Ordinance
on Protection against Cyber Risks
in the Federal Administration
(Cyber Risks Ordinance, CyRV)

This Or­din­ance reg­u­lates the or­gan­isa­tion of the Fed­er­al Ad­min­is­tra­tion for its pro­tec­tion against cy­ber risks as well as the tasks and re­spons­ib­il­it­ies of the vari­ous of­fices in the cy­ber se­cur­ity do­main.

This Or­din­ance ap­plies to:

a.

the ad­min­is­trat­ive units of the cent­ral Fed­er­al Ad­min­is­tra­tion in ac­cord­ance with Art­icle 7 the Gov­ern­ment and Ad­min­is­tra­tion Or­din­ance of 25 Novem­ber 1998³;

b.⁴

the of­fices that un­der­take in ac­cord­ance with Art­icle 2 para­graph 2 of the Or­din­ance of 25 Novem­ber 2020⁵ on the Di­git­al Trans­form­a­tion and ICT (DTIO) to com­ply there­with.

In this Or­din­ance:

a.

cy­ber se­cur­ity means the de­sired state in which data pro­cessing via in­form­a­tion and com­mu­nic­a­tion in­fra­struc­tures, in par­tic­u­lar the ex­change of data between per­sons and or­gan­isa­tions, works as in­ten­ded;

b.

cy­ber in­cid­ent means an un­in­ten­ded or in­ten­ded but un­au­thor­ised event that leads to the con­fid­en­ti­al­ity, in­teg­rity, avail­ab­il­ity or com­pre­hens­ib­il­ity of data be­ing ad­versely af­fected or that may lead to mal­func­tions;

c.

cy­ber risk means the risk of a cy­ber in­cid­ent, the ex­tent of which is meas­ured by the product of the prob­ab­il­ity of oc­cur­rence and the ex­tent of the dam­age po­ten­tially caused;

d.

re­si­li­ence means the abil­ity of a sys­tem, or­gan­isa­tion or so­ci­ety to with­stand in­tern­al or ex­tern­al dis­rup­tions and to main­tain prop­er func­tion­al­ity or re­store it as quickly and com­pletely as pos­sible;

e.

in­form­a­tion tech­no­logy se­cur­ity means the as­pect of cy­ber se­cur­ity that relates to tech­nic­al sys­tems;

f.

IT se­cur­ity dir­ect­ives means the se­cur­ity stand­ards that ap­ply to the or­gan­isa­tion­al meas­ures, pro­cesses, ser­vices and tech­no­logy;

g.

crit­ic­al in­fra­struc­tures means pro­cesses, sys­tems and fa­cil­it­ies that are es­sen­tial for the prop­er func­tion­ing of the eco­nomy or the well-be­ing of the pop­u­la­tion;

h.⁶

pro­tec­ted IT sys­tems is a gen­er­ic term for ap­plic­a­tions, ser­vices, sys­tems, net­works, data col­lec­tions, in­fra­struc­tures and in­form­a­tion tech­no­logy products; pro­tec­ted IT sys­tems can in­clude a com­bin­a­tion of sev­er­al identic­al or re­lated sys­tems;

¹ The Fed­er­al Ad­min­is­tra­tion shall en­sure that its or­gans and sys­tems are suit­ably re­si­li­ent to cy­ber risks.

² It shall work with the can­tons, the com­munes, the private sec­tor, so­ci­ety, aca­demia and in­ter­na­tion­al part­ners provided this serves to pro­tect its own se­cur­ity in­terests, and shall en­cour­age the ex­change of in­form­a­tion.

The Fed­er­al Coun­cil shall set out in a na­tion­al strategy for the pro­tec­tion of Switzer­land against cy­ber risks (NCS) the stra­tegic frame­work for im­prov­ing the pre­ven­tion and early de­tec­tion of and the re­ac­tion and re­si­li­ence to cy­ber risks.

