Switzerland rethinks Cybersecurity

Switzerland intends to fundamentally reorganise its cybersecurity regulation. The Federal Council has instructed the Federal Department of Defence, Civil Protection and Sport to prepare a consultation draft for a dedicated federal Cybersecurity Act by June 2027.

The planned Cybersecurity Act is intended to bring together several areas that have so far been addressed separately: the cyber resilience of products with digital elements, the protection of particularly important digital data, and the role of hosting and cloud providers in cybersecurity.

For companies, the planned alignment with the European Cyber Resilience Act is particularly relevant. It indicates that cybersecurity requirements in Switzerland are increasingly moving away from isolated technical measures towards a broader governance and compliance framework.

Key Takeaways

The planned Swiss Cybersecurity Act is expected to introduce requirements for manufacturers, importers and distributors of software and hardware products, while aligning with the EU Cyber Resilience Act.

Additional obligations are planned for hosting and cloud providers, as well as for the protection of particularly important digital data. The existing reporting obligation for cyberattacks on critical infrastructure is also expected to be incorporated into the new law.

There are no new obligations for companies at this stage. The specific requirements will only become clear once the consultation draft is available. However, the direction is clear: product security, cloud risks, critical data and cyber resilience are increasingly being brought together within one regulatory framework.

Why Switzerland Is Planning Its Own Cybersecurity Act

Different aspects of cybersecurity are currently addressed through separate legal and regulatory frameworks. The Federal Council now intends to combine three ongoing legislative projects into a single law.

At its core, the new framework will focus on three areas: products, data and digital infrastructure.

Products with digital elements are expected to become subject to binding cybersecurity requirements. Particularly important digital data is to receive stronger protection. At the same time, hosting and cloud providers are expected to play a greater role in defending against cyber threats.

The approach shows that Switzerland increasingly views cybersecurity as an integrated governance responsibility.

For companies, this means that Product Security, Information Security, Third-Party Risk, Incident Management and Business Continuity will increasingly need to be connected.

The Alignment with the EU Cyber Resilience Act Is No Coincidence

One of the most important aspects is the planned alignment with the European Cyber Resilience Act.

The CRA introduces binding cybersecurity requirements for products with digital elements in the EU. Manufacturers must consider cyber risks more systematically throughout the entire product lifecycle and manage vulnerabilities in a structured way.

Switzerland is now pursuing a similar approach.

The planned law is expected to introduce binding requirements for manufacturers, importers and distributors of software and hardware products. It is also expected to create a legal basis for market surveillance and even restrictions on the sale of insecure products.

For Swiss companies doing business in the EU, this alignment is particularly relevant.

Many companies already need to address the CRA. Significantly different Swiss and European requirements would create additional processes, documentation and controls.

The Federal Council therefore explicitly aims to avoid unnecessary additional compliance burdens for internationally active companies.

Cybersecurity Becomes Part of the Product Lifecycle

The planned regulation changes the perspective on product security.

Cybersecurity can no longer begin only after a product has already been deployed and a vulnerability has been discovered. Security requirements need to be considered during development, market introduction and ongoing maintenance.

For manufacturers, this means systematically assessing cyber risks, defining responsibilities and establishing vulnerability management processes.

Traceability will also become increasingly important.

Which risks were identified? Which security measures were implemented? Which vulnerabilities are known? Who decides which actions are necessary? And how is it documented that a product continues to meet the applicable requirements?

Product Security is therefore increasingly becoming a classic GRC process.

Cloud and Hosting Providers Move Further into the Regulatory Focus

The planned law goes significantly beyond digital products.

Hosting and cloud providers are also expected to become subject to specific cybersecurity obligations. The Federal Council has referred, among other things, to cooperation and defensive duties in relation to cyber threats.

The specific requirements have not yet been defined. Nevertheless, the planned regulation shows an important development: digital infrastructure is increasingly being treated as part of overall economic cyber resilience.

This does not only affect providers themselves.

Companies that outsource critical processes to cloud or hosting providers also need to understand their dependencies. If a provider fails or is compromised, numerous customers may be affected at the same time.

Cloud Governance and Third-Party Risk Management are therefore becoming an increasingly important part of modern cyber governance.

Critical Data Becomes a Separate Asset to Protect

Another key element of the planned Cybersecurity Act is the protection of particularly important digital data.

This broadens the perspective beyond traditional data protection.

Not all business-critical data is necessarily personal data. Production data, technical information, configurations, access credentials, trade secrets or operational control data can be just as critical to an organisation.

