supervisors’ oversight of critical service providers.

### National Cyber Strategy (NCS) and Institutional Roles
- NCS chronology:
  - First NCS: 2012–2017
  - Second NCS: 2017–22
  - Third/current NCS approved April 2023; no fixed end date; reviewed every five years by NCSC.
- NCSC role: Steering Committee office; provides regular implementation updates to the Federal Council.
- NCS principle: subsidiary and partnership role of the state—state intervenes only when welfare is seriously threatened and private actors cannot or will not solve the problem.
- NCSC does not interfere in supervisory and regulatory activities of FINMA and SNB; provides cyber security expertise.
- Assessment: NCSC/GovCERT require strengthened resources and authority given cross-cutting responsibilities.

### Critical Information Infrastructure Protection (CIP)
- FOCP coordinates identification and publication of critical infrastructures.
- CI list: ten sectors divided into 27 subsectors; financial sector identified with financial and insurance services as subsectors.
- CIP inventory identifies individual CI elements, including IT systems; inventory not publicly available.
- ISA support provisions for CI operators (Art.74): early identification and assessment; detection of incidents; maintaining/restoring information security; follow-up of incidents.
- ISA requires IT resources to be classified within two years of entry into force and technical measures to ensure information security must be implemented within six years of entry into force.

### Scope, Applicability of Regulation and FINMA Supervision
- Operational, cyber, and IT risk unit in the Banking Division (B-OCI) is responsible for FINMA’s supervision of IT and cyber risks, operational risk and resilience in banks, business continuity, and outsourcing.
- Key FINMA regulations/guidance: Corporate Governance Circular (2017); Operational Risk Circular (2008) replaced by Operational Risk and Operational Resilience Circular (2023/1); Guidance on Incident Reporting (05/2020); Outsourcing Circular (2018).
- Applicability:
  - Outsourcing regulation applicable to banks, insurers and securities firms.
  - Operational resilience regulation and corporate governance regulation applicable to banks, financial groups, fintech firms and investment firms.
  - Incident reporting guidance applicable to all supervised entities.
- FINMA issued guidance in 2024 on supervisory findings, incident reporting and cyber scenario exercises (03/2024) and on operational risk to fund management companies and collective investments managers (04/2024).

### FINMA Incident Reporting: Requirements, Trends, and Data Gaps
- FINMA Guidance on “Duty to report cyberattacks” (pursuant to Article 29 para. 2 FINMASA, 2020):
  - Entities must report any medium and above category cyber incident within 24 hours, submit relevant details in a prescribed format within 72 hours, and continue follow-through reports until the incident is fully resolved and closed.
- FINMA incident reporting statistics:
  - Incidents reported to FINMA since introduction: about 280 incidents total.
  - Incidents reported by sector: banks = 78; insurers = 60; asset managers = 147; market infrastructure = 3.
  - Compared to 74 incidents reported in 2023, until October 2024, 54 incidents have been reported.
- Data limitations: FINMA’s reporting format does not capture amounts of losses incurred or potential losses for each incident.
- Recommendations:
  - Upgrade incident reporting from guidance to circular.
  - Consider the Format for Incident Reporting and Exchange (FIRE) format.
  - Collect a summary of cyber incidents comprising all categories in a regular off-site report; capture quantum of losses, customer losses, and number of incidents for each type at least quarterly.

### GOVCERT ACTIVITY AND INCIDENT TRENDS (2019–H1 2024)
- GovCERT role: technical services analyzing/managing cyber threats; official CERT of Swiss government; member of FIRST, EGC, IWWN; constituency: Swiss Federal Administration and private/public sectors.
- Reported incidents increased by more than 100 percent during 2020-21 and thereafter moderated to 59.0 percent and 38.6 percent for the years 2021-22 and 2022-23.
- Cyber incidents reported during the first half of 2024 stood at 34789 (19048 during the first half of 2023), exhibiting a growth of 82.6 percent over corresponding period of the previous year.
- 90 percent of reports came from individuals and the rest from corporates.
- Notable cyberattacks (past two years): DDoS attacks in June 2023; ransomware attack on ‘Convevis’; ‘Poseidon campaign’ targeting Swiss macOS users; hacker attack on ‘Xplain’.
- Recommendation: Strengthen GovCERT resources and legal powers; current GovCERT staff: 12 FTEs for GovCERT function (total NCSC staff = 67).

### FINANCIAL SECTOR RESILIENCE — Information Sharing, Exercises, and Testing
- FS-CSC:
  - Public-private partnership; association of currently 171 members from the financial sector on a voluntary basis.
  - Supported by SIF, SNB, NCSC and FINMA.
  - Activities: information sharing, working groups, guidelines, exercises and tests, systemic crisis handling.
- Testing and exercises:
  - Operational resilience circular (2023/1) mandates red team testing, vulnerability assessments and penetration testing.
  - FINMA does not have a published testing framework (e.g., CBEST or TIBER-EU equivalent).
  - SNB, FINMA, SIF and NCSC participate annually in strategic tabletop exercises organized by FS-CSC.
  - A successful operational cyber exercise with over 100 participants was carried out on November 27, 2023.
- Assessment and recommendations:
  - Extend operational risk and resilience circular to other parts of the financial sector proportionately.
  - Develop a testing framework appropriate for Switzerland to ensure consistency and comparability across institutions.

### FINANCIAL MARKET INFRASTRUCTURES (FMIs), SIX GROUP, AND CONCENTRATION RISK
- SIX Group:
  - Operates critical FMIs and plays many key roles; operates exchanges and multiple FMIs, each incorporated separately under FINMA supervision.
  - Acquired Bolsas y Mercados Españoles (BME) in Spain; presence in Germany; plans for further expansion.
  - For SIC it is a third-party to the SNB.
- Assessment findings:
  - SIX’s central role suggests designation as “Too Big to Fail Institution” and further strengthened supervision.
  - A systemic cyber incident in the SIX group could potentially have systemic devastating implications.
  - SIX has made operations ransomware proof; contingency arrangements exist for SIC to operate with lesser capacity if data centres are unavailable.
  - Progress falls short for local and Spanish operations; Swiss entities exhibit higher maturity compared to Spanish entities.
- Recommendation: Consider options to limit further concentration in the SIX group and de-risk existing concentration; ensure concentration levels do not further increase leveraging licensing and oversight powers.

### FMIs — Legal Framework and SNB/FINMA Roles
- Legal instruments: Financial Market Infrastructure Act (FMIA); Financial Market Infrastructure Ordinance (FMIO); National Bank Act (NBA); National Bank Ordinance (NBO).
- SNB designates systemically important FMIs (art. 22 FMIA) and issues special requirements (art. 23 FMIA) including relating to IT systems.
- NBO special requirements relevant to cyber security:
  - art. 32 (Management of Operational Risk)
  - art. 32a (Information Security)
  - art. 32b (Business Continuity)
  - art. 32c (Data Centres)
  - art. 22, 22a, 27, 31, 32d (other governance, risk, and outsourcing provisions)
- SNB oversight: for SFMIs supervised by both SNB and FINMA, SNB focuses on compliance with special requirements; for SNB-operated FMIs, SNB is sole oversight authority.
- SNB and FINMA cooperation: crisis management handbook developed; SNB prioritizes operational risk management including recovery for extreme but plausible scenarios.