The meas­ures to pro­tect against cy­ber risks are di­vided in­to the fol­low­ing three do­mains:

a.

cy­ber se­cur­ity do­main: all meas­ures that serve to pre­vent and man­age in­cid­ents and to im­prove re­si­li­ence against cy­ber risks and that strengthen in­ter­na­tion­al co­oper­a­tion for this pur­pose;

b.

cy­ber de­fence do­main: all in­tel­li­gence and mil­it­ary meas­ures de­signed to pro­tect crit­ic­al sys­tems, de­fend against at­tacks in cy­ber­space, en­sure the op­er­a­tion­al read­i­ness of the Armed Forces in all situ­ations, and build ca­pa­cit­ies and cap­ab­il­it­ies to provide sub­si­di­ary sup­port to ci­vil­ian au­thor­it­ies; they in­clude act­ive meas­ures to re­cog­nise threats, to identi­fy ag­gressors and to dis­rupt and stop at­tacks;

c.

cy­ber pro­sec­u­tion do­main: all meas­ures taken by the po­lice and fed­er­al and can­ton­al pro­sec­utors to com­bat cy­ber crime.

The Fed­er­al Coun­cil shall carry out the fol­low­ing tasks:

a.

It mon­it­ors the im­ple­ment­a­tion of the NCS on the basis of the stra­tegic con­trolling and de­cides on meas­ures as re­quired.

b.

It shall with­in the scope of its re­spons­ib­il­it­ies spe­cify the areas in which dir­ect­ives on pro­tec­tion against cy­ber risks are re­quired or must be re­vised.

c.

It shall is­sue dir­ect­ives on pro­tect­ing the Fed­er­al Ad­min­is­tra­tion against cy­ber risks.

d.

It shall au­thor­ise derog­a­tions from its dir­ect­ives.

¹ The Cy­ber Core Group (CyCG) shall com­prise:

a.

the Fed­er­al Cy­ber Se­cur­ity Del­eg­ate (Art. 6a of the Fed­er­al De­part­ment of Fin­ance Or­gan­isa­tion Or­din­ance of 17 Feb. 2010⁷) as the rep­res­ent­at­ive of the Fed­er­al De­part­ment of Fin­ance (FDF);

b.

a rep­res­ent­at­ive of the Fed­er­al De­part­ment of De­fence, Civil Pro­tec­tion and Sport (DDPS);

c.

a rep­res­ent­at­ive of the Fed­er­al De­part­ment of Justice and Po­lice (FD­JP);

d.

a rep­res­ent­at­ive of the can­tons ap­poin­ted by the Con­fer­ence of Can­ton­al Gov­ern­ments.

² The Fed­er­al Cy­ber Se­cur­ity Del­eg­ate chairs the Group.

³ The CyCG shall in­form rep­res­ent­at­ives of oth­er fed­er­al ad­min­is­trat­ive units that are act­ive in con­nec­tion with cy­ber risks about its agenda and may in­vite them to at­tend in­di­vidu­al meet­ings. Where mat­ters have a for­eign policy di­men­sion, it may in­volve the Fed­er­al De­part­ment of For­eign Af­fairs (FD­FA). In ad­di­tion it may in­volve ex­perts from the private sec­tor and the uni­versit­ies.

⁴ The CyCG has the fol­low­ing tasks in par­tic­u­lar:

a.

It as­sesses cur­rent cy­ber risks and their po­ten­tial de­vel­op­ment on the basis of in­form­a­tion from the do­mains of cy­ber se­cur­ity, cy­ber de­fence and cy­ber pro­sec­u­tion.

b.

It con­tinu­ously eval­u­ates the ex­ist­ing sys­tems in the do­mains of cy­ber se­cur­ity, cy­ber de­fence and cy­ber pro­sec­u­tion and checks wheth­er these are ad­ap­ted to the threat situ­ation.

c.

It provides sup­port, if ne­ces­sary with oth­er of­fices, for in­ter­de­part­ment­al in­cid­ent man­age­ment.

d.

It in­forms the Fed­er­al Se­cur­ity Core Group (SCG) about cy­ber in­cid­ents and de­vel­op­ments that are rel­ev­ant to for­eign and se­cur­ity-policy.

⁵ The three de­part­ments rep­res­en­ted in the CyCG shall make in­form­a­tion avail­able for the joint as­sess­ment of a situ­ation.

⁶ The Fed­er­al In­tel­li­gence Ser­vice is re­spons­ible for present­ing the over­all cy­ber threat situ­ation to the CyCG.