For GRC leaders, it is therefore becoming more important to identify which information is genuinely business-critical and which security requirements follow from that classification.

This includes risk assessments, access controls, backup strategies, recovery processes and clear responsibilities.

Cybersecurity, Information Security and Business Continuity are therefore becoming increasingly interconnected.

The Existing Reporting Obligation Is Expected to Be Integrated

Since April 2025, Switzerland has already had a reporting obligation for certain cyberattacks affecting critical infrastructure.

Affected organisations must report relevant cyberattacks to the Federal Office for Cybersecurity within 24 hours of discovery.

This existing requirement is also expected to be incorporated into the new Cybersecurity Act.

That would bring a significant part of Swiss cybersecurity governance together within one common legal framework.

For companies, this can be beneficial. A consolidated regulatory framework can help reduce overlaps and conflicting requirements.

At the same time, integrated processes become more important. Incident Management, reporting obligations, Risk Management and technical security processes cannot be organised independently of one another.

What Does This Mean for Swiss Companies?

The announced Cybersecurity Act does not yet create any immediate new compliance obligations.

The consultation draft is expected to be prepared by June 2027. Only then will many details regarding scope, thresholds, specific requirements and possible exemptions become visible.

Companies should therefore not attempt to implement requirements today that have not yet been defined.

However, structural preparation already makes sense.

Companies can already review which digital products they manufacture or distribute, which critical data they process, which cloud and hosting providers they use, and which dependencies result from them.

This transparency is valuable regardless of the final regulatory details.

Particularly Relevant for Manufacturers of Digital Products

For Swiss software companies, technology providers, machinery manufacturers, device manufacturers and providers of connected products, the alignment with the CRA is likely to be particularly important.

Many of these companies are already directly or indirectly affected by the European Cyber Resilience Act.

A similar Swiss framework could eventually allow core processes to be used across both markets.

This applies in particular to Cyber Risk Assessments, Vulnerability Management, product documentation, incident processes, responsibilities and control evidence.

Companies that already structure these processes today are likely to be better prepared for future Swiss requirements.

Cloud Customers Should Monitor the Development as Well

The planned cloud obligations are primarily aimed at providers. Nevertheless, the topic is also relevant for their customers.

Companies are moving more and more critical processes, data and applications into external infrastructure.

This increases dependency on a small number of strategically important service providers.

For GRC leaders, the question is therefore not only whether a provider is technically secure. It is also important to understand how critical the provider is to the organisation, which processes depend on it, and how an outage could be managed.

Modern Third-Party Risk Management should make these dependencies visible and connect them with BCM, Information Security and Risk Management.

Conclusion: Switzerland Is Consolidating Cybersecurity into a Governance Topic

The planned Cybersecurity Act marks an important next step in Swiss cybersecurity regulation.

Products with digital elements, important digital data, cloud and hosting providers, and the existing reporting obligation for critical infrastructure are expected to be brought together within a single legal framework.

There is no immediate need for companies to take action yet. The specific requirements will only become clear once the consultation draft is published.

However, the strategic direction is clear: cybersecurity is becoming more regulated, more interconnected and more evidence-driven.

Companies that already create transparency around their digital products, critical data, third parties, risks and controls will establish a strong foundation for the requirements ahead.

FAQ

Does Switzerland already have a new Cybersecurity Act?

No. On 25 September 2026, the Federal Council decided to prepare a consultation draft. It is expected to be available by June 2027.

What is the new Cybersecurity Act expected to regulate?

The planned law is expected to cover requirements for products with digital elements, the protection of particularly important digital data, and specific obligations for hosting and cloud providers.

Is Switzerland aligning with the EU Cyber Resilience Act?

Yes. For products with digital elements, the planned Swiss regulation is expected to align with the European Cyber Resilience Act.

Which companies could be affected?

The law could be particularly relevant for manufacturers, importers and distributors of software and hardware products, as well as hosting and cloud providers. The exact scope has not yet been defined.

What will happen to the existing cyber incident reporting obligation?

The reporting obligation for certain cyberattacks on critical infrastructure, which has been in force since April 2025, is expected to be incorporated into the new Cybersecurity Act.

Do companies need to take action now?

The planned law does not yet create any new obligations. However, companies can already structure their digital products, critical data, cloud dependencies, risks and existing cybersecurity controls.

How does Zazoon help?

Zazoon helps companies centrally manage cyber risks, regulatory requirements, controls, responsibilities, third parties, actions and evidence. This makes it easier to integrate new regulatory requirements into existing GRC processes.