### SELF-ASSESSMENTS, ENDPOINT SECURITY, AND STANDARDS
- CPMI-IOSCO cyber resilience guideline was unique; over time standards like NIST progressed; authorities do not see much value in periodic self-assessments against CPMI-IOSCO alone.
- SNB issued an endpoint security requirement to participants of the SIC system; scope includes all banks, fintech licenses (presently only 2), and select insurance companies participating in repo markets.
  - Compliance is mandatory; commencing from 2024 external audit firms need to assess compliance and provide feedback to the SNB.
  - Requirement has been mapped to SWIFT CSP.
- Recommendation: Require SFMI to carry out self-assessments under CPMI-IOSCO guidelines more frequently to capture gaps arising from system changes.

### SUPERVISORY ARRANGEMENTS, ON-SITE ACTIVITY, AND EXTERNAL AUDITORS
- FINMA organization and priorities:
  - B-OCI (Operational, Cyber and IT risks unit) handles regulation development, threat analysis, onsite/offsite supervision, incident follow-up, review of external audit reports, licensing assistance, coordination.
  - FINMA has considered carving out specialized horizontal review units.
- On-site examinations (2023 activity):
  - Onsite examinations categorized: deep dive (typically one day), supervisory review (maximum of four days), joint reviews (with international regulators).
  - For 2023: eleven supervisory reviews and three deep dives were carried out.
- FINMA on-site and external audit counts (Table):
  - 2020: FINMA On-site Exams = 4; Regulatory Audit by External Audit firms = 212; Of which In-depth Audit = 29
  - 2021: 14; 229; 21
  - 2022: 19; 218; 18
  - 2023: 17; 211; 18
- External auditors perform many regulatory audits; FINMA depends on external auditors though on-site visits have increased.
- FINMA uses an excel-based tool ‘Benchmark’ to assess cyber maturity; completed for 32 supervised entities.

### AUDIT FINDINGS, PRIORITIES AND RISK MONITORING
- Audit findings: cyber is top or second top risk for category 1 & 2 banks; for categories 3–5 cyber appears among top risks.
- FINMA Risk Monitor (cyber risk trend): New in 2019; 2020 (↑); 2021 (→); 2022 (→); 2023 (→).
- Outsourcing risk added to main risks in Risk Monitor in 2023.
- B-OCI prioritizes supervisory activity risk-based: GSIB, DSIBs and SFMI; then security firms and insurance companies; followed by other supervised entities.

### SUPERVISORY RESOURCES, STAFFING, AND ENFORCEMENT
- FINMA B-OCI staffing:
  - Unit has nine staff apart from the head of the unit.
  - One FTE responsible for operational risk and operational resilience.
  - Three FTEs each looking after ICT, Data, and cyber risks.
  - Two FTEs supervise outsourcing risk.
- Assessment: FINMA resources focused on operational risk, IT and cyber are inadequate given number of supervised entities and planned work areas.
- SNB oversight unit resources are limited; end point security requirement implies perusing 300 certificates from Auditors and following up with banks.
- Enforcement powers:
  - FINMA does not have legal powers to levy monetary penalties; non-monetary penalties exist but have not been used.
  - Non-monetary penalties require Enforcement Division investigation and can be challenged in courts.
  - No enforcement activity to date following cyber-related incidents as part of enforcement procedure.
- Recommendations:
  - Augment FINMA staffing dedicated to cyber, ICT and operational resilience work.
  - Augment SNB resources in oversight unit to handle additional workloads and to fully understand SFMI risk profiles.
  - Empower FINMA to levy monetary fines in technology and cyber risk areas to act as disciplining factor where irresponsible behavior poses systemic risk.

### USE OF POWERS AND PENALTIES
- It is important to use the powers available to impose non-monetary penalties judiciously.
- Recommendation to consider empowering FINMA with monetary penalties in technology and cyber risk areas to strengthen enforcement where appropriate.

*Source: EXECUTIVE SUMMARY and selected sections of the Technical Note (TN) from the Switzerland: 2025 FSAP.*

### EXECUTIVE SUMMARY __________________________________________________________________________ 5

### EXECUTIVE SUMMARY

### Major Findings
- Cyber security is recognized as one of the major risks in Switzerland by both authorities and financial market players.
- With digitalization, cyber incidents have been increasing in frequency and sophistication, including in the financial sector.
- The Swiss National Bank (SNB) and the Swiss Financial Market Supervisory Authority (FINMA) tag cyber risk as a significant threat to the financial sector.
- The Financial Sector–Cyber Security Centre (FS-CSC), a new public-private partnership, supports threat intelligence sharing, cyber exercises and tests, incident response assistance, and active information sharing.
- The National Cyber Security Center (NCSC) was established in 2020 to coordinate cyber security matters at the country level.
- Key regulatory initiatives include the Operational Risks and Resilience Circular from 2022 and FINMA’s Guidance from 2020 and 2024, which cover the duty to report cyberattacks.
- Amendments to the Information Security Act (ISA) for incident reporting requirements on critical infrastructure are effective in 2025.
- Third-party related cyber incidents accounted for fifty percent and thirty percent of the reported incidents in 2023 and 2024, respectively.
- Reporting by individuals to GovCERT accounted for 90 percent of cases; the rest was from corporates.
- Cyber incidents reported to GovCERT have increased significantly over the years, although reporting is on a voluntary basis and the actual number of incidents could be much higher.
- Switzerland’s cyber maturity rankings: 27th place in the National Cyber Security Index; 42nd place (2020 report) in the Cyber Security Index by the International Telecom Union; September 2024 Cyber Security Index places Switzerland in the second tier—"Advancing Category," whereas the first tier already has 45 countries.

### Progress and Shortcomings
- The cyber risk management framework has recently been strengthened, but several major changes are still to be implemented over the next two to three years.
- Several provisions in the Operational Risk and Resilience Circular, issued in 2023, have a significant transition time (1–2 years).
- Several assessments (GCSCC/University of Oxford; GCSCC’s Cyber Security Capacity Maturity Model for Nations) identify gaps and make recommendations; more work is needed despite progress.
- Banks’ cyber risk supervision relies heavily on external audit firms and to a lesser extent on FINMA’s direct onsite supervision; offsite supervision is limited.
- The “Cyber Risk Management” procedures were updated in November 2023 and became operational in 2024.
- Testing practices can be further improved by developing a framework and conducting tests more regularly.
- There is a need for stricter regulation, more effective supervision, and increased coordination across authorities.
- The financial system is only as strong as its weakest link; expanding regulatory scope beyond banks to encompass the entire financial sector would increase cyber preparedness and the attractiveness of the Swiss Financial Center (SFC).

### Institutional and Coordination Observations
- FINMA is the unified supervisor of banks, insurance companies, securities firms, asset managers, many of which are large, complex, and globally active. Switzerland is home to a G-SIB (UBS) and major internationally active insurers (Swiss Re Group, Zurich Insurance Group). The systemically important financial market infrastructure is SIX Group.
- Coordination is fragmented: SNB is mandated for financial stability analysis and cyber resilience stress testing; FINMA coordinates supervision of individual entities; prosecution of cybercrime is the responsibility of cantonal authorities; cyber security is addressed by both federal and cantonal authorities.
- Enhancing coordination between FINMA, NCSC, and the Federal Data Protection Agency (FDPA) regarding incident reporting frameworks, and formalizing arrangements between FINMA and FDPA, would reinforce the cyber risk oversight framework.
- GovCERT’s mandate could be expanded; consideration of legal measures to empower GovCERT to investigate systemic cyber incidents is a medium-term option.