¹ The Fed­er­al Coun­cil shall ap­point a Steer­ing Com­mit­tee for the Na­tion­al Strategy for the Pro­tec­tion of Switzer­land against Cy­ber Risks (NCS StC).

² The NCS StC shall com­prise the Fed­er­al Cy­ber Se­cur­ity Del­eg­ate, rep­res­ent­at­ives from the can­tons ap­poin­ted by the Con­fer­ence of Can­ton­al Gov­ern­ments, rep­res­ent­at­ives of busi­ness and the uni­versit­ies and rep­res­ent­at­ives of the ad­min­is­trat­ive units that are re­spons­ible for im­ple­ment­ing any NCS meas­ures in ac­cord­ance with the NCS im­ple­ment­a­tion plan. Each de­part­ment and the Fed­er­al Chan­cellery shall ap­point at least one rep­res­ent­at­ive to the NCS StC.

³ The Fed­er­al Cy­ber Se­cur­ity Del­eg­ate chairs the Steer­ing Com­mit­tee.

⁴ The NCS StC has the fol­low­ing tasks:

a.

It en­sures the stra­tegic co­her­ence of the im­ple­ment­a­tion of NCS meas­ures and checks their pro­gress con­tinu­ously by a pro­cess of stra­tegic con­trolling.

b.

It draws up pro­pos­als for spe­cial meas­ures in the event of the delayed or in­com­plete im­ple­ment­a­tion of NCS meas­ures.

c.

It en­sures the on­go­ing fur­ther de­vel­op­ment of the NCS; to do so it mon­it­ors the de­vel­op­ment of the threat situ­ation in con­sulta­tion with the CyCG and de­vises pro­pos­als for the ad­just­ment of the NCS as re­quired.

d.

It pre­pares a re­port each year on the im­ple­ment­a­tion of the NCS for the Fed­er­al Coun­cil and the pub­lic.

e.

It en­sures all the of­fices con­cerned from the Con­fed­er­a­tion, can­tons, busi­ness and uni­versit­ies take a co­ordin­ated ap­proach to im­ple­ment­ing the NCS meas­ures.

f.

It en­sures that in im­ple­ment­ing the NCS meas­ures ac­count is taken of the risk policy of the Con­fed­er­a­tion, the na­tion­al strategy to pro­tect crit­ic­al in­fra­struc­tures and the Fed­er­al Coun­cil strategies in re­la­tion to in­form­a­tion tech­no­logy.

¹ The IT Se­cur­ity Com­mit­tee (ITSC) com­prises a rep­res­ent­at­ive of the Na­tion­al Cy­ber Se­cur­ity Centre (NC­SC⁸), the de­part­ment­al and the Fed­er­al Chan­cellery IT se­cur­ity of­ficers and the IT se­cur­ity of­ficers for stand­ard in­form­a­tion and com­mu­nic­a­tion tech­no­logy ser­vices (ICT).

² Ad­di­tion­al per­sons may be in­cluded in an ad­vis­ory ca­pa­city on a case-by-case basis.

³ The NC­SC rep­res­ent­at­ive chairs the com­mit­tee.

⁴ The ITSC acts as a con­sultat­ive body for the NC­SC on IT se­cur­ity is­sues in the Fed­er­al Ad­min­is­tra­tion.

¹ The Fed­er­al Cy­ber Se­cur­ity Del­eg­ate has the fol­low­ing tasks:

a.

He or she chairs the NC­SC.

b.

He or she en­sures the best pos­sible co­ordin­a­tion of cross-de­part­ment­al work in the do­mains of cy­ber se­cur­ity, cy­ber de­fence and cy­ber pro­sec­u­tion.

c.

He or she en­sures the vis­ib­il­ity of the activ­it­ies of the Con­fed­er­a­tion re­lated to cy­ber risks, con­trib­utes to achiev­ing the best pos­sible con­di­tions for an in­nov­at­ive cy­ber se­cur­ity eco­nomy, is the rel­ev­ant fed­er­al con­tact per­son for cy­ber risks and rep­res­ents the Con­fed­er­a­tion in the rel­ev­ant com­mit­tees and work­ing groups; he or she en­sures the best pos­sible co­ordin­a­tion of the work of the can­tons and of the Con­fed­er­a­tion to pro­tect Switzer­land against cy­ber risks.

d.

