Swiss Government Ensures Security of Supply
In order to ensure long-term security of supply, Switzerland has developed specific regulations in recent years that provide operators of critical infrastructure with a clear framework for action. It is particularly important to note that the legal requirements include not only technical but also, and above all, organizational obligations. Those who understand cybersecurity as a cross-cutting issue, i.e., combining risk management, reporting requirements, training, and governance, not only meet regulatory expectations but also create long-term resilience.
Companies should clarify internal responsibilities at an early stage, define clear processes, and ensure that cybersecurity is understood as a management task. In the coming years, this holistic approach will prove to be a crucial success factor.
Advancement through technology
& responsibility
Switzerland is one of the countries with the highest density of networked devices per capita. In addition to classic IoT applications such as sensors and IP cameras, industrial control systems (PLCs) are also increasingly accessible online. This significantly increases the attack surface, especially in critical infrastructures where a failure can have direct consequences for the energy supply.
Also the Swiss Energy Grid Is Vulnerable
A key point is that many of these devices do not receive security updates for years. Companies should therefore maintain a complete inventory of all IT/OT systems and regularly check for vulnerabilities. A simple but effective measure is to consistently segment the network to minimize the risk of lateral movement in the event of an attack.
Particular caution is required in the area of remote maintenance: standard passwords and unencrypted connections are still a common attack vector. Systematically implementing authentication, logging, and regular checks can drastically reduce the risk. Looking to the future, the number of networked components in smart grids and remote operating environments will continue to rise. Transparency and continuous monitoring are therefore key to maintaining control over your own OT landscape
Minimum ICT Standard as a Basis for
Cybersecurity
The ICT minimum standard was developed in close cooperation with the Swiss Federal Office of Energy (SFOE) and the National Cyber Security Center (NCSC) and forms the central basis for cyber regulation in the Swiss energy sector. It defines the minimum organizational and technical requirements that operators of electricity and gas networks are obliged to implement. The aim is to strengthen the cyber resilience of the energy supply in a sustainable manner in order to prevent cyber attacks and security incidents preventively, while at the same time ensuring functionality and security of supply even in the event of disruptions or failures.
The Minimum ICT Standard
Companies should pay particular attention to the holistic structure of the standard: in addition to technical protective measures, it also requires processes for risk analysis, employee training, and management involvement. Many operators underestimate this governance aspect, even though it is crucial for the long-term effectiveness of the entire security program. Those who use the minimum ICT standard not only as a pure compliance task, but also as a tool for continuous improvement, can systematically strengthen their security situation. This includes regular self-assessments, prioritization of measures, and comprehensible documentation of progress.
The minimum ICT standard is flanked by further legal framework conditions. The revised Data Protection Act (DSG) obliges companies to protect personal data. In addition, operators of critical infrastructures in Switzerland have been subject to a separate reporting obligation since April 1, 2025: cyberattacks must be reported to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. Supervision is carried out by various bodies: The NCSC acts as the national reporting center for cyber incidents and supports companies with recommendations for action and analyses. The ElCom (Federal Electricity Commission) is also relevant for the energy industry, which monitors compliance with regulations as part of its supervisory function.
Security Is Not a State, but a Process
Cybersecurity in the energy sector is not a one-time task, but a continuous process. Systems change, employees change, threats evolve. To survive in this environment, you need structures for ongoing improvement. Companies should therefore regularly review their security measures, validate them through assessments, and test them in emergency drills. Especially in the initial phase or in preparation for external audits, it can be useful to involve specialized partners in order to identify specific vulnerabilities and implement improvement measures efficiently.
OMICRON Cybersecurity Consulting
In the long term, cybersecurity will become an integral part of corporate strategy and a quality feature in tenders, collaborations, and regulatory audits. Companies that invest in structures and culture today will not only be more resilient tomorrow, but also more competitive.
Overall, Swiss cybersecurity regulations create a clear framework that makes energy supplies more resilient to attacks while also strengthening confidence in critical infrastructure. Companies that consistently implement these requirements not only contribute to security of supply, but also position themselves for the future challenges of a digitalized energy world.
Resources