### Supervisory and Resourcing Needs
- FINMA should gradually increase its direct onsite supervision and reduce dependence on external auditors.
- FINMA, SNB, and NCSC staff resources should be reinforced substantially to adequately monitor cyber risks.
- FINMA should strengthen off-site supervision by collecting key risk indicators and data for mapping.
- SNB should augment resources to have a complete understanding of the cyber risk profile of Systemically Important Financial Market Infrastructures (SFMI).
- FINMA should augment resources in the Banking-Operational, Cyber, and IT risk unit to improve cyber risk supervision.

### Testing and Resilience Recommendations
- Develop a testing framework appropriate for the Switzerland market to achieve consistency in results across institutions.
- Conduct stress tests with severe but plausible cyber scenarios to assess impact on the financial sector.
- Conduct cyber resilience stress tests for the financial sector.

### Legal and Regulatory Context
- Cyberattacks are criminalized under the Swiss Criminal Act; Article 143 sets unauthorized access to data processing systems with a maximum penalty of three years or a monetary penalty.
- Various legal acts empower FINMA to supervise financial institutions and market infrastructures and require boards to identify, mitigate, and monitor all material risks; FINMA can use these provisions to supervise cyber risks even without standalone cyber regulation.
- Article 3 (f)(2) of the Banking Act requires financial groups and conglomerates to be organized to specifically detect, mitigate, and monitor all material risks.
- The Financial Market Infrastructure Act (Fin MIA): Article 14 requires systemically important FMIs to operate IT systems protecting confidentiality and integrity of information regarding participants and transactions; Article 23 requires special requirements to protect against risks they pose to financial stability, as determined by the SNB.

### Key Recommendations (Table 1: Switzerland: 2025 FSAP: Key Recommendations)
- Legal and Regulatory Framework
  - 1. Strengthen legal measures to facilitate effective supervision of critical third-party service providers to the financial sector (¶18). — FINMA, SIF, NCSC — ST
  - 2. Consider introducing legal measures to empower GovCERT to investigate systemic cyber incidents (¶18). — NCSC — MT
  - 3. Provide adequate resources to GovCERT to ensure effective functioning, including to support the financial sector (¶25). — NCSC — I
  - 4. Extend ICT / cyber and outsourcing regulations to all parts of the financial sector (¶36). — FINMA — ST
  - 5. Consider options to limit further concentration in the SIX group and to de-risk the existing levels of concentration (¶44). — SNB, FINMA — ST
- Institutional Elements
  - 6. Enhance coordination between FINMA, FDPA, and NCSC regarding incident reporting frameworks (¶54). — FINMA, FDPA, NCSC — ST
  - 7. Formalize arrangements between the FDPA and FINMA to enhance further cooperation (¶64). — FINMA, FDPA — ST
- Supervisory Arrangements
  - 8. Reduce the dependence on external auditors and correspondingly increase on-site examinations (¶84). — FINMA — ST
  - 9. Review the on-site supervision policy with an aim to increase FINMA’s on-site activity, explore synergies between IT and cyber risk examination units, and strengthen off-site supervision by collecting key risk indicators and data for mapping (¶85). — FINMA — ST
  - 10. Introduce regular reporting to the Board covering the analysis of the threat landscape, type and trend of incidents, regulatory environment, supervisory actions, and material gaps in the preparedness (¶ 85). — FINMA — I
  - 11. Collect, in the form of a regular off-site report, a summary of cyber incidents comprising all categories to better understand the overall threat landscape (¶93). — FINMA — ST
  - 12. Revise the incident reporting regulation to address the gaps, consider the Format for Incident Reporting and Exchange (FIRE) format to make incident reporting template comprehensive, and issue a circular on the topic (¶92). — FINMA — ST
  - 13. Augment resources within SNB to have a complete understanding of the cyber risk profile of Systemically Important Financial Market Infrastructures (SFMI) (¶99). — SNB — I
  - 14. Augment resources in the FINMA Banking-Operational, Cyber, and IT risk unit to improve cyber risk supervision (¶98). — FINMA — I
- Financial Sector Resilience
  - 15. Develop a testing framework that is appropriate for the Switzerland market to achieve consistency in the results across institutions (¶108). — FINMA — MT
  - 16. Conduct stress tests with severe but plausible cyber scenarios to assess impact on the financial sector (¶110). — SNB, FINMA — ST
  - 17. Conduct cyber resilience stress tests for the financial sector (¶110). — SNB, FINMA — ST
- Selected Cyber Security Considerations at SNB and FINMA
  - 18. Assess the impact of the Information Security Act (ISA) and take necessary action to comply with its provisions (¶113). — SNB — I

- Footnote on timeframes: I Immediate (within 1 year); ST Short term (within 1-2 years); MT Medium Term (within 3−5 years).

### Scope of this Technical Note
- Focus: cyber risk regulatory and supervisory practices within the financial sector broadly, with specific attention to systemically important banks (SIBs), insurance companies, and financial market infrastructure (FMI).
- Assessment considered institutional arrangements, legal, organizational, coordination measures, cyber risk regulations, licensing practices, supervisory practices covering governance, risk management, cyber security, incident reporting, and testing arrangements.
- Also considered enabling initiatives: information sharing, awareness building, and public-private partnerships.
- The assessment relied on answers from SNB, FINMA, State Secretariat of International Finance (SIF), and NCSC; interviews and discussions with stakeholders; and review of certain confidential documents provided in a trust room.

*Source: EXECUTIVE SUMMARY and selected sections of the Technical Note (TN) from the Switzerland: 2025 FSAP.*

### 11.  The duty to provide information and to report any incident of substantial importance

### 11.  The duty to provide information and to report any incident of substantial importance

### Duty to provide information and incident reporting framework
- Article 29 of FINMASA requires that the supervised entities and their audit companies immediately report to FINMA any incident of substantial importance.
- Reporting requirement extends to third parties to whom essential functions of a bank are outsourced; per Article 23 of the Banking Act, FINMA can carry out checks on these outsourced entities at any time.
- Equivalent check powers are not available for other non-bank supervised entities, constraining FINMA’s powers.

### Information Security Act (ISA) and related ordinances
- The Federal Council put into effect the 2024 Information Security Act (ISA), covering federal and cantonal authorities and critical infrastructures in private and public sectors. The financial sector is one of the identified critical infrastructures.
- Four ordinances drawing from ISA:
  - Information Security Ordinance (ISO)
  - Ordinance on Security Checks on Persons (VPSP)
  - Ordinance on the Company Security Procedure (VBSV)
  - Ordinance on Federal Identity Management Systems and Directory Services (IAMV)
- A cyber security ordinance specifying reporting requirements for critical infrastructures under the ISA is scheduled to come into force on April 1, 2025.
- Some ISA provisions apply only to federal and cantonal authorities and not to critical infrastructure (which includes the SNB).
- The ISA provides legal backing to some NCSC activities, particularly about gathering incident reports and access to relevant data.