He or she rep­res­ents the NC­SC in the fed­er­al crisis units.

e.

He or she shall is­sue IT se­cur­ity dir­ect­ives.

f.⁹

He or she de­cides on derog­a­tions from the dir­ect­ives that he or she is­sues; if the derog­a­tions also af­fect dir­ect­ives is­sued by the Fed­er­al Chan­cellery on the di­git­al trans­form­a­tion und ICT steer­ing, he or she shall con­sult the Fed­er­al Chan­cellery be­fore­hand.

² He or she shall reg­u­larly in­form the FDF on be­half of the Fed­er­al Coun­cil about the status of in­form­a­tion tech­no­logy se­cur­ity in the de­part­ments and the Fed­er­al Chan­cellery.

³ He or she may par­ti­cip­ate in the pre­par­a­tion of Fed­er­al Ad­min­is­tra­tion IT dir­ect­ives that re­late to cy­ber se­cur­ity and in se­cur­ity-rel­ev­ant IT pro­jects. In par­tic­u­lar he or she may re­quest in­form­a­tion, com­ment there­on and re­quest changes.

⁴ He or she may, after con­sult­ing the Swiss Fed­er­al Audit Of­fice, re­quest audits of in­form­a­tion tech­no­logy se­cur­ity.

¹ The NC­SC is the centre of ex­cel­lence of the Con­fed­er­a­tion for cy­ber risks and co­ordin­ates the work of the Con­fed­er­a­tion in the cy­ber se­cur­ity do­main. It has the fol­low­ing tasks:

a.

It runs the Na­tion­al Con­tact Point for Cy­ber Risks; this re­ceives re­ports from the Fed­er­al Ad­min­is­tra­tion, the private sec­tor, the can­tons and the pub­lic, ana­lyses them and may is­sue re­com­mend­a­tions there­on.

b.

It en­sures with its co­oper­a­tion part­ners in the Fed­er­al Ad­min­is­tra­tion that sub­si­di­ary sup­port is giv­en to op­er­at­ors of crit­ic­al in­fra­struc­tures and en­cour­ages these op­er­at­ors to ex­change in­form­a­tion on cy­ber risks.

c.

It runs the Com­puter Emer­gency Re­sponse Team (Gov­CERT); this is the na­tion­al spe­cial­ist ser­vice re­spons­ible for tech­nic­al as­pects of in­cid­ent man­age­ment, ana­lys­ing tech­nic­al ques­tions, as­sess­ing the threat situ­ation from a tech­nic­al view­point and provid­ing tech­nic­al sup­port to the Na­tion­al Con­tact Point.

d.

It runs a spe­cial­ist ser­vice for the fed­er­al in­form­a­tion tech­no­logy se­cur­ity; this shall draw up IT se­cur­ity dir­ect­ives, ad­vise the ad­min­is­trat­ive units on their im­ple­ment­a­tion and mon­it­or the status of in­form­a­tion tech­no­logy se­cur­ity in the de­part­ments and the Fed­er­al Chan­cellery.

e.

It provides the fed­er­al IT se­cur­ity of­ficers (FIT­SOs).

f.

It co­ordin­ates the im­ple­ment­a­tion of the NCS, con­ducts stra­tegic con­trols and pre­pares the meet­ings of the CyCG and of the NCS StC.

g.

It has a pool of ex­perts from which ex­perts are provided to sup­port the in­di­vidu­al of­fices in im­ple­ment­ing NCS meas­ures and in de­vel­op­ing, im­ple­ment­ing and check­ing stand­ards and reg­u­la­tions in re­la­tion to cy­ber se­cur­ity.

h.

It con­trib­utes with spe­cif­ic in­form­a­tion to rais­ing aware­ness of cy­ber risks in the Fed­er­al Ad­min­is­tra­tion and among the gen­er­al pub­lic, provides in­form­a­tion on the cur­rent situ­ation and gives in­struc­tions on pre­vent­ive and re­act­ive meas­ures.

i.

It runs a re­si­li­ent ana­lys­is and com­mu­nic­a­tions in­fra­struc­ture that must func­tion in­de­pend­ently of the oth­er fed­er­al IT sys­tems.

j.