### ISA amendments, January 2025 reporting, and cross-law changes
- ISA amended to include cyber incident reporting obligation for all identified critical infrastructures, which came into force in January 2025.
- This requirement for the financial sector is in addition to FINMA requirements for incident reporting.
- NCSC and FINMA have coordinated efforts to avoid duplication so far.
- ISA incorporated amendments in other laws:
  - Federal Law on Public Procurement—NCSC’s power to publish certain vendors who do not fix vulnerabilities within the time limit fixed by NCSC.
  - Data Protection Act—the Data Protection Authority can share reports with the NCSC for analyses of incidents.
  - Financial Market Supervision Act—FINMA is authorized to share non-publicly available information with other supervisors, NCSC, and SNB.

### Data Protection Act revision
- The Federal Council proposed an amendment to the Data Protection Act (FADP, 2020), aiming to strengthen the law to achieve equivalence with the European Union’s GDPR and facilitate cross-border provision of services.
- One requirement of the revision is to promptly notify the Federal Data Protection and Information Commissioner (FDPIC) in the event of a data security breach.

### Assessment: legal progress and implementation challenges
- Progress achieved:
  - Enacting the ISA and rapidly including cyber incident reporting requirements on critical infrastructure.
  - Revising the FADP to pursue equivalence with EU GDPR-related aspects.
- Structural constraints:
  - Switzerland’s federal structure and intensive public consultation processes can slow legislation introduction or major amendments.
- Implementation timelines and dependencies:
  - Various ISA components and ordinances are being rolled out and may take time for fuller implementation.
  - Specific work-in-progress items include:
    - Achieving minimum standard in terms of Information Security Management Systems (ISMS)
    - Background check of individuals deployed in sensitive positions (centralized Government-level process)
    - Background check of critical service providers (centralized Government-level process, and there is a waiting period of months already)
    - Incident reporting processes
  - For the SNB, being a listed organization in the ISA increases dependence on these processes compared to FINMA, which is not a directly listed entity in the ISA.

### Recommended legal strengthenings
- Two areas require stronger legal measures:
  - (i) Vesting powers with GovCERT (NCSC) to investigate systemic cyber incidents.
    - Current ISA empowers GovCERT (NCSC) to receive incident reports but does not empower it to investigate a systemic cyber incident if the victim company does not seek help.
    - Recommendation: Vest GovCERT (NCSC) with powers to take proactive steps without delay where incidents have contagion potential to the whole sector or protective measures are needed and the victim does not request or cooperate.
  - (ii) Strengthening powers of financial sector regulators to effectively supervise critical third parties.
    - Third-party providers pose significant risk; recent incidents targeted third parties to steal information from federal agencies and the financial sector.
    - FINMA observes cyberattacks on third parties are growing and places outsourcing risk as one of the major risks in its risk assessment.
    - SNB, FINMA and SIF are discussing the issue in light of a Basel Committee on Banking Supervision (BCBS) consultation document.
    - Recommendation: Appropriate legal measures to strengthen supervisors’ oversight of critical service providers.

### National Cyber Strategy (NCS)
- Switzerland has developed NCS strategies since 2012:
  - First NCS: 2012–2017
  - Second NCS: 2017–22
  - Third and current NCS approved by the Federal Council and by the Cantons in April 2023; it is no longer limited in time but will be reviewed every five years by NCSC.
- A Steering Committee is established to plan and coordinate NCS implementation with representation from multiple stakeholders and defines performance indicators for each measure. NCSC functions as the Steering Committee’s office and provides regular implementation updates to the Federal Council.
- Cantons define their cyber security organization independently; the Swiss Security Network (SSN) produced the "Recommendation for the implementation of the cantonal cyberorganization", adopted by the Conference of Cantonal Justice and Police Directors (CCJPD) in 2020.
- NCS is based on a subsidiary and partnership role of the state: state intervenes only when welfare is seriously threatened and private actors cannot or will not solve the problem.

### Role of SNB, FINMA, and NCSC under the NCS
- NCSC does not interfere in supervisory and regulatory activities of FINMA and SNB.
- FINMA has strengthened regulations on incident reporting and operational resilience and plays a role in crisis management.
- SNB contributed to establishing the FS-CSC and is a party in setting up crisis management protocols.
- Federal office will not take over supervisory or regulatory tasks from sector specialist authorities; NCSC provides cyber security expertise to these authorities.

### Assessment: institutional capacity and resource needs
- Cyber security is cross-cutting; public authorities coordinating cyber matters, particularly the NCSC, need strengthening.
- NCSC’s elevated status and cross-cutting responsibilities require further resources and authority.
- Adequate resources in GovCERT (NCSC) are important given expanded role and additional workload from ISA implementation and potential involvement in systemic cyber incidents.

### Critical Information Infrastructure Protection (CIP)
- The Federal Office of Civil Protection (FOCP) coordinates identification and publication of critical infrastructures.
- CI list: ten sectors divided into 27 subsectors; financial sector identified with financial and insurance services as subsectors.
- A CIP strategy approved by the Federal Council; inventory identifies individual CI elements, including IT systems, for planning and prioritizing risk management and incident response. The CIP inventory is not available in the public domain.
- Federal Council published the latest National Strategy for Critical Infrastructure Protection in June 2023 to align stakeholders across federal, cantonal, and private levels.
- ISA provides that the Confederation supports CI operators to ensure network/system interruptions and abuses are rare, short-lived, manageable, and damage extent is low. Support includes:
  - (a) early identification and assessment of threats, hazards, vulnerabilities, and security gaps;
  - (b) detection of incidents;
  - (c) maintaining and restoring information security after an incident;
  - (d) follow-up of incidents (Art.74).
- Designated agencies may process personal data without notice. ISA requires IT resources to be classified within two years of entry into force and technical measures to ensure information security must be implemented within six years of entry into force.

### Scope and applicability of regulation and FINMA’s supervision
- Operational, cyber, and IT risk unit in the Banking Division (B-OCI) is responsible for FINMA’s supervision of IT and cyber risks, operational risk and resilience in banks, business continuity, and outsourcing.
- Key FINMA regulations/guidance:
  - Corporate Governance Circular (2017)
  - Operational Risk Circular (2008) now replaced by Operational Risk and Operational Resilience Circular (2023/1)
  - Guidance on Incident Reporting (05/2020)
  - Outsourcing Circular (2018)
- Applicability of regulations is not uniform:
  - Outsourcing regulation applicable to banks, insurers and securities firms.
  - Operational resilience regulation and corporate governance regulation applicable to banks, financial groups, fintech firms and investment firms.
  - Incident reporting guidance applicable to all supervised entities.
- FINMA issues guidance notes periodically; in 2024 it issued guidance on supervisory findings, incident reporting and cyber scenario exercises (03/2024) and guidance on operational risk to fund management companies and collective investments managers (04/2024).