It in­forms the CyCG and, on mat­ters of im­port­ance to for­eign and se­cur­ity policy, the SCG about rel­ev­ant cy­ber in­cid­ents.

² It may, provided this dir­ectly or in­dir­ectly serves to pro­tect the Fed­er­al Ad­min­is­tra­tion against cy­ber risks, pro­cess data on cy­ber in­cid­ents and as­so­ci­ated com­mu­nic­a­tion flows. It may dis­close such data to gov­ern­ment and private se­cur­ity teams, provided:

a.

the data pro­vider agrees; and

b.

no stat­utory du­ties of con­fid­en­ti­al­ity are in­fringed.

³ A dis­clos­ure of per­son­al data abroad is only per­mit­ted if the re­lated re­quire­ments of the fed­er­al le­gis­la­tion on data pro­tec­tion are com­plied with.

⁴ Sens­it­ive per­son­al data may only be pro­cessed if there is a stat­utory basis for pro­cessing such data with the means avail­able with­in the fed­er­al IT sys­tems.

⁵ After con­sult­ing with the of­fices con­cerned, the NC­SC shall as­sume over­all re­spons­ib­il­ity with­in the Fed­er­al Ad­min­is­tra­tion for man­aging a cy­ber in­cid­ent if the in­cid­ent poses a risk to the prop­er func­tion­ing of the Fed­er­al Ad­min­is­tra­tion. In do­ing so, it has the fol­low­ing tasks and powers:

a.

It may re­quire the ser­vice pro­viders and re­cip­i­ents con­cerned to provide it with all ne­ces­sary in­form­a­tion.

b.

It may or­der im­me­di­ate meas­ures.

c.

It shall up­date the man­age­ment of the ad­min­is­trat­ive units con­cerned on the cur­rent situ­ation.

⁶ If, fol­low­ing a cy­ber in­cid­ent, the risk to the con­fid­en­ti­al­ity or the ef­fi­ciency of the Fed­er­al Ad­min­is­tra­tion is suf­fi­ciently re­duced by the meas­ures taken and if the re­quired fol­low-up work and its fund­ing have been defined, the NC­SC shall re­as­sign re­spons­ib­il­ity for the fur­ther pro­cessing to the of­fices con­cerned.

¹ The de­part­ments and the Fed­er­al Chan­cellery shall re­port to the NC­SC at the end of the year on the status of in­form­a­tion tech­no­logy se­cur­ity.

² The in­tern­al ser­vice pro­viders in ac­cord­ance with Art­icle 9 DTIO¹⁰ shall sub­mit reg­u­lar re­ports to the NC­SC on weak­nesses and cy­ber in­cid­ents that have been de­tec­ted and on meas­ures planned and taken for their rec­ti­fic­a­tion.¹¹

³ The de­part­ments and the Fed­er­al Chan­cellery shall each ap­point a de­part­ment­al IT se­cur­ity of­ficer (ITS­OD), who shall act on the dir­ect in­struc­tions of the head of de­part­ment.¹²

⁴ The ITS­ODs are in par­tic­u­lar re­spons­ible for:

a.

co­ordin­at­ing IT se­cur­ity as­pects with­in the de­part­ment or the Fed­er­al Chan­cellery and with the of­fices re­spons­ible for cross-de­part­ment­al co­ordin­a­tion and co­oper­a­tion.

b.

draw­ing up the re­quired prin­ciples for im­ple­ment­ing the IT se­cur­ity dir­ect­ives and for or­gan­isa­tion at the level of the de­part­ment or the Fed­er­al Chan­cellery.¹³

⁵ The de­part­ments and the Fed­er­al Chan­cellery shall reg­u­late the re­la­tion­ship between the ITS­ODs and the IT se­cur­ity of­ficers for the ad­min­is­trat­ive units (IT­SOOs), in par­tic­u­lar tech­nic­al lead­er­ship on se­cur­ity is­sues.¹⁴

¹ The ad­min­is­trat­ive units shall each ap­point an IT se­cur­ity of­ficer (IT­SOO) who shall act on the dir­ect in­struc­tions of the head of the ad­min­is­trat­ive unit. The Di­git­al Trans­form­a­tion and ICT Steer­ing Sec­tor at the Fed­er­al Chan­cellery (DTI Sec­tor of the FCh) shall also ap­point an IT se­cur­ity of­ficer for stand­ard ser­vices.

² The IT­SOOs and the IT se­cur­ity of­ficer for stand­ard ser­vices shall carry out the fol­low­ing tasks:

a.

They shall en­sure the rap­id im­ple­ment­a­tion of the IT se­cur­ity dir­ect­ives andthe use of the se­cur­ity pro­ced­ures in the ad­min­is­trat­ive units (Chapter 3a).

b.

They shall en­sure that em­ploy­ees are made aware of and re­ceive train­ing on IT se­cur­ity is­sues on tak­ing up em­ploy­ment and peri­od­ic­ally there­after and are fa­mil­i­ar with the re­spons­ib­il­it­ies and pro­ced­ures for in­form­a­tion tech­no­logy se­cur­ity in their work­ing en­vir­on­ment rel­ev­ant to their level and func­tion.

c.

They shall re­port to the head of their ad­min­is­trat­ive unit at least every six months on the cur­rent status of in­form­a­tion tech­no­logy se­cur­ity in their ad­min­is­trat­ive unit.

³ The ad­min­is­trat­ive units are re­spons­ible for the se­cur­ity of their pro­tec­ted IT sys­tems. They shall carry out the fol­low­ing tasks:

a.

They shall con­duct an in­vent­ory of their pro­tec­ted IT sys­tems and take the re­quired se­cur­ity meas­ures; they shall in par­tic­u­lar en­sure that these meas­ures are doc­u­mented for the in­di­vidu­al pro­tec­ted sys­tems in the cur­rent man­ner.

b.

They are re­spons­ible for com­pli­ance with and the im­ple­ment­a­tion of the IT se­cur­ity dir­ect­ives and the de­cisions of the Fed­er­al Coun­cil, the NC­SC and the de­part­ments or the Fed­er­al Chan­cellery with­in the scope of their re­spons­ib­il­it­ies.

c.

They are re­spons­ible, sub­ject to Art­icle 12 para­graph 5, for man­aging cy­ber in­cid­ents that af­fect their pro­tec­ted IT sys­tems.

d.

When ob­tain­ing ser­vices from an ex­tern­al ser­vice pro­vider, they shall en­sure that the IT se­cur­ity dir­ect­ives form part of the con­trac­tu­al re­la­tion­ship with that pro­vider.

e.

They shall veri­fy in an ap­pro­pri­ate man­ner wheth­er ex­tern­al ser­vice pro­viders are com­ply­ing with the IT dir­ect­ives.

f.

They shall en­sure that the re­spons­ib­il­it­ies for in­form­a­tion tech­no­logy se­cur­ity at an op­er­a­tion­al level are set out in the pro­ject and per­form­ance agree­ments between ser­vice pro­viders and ser­vice pro­curers.

g.

They shall en­sure that per­sons to whom this Or­din­ance does not ap­ply are only al­lowed ac­cess to fed­er­al IT in­fra­struc­ture if they un­der­take to com­ply with the IT se­cur­ity dir­ect­ives.

⁴ The ser­vice pro­viders shall per­form the fol­low­ing func­tions:

a.

They shall provide their ser­vice pro­curers on re­quest with all the in­form­a­tion re­quired to pro­tect their pro­tec­ted IT sys­tems in an ap­pro­pri­ate form.

b.

They shall en­sure that they have the ca­pa­cit­ies re­quired to con­duct a tech­nic­al ana­lys­is and man­age cy­ber in­cid­ents that af­fect them dir­ectly or af­fect their ser­vice pro­curers.

c.

They shall re­port to their ser­vice pro­curers without delay any weak­nesses and se­cur­ity in­cid­ents that they de­tect that re­late to their pro­tec­ted IT sys­tems.

d.

They shall work with the ser­vice pro­viders to define a pro­cess for man­aging cy­ber in­cid­ents. The pro­cess shall in par­tic­u­lar reg­u­late de­cision-mak­ing powers in re­la­tion to im­me­di­ate meas­ures.