### Regulatory changes since the previous FSAP
- Notable developments in the past five years focus on cyber incident reporting and operational risks and resilience.
- FINMA guidance on “Duty to report cyberattacks” (pursuant to Article 29 para. 2 FINMASA, 2020):
  - Requires all supervised entities to report cyber incidents in a timebound manner.
  - Entities must inform FINMA about any medium and above category cyber incident within 24 hours, submit relevant details in a prescribed format within 72 hours, and continue follow-through reports until the incident is fully resolved and closed.
  - FINMA indicated it may transfer clarifications to a circular later; a reference to incident reporting is introduced in the circular on operational risks and resilience.
- FINMA Guidance 03/2024 (“Findings from FINMA’s cyber risk supervision, clarification of FINMA Guidance 05/2020 and scenario-based cyber risk exercises”) provided further clarification on reporting periods, incidents at outsourced vendors, and resolving various categories of incidents and on meeting reporting requirements under FINMA and the ISA.
- Reporting requirements under the FADP exist for incidents resulting in data leakage/loss—irrespective of the risk category of the incident.

### New FINMA circulars, audit templates, and guidance
- December 2022: FINMA issued circular on “Operational Risks and Resilience—banks” (2023/1), applicable to banks, financial groups and conglomerates, certain investment firms, and persons under Article 1b of the Banking Act. This circular reflects PSMOR and POR and replaced the 2008 operational risk management circular. Most came into effect from January 1, 2024, with a transition period of one to two years for select requirements.
- 2023: FINMA issued “Audit Points for Cyber Risk Management,” to be implemented by auditors for interventions under the audit strategy effective January 1, 2024. The first audit report based on the template will be available in early 2025. The template requires auditors to adapt the standard work program to the specific situation of the institution and to provide rationale if specified audit procedures are not carried out completely.
- 2024: FINMA issued guidance on “Operational risk management by fund management companies and managers of collective assets” highlighting possible actions to enhance operational risk management, including ICT and cyber risk aspects.

### Insurance companies and other supervised entities
- The revised operational resilience circular does not apply to insurance companies.
- Insurance Supervision Act requires the Board of Directors to be responsible for identifying, managing, and mitigating all material risks.
- Article 29 of the Financial Market Supervision Act provides legal basis for incident reporting of all licensed and supervised entities, including insurance companies.
- At licensing, B-OCI provides inputs on ICT and cyber aspects for insurance companies, but for larger firms there are no regulations clearly applicable in these areas.
- Other supervised entities (except supervised entities in financial groups and certain investment firms):
  - No explicit technology or cyber regulation generally applies.
  - Binding regulatory instruction flows from base Acts where Board of Directors bear responsibility for material risks.
  - For fund managers and collective investment scheme managers, recently published FINMA guidance provides clarity on expectations.

*Source: 1cheea2025005-source-pdf - 11.  The duty to provide information and to report any incident of substantial importance*

### 36. There is an urgent need to extend ICT / cyber regulations and outsourcing regulation

### 36. There is an urgent need to extend ICT / cyber regulations and outsourcing regulation

### Urgent recommendation
- Extend ICT / cyber regulations and outsourcing regulation to all parts of the financial sector.
- Given that FINMA is responsible for a wide range of supervised entities, issue comprehensive instructions covering all major supervised entities and make certain provisions proportionately applicable to help supervisors and supervised entities.

### Financial Market Infrastructures (FMIs) — structure and legal framework
- The SIX Group operates various FMIs in Switzerland; the SIX group operated FMIs are the only locally established systemic FMIs; other systemic FMIs are foreign incorporated.
- The SNB has responsibility for SFMIs; FINMA regulates all the FMIs, except for SIX Interbank Clearing (SIC), which is a SNB-operated FMI.
- General regulatory framework for FMIs is governed by:
  - Financial Market Infrastructure Act (FMIA)
  - Financial Market Infrastructure Ordinance (FMIO)
  - National Bank Act (NBA)
  - National Bank Ordinance (NBO)
- The SNB designates systemically important FMIs and their systemically important business processes based on the criteria in art. 22 FMIA, and based on art. 23 FMIA issues special requirements that must be fulfilled by systemically important FMIs (in addition to the general requirements stipulated in the FMIA/FMIO), including relating to IT systems.

### Specific legal provisions relevant to cyber security and operational risk
- Special requirements relevant for cyber security are contained in the NBO in:
  - art. 32 (Management of Operational Risk)
  - art. 32a (Information Security)
  - art. 32b (Business Continuity)
  - art. 32c (Data Centres)
- Other special requirements relevant for certain aspects of cyber security management:
  - art. 22 (Governance and Organization)
  - art. 22a (Board of Directors, Senior Management and Internal Audit)
  - art. 27 (Risk Management Principles)
  - art. 31 (Management of General Business Risk)
  - art. 32d (Outsourcing)

### Oversight, supervisory roles, and priorities
- The SNB has mandate to oversee SFMI and for SFMIs that are also supervised by FINMA; the two authorities cooperate very closely.
- For FMIs supervised by both, the SNB focuses on assessing compliance with the special requirements.
- In oversight of SFMIs, the SNB places high priority on operational risk management, including cyber security, and has focused on improving:
  - the maturity and the transparency of the cyber security framework in general
  - recovery in the case of extreme but plausible scenarios (e.g., by preparing measures in case of a massive ransomware attack)
- For SFMIs operated by the SNB, or on behalf of the SNB, and hence not subject to FINMA supervision, the SNB is the sole oversight authority.
- FINMA supervises FMIs including SFMI and is planning to:
  - strengthen scenario-based testing including red team tests
  - improve data-based supervisory interventions
- Active supervision of cyber risk started in 2017 and has progressively evolved.
- Together with FINMA and the FDF, the SNB has been engaged in advancing crisis management arrangements for serious operational incidents (including cyber incidents) in the financial sector; a crisis management handbook has since been developed.

### Self-assessments and industry programs
- In 2018–19, SFMI were asked to carry out a self-assessment under CPMI-IOSCO cyber resilience guideline, but there have been no self-assessments thereafter.
- Initial self-assessment based on CPMI-IOSCO cyber resilience guidelines provided key insights on gaps; the SNB and FINMA followed up with SFMI to bridge those gaps.
- Subsequently, SWIFT’s Customer Security Program (CSP) also came into force.
- The authorities are of the opinion that while at the time of its [text ends here in source]

*Source: 1cheea2025005-source-pdf - 36. There is an urgent need to extend ICT / cyber regulations and outsourcing regulation*

### introduction, CPMI-IOSCO cyber resilience guideline was very unique, over time, other standards like

### Introduction

### Endpoint Security Requirement and Self-Assessments
- CPMI-IOSCO cyber resilience guideline was very unique; over time, other standards like NIST have progressed further, and hence they do not see much value in carrying out self-assessments against CPMI-IOSCO cyber resilience guideline periodically.
- The SNB has issued an end point security requirement to the participants of the SIC system.
  - Scope includes all banks (all categories of banks), fintech licenses (at present only 2, there is a proposal to convert such licenses into a payment service provider license going forward) and select insurance companies (which on account of their participation in repo markets is eligible to be part of inter-bank clearing).
  - Compliance is mandatory and commencing from 2024 external audit firms need to assess the compliance and provide feedback to the SNB.
  - The requirement has been mapped to SWIFT CSP so that compliance could be monitored in an integrated manner.
- Recommendation: Requiring SFMI to carry out self-assessments under CPMI-IOSCO guidelines more frequently would help supervisors better understand emergence of new gaps arising from implementation of new systems or retirement of existing systems.
  - SFMI can internally map requirements under regulations issued by the SNB and FINMA, SWIFT’s CSP and CPMI-IOSCO cyber guidelines and ensure meeting all requirements.

### SIX Group and Systemic Concentration Risks
- The SIX group:
  - Operates critical FMIs and plays many key roles in the financial sector.
  - For SIC it is a third-party to the SNB.
  - Operates exchanges and therefore is a regulator for certain entities; operates multiple FMIs, each incorporated separately under the supervision of FINMA.
  - Provides market data for the financial sector both within Switzerland and abroad; can provide third-party services to other financial sector entities.
  - Is jointly owned by financial sector participants locally and abroad; has acquired Bolsas y Mercados Españoles (BME) in Spain, has presence in Germany and is looking to further expand.
- Assessment findings:
  - SIX has assumed such a central role that it would be fair to designate it as a “Too Big to Fail Institution” and strengthen supervision further.
  - From a technology and cyber security perspective, SIX group operations entail significant risks to the financial sector and are crucial to day-to-day operations.
  - SNB as SIC System Manager does not conduct independent audit of their service provision; it depends on the external auditor’s opinion.
  - SIC Board includes a senior official from the SNB; oversight is carried out by a different unit.
  - FINMA does not have mandate or opportunity to supervise SIC, though it is part of the supervised group.
  - A systemic cyber incident in the SIX group could potentially have systemic devastating implications.
- Progress and gaps:
  - SIX has progressed in strengthening cyber security; one major achievement is making operations ransomware proof.
  - Contingency arrangements exist for SIC to carry on with lesser capacity if data centres are simultaneously unavailable.
  - Progress toward internally targeted maturity profile falls short for local and Spanish operations; maturity level in Swiss entities is higher compared to Spanish entities.
- Recommendation: Consider options to limit further concentration in the SIX group and de-risk existing concentration; ensure concentration levels do not further increase leveraging licensing and oversight powers.

### Institutional Elements and National Strategy
- Government and strategy orientation:
  - Switzerland promotes its Swiss Financial Center status and encourages digital innovation.
  - National Cyber Strategy (NCS) is based on subsidiary and partnership role of the state: state intervenes when societal welfare is seriously threatened and private actors cannot solve problem independently.
  - Public messaging favors private sector solutions; regulation is need-based and reviewed periodically.
- International comparison:
  - Based on ITU Global Cyber Security Index (GCI) data cited, Switzerland lags peer international financial centers and is placed in Tier 2 while peers are in Tier 1.
  - Table values cited:
    - France: Cyber Security Index Ranking (2020) = 9; Cyber Security Index Tiers (2024) = 1
    - Germany: 13; 1
    - Singapore: 4; 1
    - United Kingdom: 2; 1
    - United States of America: 1; 1
    - Switzerland: 42**; 2
    - ** Number of Tier 1 countries =>45
  - Note: ITU publication indicates Switzerland did not respond to the questionnaire; ranking based on publicly available materials.

### National Cyber Institutions, FS-CSC, and FDPA
- NCSC and organizational changes:
  - NCSC responsibilities: operate national contact point on cyber risks, run GovCERT, manage federal administration's specialized IT security service, assist in implementing NCS, develop/evaluate cyber standards and regulations.
  - NCSC was set up under Ordinance on Protecting against Cyber Risks (entered into force July 1, 2020).
  - Effective January 1, 2024, NCSC elevated and relocated to become a federal office (Federal Office for Cyber Security) transferred from FDF to DDPS.
  - NCSC staff: 67 total, of which 12 staff are earmarked for GovCERT function.
  - A Federal Office of Information Security is being established, likely to be activated by mid-2025; until then NCSC will carry those tasks.
- Financial Sector Cyber Security Center (FS-CSC):
  - Set up as a public-private partnership; association of currently 171 members from the financial sector on a voluntary basis.
  - Supported by SIF, SNB, NCSC and FINMA; started operation in 2022.
  - Members pay annual fee, participate in working groups, facilitate information sharing, develop guidelines, conduct exercises and tests, and deal with systemic cyber crises.
  - SNB is a full member of steering board; FINMA, SIF and NCSC sit as participating members without vote.
- Federal Data Protection Agency (FDPA):
  - Set up to implement new Federal Act on Data Protection (FADP).
  - Headed by Federal Data Protection and Information Commissioner (FDPIC); requires reporting of incidents involving data privacy issues including from financial sector.
  - FINMA is exempt from provisions regarding its supervisory activities; act applicable to processing data related to FINMA employees.

- Assessment and recommendation:
  - Coordination among FINMA, NCSC and FDPA regarding incident reporting will reduce regulatory burden; NCSC is coordinating with authorities.
  - Strengthen NCSC/GovCERT with adequate resources and legal powers: GovCERT currently has 12 FTEs (noted as very low); comparable national CERTs in Europe may have 100+ FTEs.
  - Formalize coordination between FINMA and FDPA (e.g., MOU) to minimize regulatory burden and streamline processes.

### GovCERT Activity and Incident Trends
- GovCERT role:
  - Provides technical services analyzing/managing cyber threats; official CERT of Swiss government.
  - Member of FIRST, European Government CERTs (EGC), and IWWN.
  - Constituency: Swiss Federal Administration and private/public sectors.
  - Supports critical infrastructure operators and collaborates closely with police authorities.
- Cyber incidents reported to NCSC (2019–2023):
  - Reported incidents increased by more than 100 percent during 2020-21 and thereafter moderated to 59.0 percent and 38.6 percent for the years 2021-22 and 2022-23.
  - Cyber incidents reported during the first half of 2024 stood at 34789 (19048 during the first half of 2023), exhibiting a growth of 82.6 percent over corresponding period of the previous year.
  - 90 percent of reports came from individuals and the rest from corporates.
- Notable cyberattacks in past two years included:
  - Distributed denial of service (DDoS) attacks on Swiss organizations and authorities in the first two weeks of June 2023.
  - Ransomware attack on software company ‘Convevis’.
  - Malware campaign known as ‘Poseidon campaign’ targeting Swiss macOS internet users.
  - Hacker attack on ‘Xplain’ a major provider of IT services to national and cantonal authorities.
- Assessment and recommendations:
  - GovCERT (NCSC) has important monitoring, advisory and incident-handling roles and coordinates internationally.
  - GovCERT needs strengthening in resources and legal powers: current strength of 12 FTEs is inadequate relative to responsibilities and growing incident frequency/sophistication.