⁵ If it is not pos­sible to man­age a cy­ber in­cid­ent in ac­cord­ance with the defined pro­cess, the parties con­cerned shall in­form the NC­SC so that it can de­cide on what fur­ther ac­tion to take.

⁶ The ad­min­is­trat­ive units shall con­sult the NC­SC in con­nec­tion with se­cur­ity-rel­ev­ant IT dir­ect­ives as well as pro­jects.

⁷ They are re­spons­ible for de­vel­op­ing, im­ple­ment­ing and check­ing stand­ards and reg­u­la­tions in re­la­tion to cy­ber se­cur­ity in their sec­tors. The NC­SC shall wherever pos­sible provide them with ex­perts from the pool men­tioned in Art­icle 12 para­graph 1 let­ter g.

Em­ploy­ees of the Fed­er­al Ad­min­is­tra­tion who use IT Re­sources are re­spons­ible for us­ing them in ac­cord­ance with the reg­u­la­tions.

¹ The ad­min­is­trat­ive units shall en­sure that an up-to-date pro­tec­tion needs ana­lys­is is avail­able for all pro­tec­ted IT sys­tems. In the case of IT pro­jects, they must con­duct the pro­tec­tion needs ana­lys­is be­fore the pro­ject re­lease.

² In the pro­tec­tion needs ana­lys­is, they shall as­sess the as­pects of con­fid­en­ti­al­ity, avail­ab­il­ity, in­teg­rity, com­pre­hens­ib­il­ity and vul­ner­ab­il­ity to es­pi­on­age.

The ad­min­is­trat­ive units shall im­ple­ment the dir­ect­ives on ba­sic pro­tec­tion for all pro­tec­ted IT sys­tems and doc­u­ment the im­ple­ment­a­tion.

¹ If the pro­tec­tion needs ana­lys­is dis­closes an in­creased need for pro­tec­tion, the ad­min­is­trat­ive units, in ad­di­tion to im­ple­ment­ing the se­cur­ity dir­ect­ives on ba­sic pro­tec­tion and based on a risk ana­lys­is, shall de­vise fur­ther se­cur­ity meas­ures and doc­u­ment and im­ple­ment the same.

² The ad­min­is­trat­ive units shall identi­fy risks that can­not be re­duced or can only be in­suf­fi­ciently re­duced (re­sid­ual risks), and doc­u­ment the same. The pro­ject cli­ent or the busi­ness pro­cess own­er and the head of the ad­min­is­trat­ive unit shall take note of the re­sid­ual risks and con­firm the same in writ­ing.

³ The head of the ad­min­is­trat­ive unit con­cerned shall de­cide wheth­er known re­sid­ual risks are ac­cep­ted.

¹ The se­cur­ity pro­ced­ures must be car­ried out at least every five years.

² In the event of se­cur­ity-rel­ev­ant modi­fic­a­tions be­ing made to the pro­tec­ted IT sys­tem or to the threat situ­ation, the pro­ced­ures must be car­ried out im­me­di­ately.

The amend­ment of oth­er le­gis­la­tion is reg­u­lated in the An­nex.

¹ Au­thor­it­ies and of­fices that have un­der­taken by agree­ment with the Fed­er­al IT Steer­ing Unit (FITSU) to com­ply with the pro­vi­sions of the Fed­er­al Ad­min­is­tra­tion In­form­a­tion Tech­no­logy Or­din­ance of 9 Decem­ber 2011¹⁹ (FAITO) be­fore this Or­din­ance comes in­to force shall be sub­ject un­til 31 Decem­ber 2021 to the ob­lig­a­tions in ac­cord­ance with this Or­din­ance to the ex­tent un­der the cur­rent law.²⁰

² They shall be sub­ject to this Or­din­ance from 1 Janu­ary 2022, un­less the agree­ment is ter­min­ated on or be­fore 31 Decem­ber 2021.

¹ ICT se­cur­ity dir­ect­ives and per­mit­ted ex­cep­tions is­sued by the FITSU be­fore this Or­din­ance comes in­to force shall con­tin­ue to ap­ply.

² The NC­SC shall de­cide on amend­ments to the dir­ect­ives and au­thor­ised ex­cep­tions.

This Or­din­ance comes in­to force on 1 Ju­ly 2020.