### Coordination Across Authorities
- Institutional coordination:
  - Federal Council published “Digital Finance: Areas of Action 2022+” in February 2022, identifying 12 areas of action and instructing FDF (NCSC), SIF, FINMA and SNB to continuously monitor threat situation and expand mechanisms for combating financial cybercrime.
  - Formal agreements:
    - Tripartite agreement between FDF, SNB and FINMA facilitates cooperation, particularly in crisis.
    - Bipartite agreement between SNB and FINMA facilitates coordination on supervision of SFMI, financial stability analysis, and crisis coordination.
  - Recommended coordination enhancements between SNB and FINMA:
    - Mutually invite the other agency to meetings with SFMI.
    - SNB may invite FINMA for supervisory discussions with SIC although SIC is not under FINMA’s purview.
    - Coordinate supervisory activities further.
- Assessment and recommendations:
  - Tripartite and bipartite agreements are good bases for cooperation but scope for improvement exists.
  - Committees established under these agreements meet semi-annually and include steering committee, committee on financial crises (CFC), and sub-group on operational crises.
  - Recommendation: Improve role of committees during normal times—articulate cyber security strategy for financial sector, periodical threat assessments, guidance to operational teams, assessment of regulations and supervisory focus, and lessons learned.
  - Recommendation: Formalize coordination/cooperation between FINMA and FDPA (e.g., MOU).

### Supervisory Arrangements: Priorities and Processes
- FINMA strategic goals (2021–24) relevant to cyber/ICT risks include:
  - Ensure financial institutions maintain highest risk management standards and promote responsible corporate governance (FINMA identified cyberattacks as one of the most significant risks in its Risk Monitor).
  - Ensure institutions remain robust amid structural developments and clients benefit from new opportunities without additional risks (rapid pace of digitalization identified as a challenge).
  - Promote innovation in Swiss financial center; FINMA applies rules pragmatically and technology-neutrally.
- Cyber risk monitoring:
  - FINMA identifies cyber risk as a major risk every year since 2019.
  - Table 3 trend (year/trend) shows cyber risk as New in 2019 and arrows for subsequent years: 2020 (↑), 2021 (→), 2022 (→), 2023 (→).
- Outsourcing risk:
  - Added to main risks in Risk Monitor in 2023; outsourcing and third-party risk management are important due to impactful cyberattacks on service providers.
- Supervisory strengthening since 2020:
  - FINMA augmented resources to monitor institutions across: (i) threat analysis, (ii) ongoing supervision, (iii) incident/crisis management.
  - Complete revision of Circular “Operational risks and resilience” and additional guidance to audit firms on cyber security (changes enter into force for audit periods ending in 2024).
- Organizational and process notes:
  - Operational, Cyber and IT risks unit (B-OCI) within Risk Management (Banks Division) carries FINMA-wide responsibilities for cyber/ICT/outsourcing.
  - B-OCI responsibilities include regulation development, threat landscape assessment, onsite/offsite supervision, incident reports follow-up, reviewing external regulatory audit reports, assisting licensing, coordination domestically/internationally.
  - FINMA examining carving out specialized horizontal review units to a separate division at same hierarchy as Banks or Insurance division.
  - NIST framework is leveraged in articulating regulation; many Swiss financial sector entities use NIST; major banks also use ISO and COBIT.
- On-site inspection policy and activity:
  - Onsite examinations categorized as deep dive (typically one day), supervisory review (maximum of four days), and joint reviews (with international regulators).
  - For 2023, eleven supervisory reviews and three deep dives were carried out.
  - Table 4 FINMA On-site Exams and Regulatory Audit by external auditors:
    - 2020: FINMA On-site Exams = 4; Regulatory Audit by External Audit firms = 212; Of which In-depth Audit = 29
    - 2021: 14; 229; 21
    - 2022: 19; 218; 18
    - 2023: 17; 211; 18
- External auditors and benchmarks:
  - External audit firms perform many regulatory audits; FINMA depends on external auditors though FINMA has increased on-site visits.
  - FINMA determines scope for in-depth audits and reviews draft audit reports; external audit reports are submitted to FINMA.
  - FINMA uses an excel-based tool called ‘Benchmark’ to assess cyber maturity; completed for 32 supervised entities.
- Audit findings and priorities:
  - Top ten risks from audit firms indicate cyber is top or second top risk for category 1 & 2 banks; for category 3, 4, 5 banks cyber appears among top risks with counts summarized in Table 5:
    - Table 5 summary (Total for ranks 1 to 10): Total = 46, 40, 24, 27, 22, 16, 6, 8, 6, 6
  - The B-OCI prioritizes supervisory activity in a risk-based manner focusing on GSIB, DSIBs and SFMI; priority then security firms and insurance companies, followed by other supervised entities.
- Assessment and recommendations:
  - Supervision is heavily dependent on external auditors; dependence needs to be reduced and on-site supervisory visits augmented.
  - Review on-site supervision policy, increase synergies between IT and Cyber teams, strengthen off-site supervision by requiring regular reporting to maintain digital risk profiles.
  - Supervised entities should provide regular information to their Boards covering threat landscape analysis, incident trends, regulatory environment, supervisory actions, and material gaps.

### Incident Reporting Arrangements
- FINMA incident reporting framework:
  - Article 29 of FINMASA mandates supervised entities and audit companies to report incidents of substantial importance.
  - FINMA’s May 2020 guidance introduced reporting template and classification requirements; extended to all supervised entities and collected via an IT application.
  - Reporting requirement: report all cyber incidents categorized as medium and above on an individual basis.
    - Initial report via email or phone to key account manager within 24 hours, followed by incident reporting template submission within 72 hours (working days). For critical incidents, number of days includes bank holidays and weekends. Subsequent updates until final closure.
  - Since commencement of reporting in late 2020, FINMA has provided incident summaries in Cyber Dossier.
- Data limitations and trends:
  - FINMA’s cyber incident reporting format does not capture certain critical elements such as amounts of losses incurred or potential losses for each incident.
  - FINMA reporting trends:
    - Smaller institutions are successfully attacked more often.
    - Insurers (around 30% of attacks) and asset managers (around 20%) are more often being targeted compared to the past and compared to banks.
    - Successfully attacking companies via service providers has continued.
  - Incident counts reported to FINMA since introduction: about 280 incidents total.
    - Incidents reported by sector: banks = 78; insurers = 60; asset managers = 147; market infrastructure = 3.
    - Compared to 74 incidents reported in 2023, until October 2024, 54 incidents have been reported.
- Assessment and recommendations:
  - FINMA should upgrade incident reporting from guidance to a full-fledged circular.
  - FINMA is aware of FSB consultation (October 2024) proposing Format for Incident Reporting Exchange (FIRE); desirable to reflect finalized FIRE format.
  - FINMA must collect a summary of cyber incidents comprising all categories in a regular off-site report.
    - Currently cyber incidents below reporting threshold are not regularly divulged to FINMA; design a return to capture different incident types, quantum of losses incurred, customer losses, and number of incidents for each type at least quarterly.

### Supervisory Resources and Enforcement
- Resources:
  - FINMA B-OCI staffing:
    - Unit has nine staff apart from the head of the unit.
    - One FTE responsible for operational risk and operational resilience.
    - Three FTEs each looking after ICT, Data, and cyber risks.
    - Two FTEs supervise outsourcing risk.
  - Assessment: FINMA resources focused on operational risk, IT and cyber are inadequate given number of supervised entities and planned work areas.
  - SNB oversight unit resources are limited and workload expected to increase with new security requirements; oversight unit prioritizes monitoring the SIX group.
    - End point security requirement will translate into perusing 300 such certificates from Auditors and following up with banks for remedial action.
  - Need to strengthen capacity to assess systemic cyber risk as part of financial stability analysis; additional work for both SNB and FINMA anticipated.
- Enforcement powers:
  - FINMA does not have legal powers to levy monetary penalties; non-monetary penalties exist but have not been used.
  - Non-monetary penalties require Enforcement Division investigation and can be challenged in courts.
  - No enforcement activity to date following cyber-related incidents as part of enforcement procedure.
- Assessment and recommendations:
  - Augment FINMA staffing dedicated to cyber, ICT and operational resilience work.
  - Augment SNB resources in oversight unit to handle additional workloads and to fully understand SFMI risk profiles.
  - Empower FINMA to levy monetary fines in technology and cyber risk areas to act as a disciplining factor where irresponsible behavior poses systemic risk.

*Source: 1cheea2025005-source-pdf - introduction, CPMI-IOSCO cyber resilience guideline was very unique, over time, other standards like*

### 101. It is important to use the powers available to impose non-monetary penalties judiciously.

### 101. It is important to use the powers available to impose non-monetary penalties judiciously.

### FINANCIAL SECTOR RESILIENCE — A. Information Sharing Arrangements
- The FS-CSC plays a crucial role in information sharing among financial sector participants.
- The FS-CSC is a public-private partnership, with membership from banks, insurance companies and other supervised entities.
- In Switzerland, the private sector tends to cooperate more with mutual trust; this has facilitated information sharing among the members.
- The presence of FINMA, SNB, SIF and NCSC help in extending the support of the authorities to this initiative.
- The FS-CSC was established only in 2022 and is a young organization supported by volunteers nominated by its members; reasonable time needs to be given to assess whether this is successful.
- The FS-CSC has collaborated with the FS-ISAC to collect information at tactical and operational level.
- The steering board and various working groups are capable of discussing strategic information shared on an ongoing basis.

### FINANCIAL SECTOR RESILIENCE — B. Cyber Exercises and Testing
Findings:
- Operational resilience circular (2023/1) mandates red team testing exercises, in addition to regular vulnerability assessments and penetration testing.
- Vulnerability assessments and penetration testing requirements are already implemented; red team testing expectations are built in.
- In selected cases, a few supervised entities (as guided by FINMA) have carried out red team testing with the help of audit firms.
- FINMA does not have a testing framework published (in the lines of CBEST or TIBER-EU).
- FINMA indicated that it would expect banks to hire professional firms to conduct red team testing going forward.
- Annual Report 2021 indicated that FINMA has also carried out some cyber exercises: tabletop exercises to test detection and response processes, and scenario-based tests under controlled conditions commissioned from specialists.
- The FS-CSC conducts operational exercises as well as strategic exercises regularly.
- The SNB, FINMA, SIF and NCSC participate annually in strategic tabletop exercises organized by the FS-CSC focusing primarily on measures to mitigate the impact of a systemic cyber-attack on the Swiss financial sector.
- A successful first operational cyber exercise for the Swiss financial center with over 100 participants from the member institutions was carried out on November 27, 2023.
- FINMA has considered participation of category 3 and 4 banks in such operational and strategic exercises as meeting the requirements under the operational resilience circular.

Assessment and Recommendations:
- Operational Risk and Resilience circular covers only banks and financial groups; there is a need to extend the circular to other parts of the financial sector in a proportional manner thereby extending the testing framework to all sections of the financial sector.
- FINMA may consider developing a testing framework that is appropriate for the Switzerland’s market to achieve consistency in the results across institutions.
- Currently, there is no preferred testing framework indicated by FINMA; banks are expected to decide their own scope considering their own digital presence.
- For supervisors it is important to compare the results and ensure minimum quality; developing a testing framework suitable for Switzerland is necessary.

### FINANCIAL SECTOR RESILIENCE — C. Systemic Analysis and Concentration Risk
Findings:
- FINMA’s supervision is primarily focused on individual entities and not the sector as whole; the SNB is vested with the responsibility to contribute to financial stability.
- FINMA’s risk monitor covers some sectoral views.
- A recent survey on outsourcing carried out by FINMA provided a systemic view of dependence on critical service providers.
- The SNB’s recent financial stability report covered recent cyber security-related work of standard setters; the SNB also covers cyber security aspects in its annual report.
- Stress tests considering cyber scenarios or cyber resilience stress testing are not carried out.

Assessment and Recommendations:
- Further work is needed in strengthening financial stability analysis relating to cyber.
- FINMA, using its supervisory reporting and outcome, needs to identify systemic elements of cyber risk (say concentration risk in terms of technology, services, geography, etc., and emerging areas of systemic risk).
- The SNB and FINMA need to coordinate their activities to carry out cyber resilience stress tests at periodic intervals to assess the systemic gaps as well as institution-specific gaps in the preparedness.
- The SNB may consider severe but plausible cyber scenarios while conducting stress tests to identify potential financial stability implications.

### SELECTED CYBER SECURITY CONSIDERATIONS AT SNB AND FINMA — A. Swiss National Bank
Findings:
- The SNB considers operational and cyber risks as major risks and has developed a cyber security strategy for its own operations.
- The SNB’s cyber security strategy sets out overarching cyber security objectives including: adopting a holistic approach; focus on current and future initiatives on cyber security; the use of widely accepted standards; aim for full protection at non-targeted attacks; aim at a high degree of protection against targeted attacks; strengthen response and recovery; regularly review the status, focus and progress of the measures. These are broken down into various focused actions.
- The SNB follows a three lines of defense approach in managing cyber risks (Figure 4).
- The SNB is strengthening its own cyber security posture and is currently in the process of implementing an identity and access management (IAM) solution, which has progressed substantially, with few more elements to be still integrated.
- The SNB is yet to implement a full-fledged data leak prevention system, though some elements are already in place.
- The SNB is careful about cloud adoption, with limited usage of cloud as of now, though the SNB is preparing itself if there is a need to increase its cloud usage.

Assessment and Recommendations:
- The SNB is subject to the newly enacted ISA and its various provisions.
- The SNB is an organization listed in the ISA, and being part of the federal agencies category, it is subject to all the ordinances issued thereunder.
- Background checks to be carried out for individuals posted in sensitive areas relating to cyber security by the designated federal agency and such checks to be carried out regarding critical third-party service providers may pose some challenges in implementation.
- The SNB is subject to incident reporting requirements under the ISA and needs to report cyber incidents to NCSC.
- There is a need to assess the impact of the ISA and take necessary action to comply with its provisions.

### SELECTED CYBER SECURITY CONSIDERATIONS AT SNB AND FINMA — B. FINMA
Findings:
- FINMA has a cyber security strategy, first approved by the management and the Board of Directors in 2022.
- The revision of the strategy will be brought to the attention of the Executive Board (via the annual safety report) and the Board of Directors (via management reporting) at the appropriate stage.
- An external cyber security assessment takes place every two years (for the first time now in 2024) to assess the maturity of cyber security.
- The results and measures were presented to the Board of Directors in September 2024.
- FINMA is targeting a maturity level of 3.5 out of 4, though currently they are yet to reach that level, despite progress made.
- The NIST and ISO standards are leveraged internally.

*Source: https://www.imf.org/-/media/files/publications/cr/2025/english/1cheea2025005-source-pdf.pdf*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2025/english/1cheea2025005-source-pdf.pdf_