Ordinance
on Protection against Cyber Risks
in the Federal Administration
(Cyber Risks Ordinance, CyRV)

¹ The Cy­ber Core Group (CyCG) shall com­prise:

a.

the Fed­er­al Cy­ber Se­cur­ity Del­eg­ate (Art. 6a of the Fed­er­al De­part­ment of Fin­ance Or­gan­isa­tion Or­din­ance of 17 Feb. 2010⁷) as the rep­res­ent­at­ive of the Fed­er­al De­part­ment of Fin­ance (FDF);

b.

a rep­res­ent­at­ive of the Fed­er­al De­part­ment of De­fence, Civil Pro­tec­tion and Sport (DDPS);

c.

a rep­res­ent­at­ive of the Fed­er­al De­part­ment of Justice and Po­lice (FD­JP);

d.

a rep­res­ent­at­ive of the can­tons ap­poin­ted by the Con­fer­ence of Can­ton­al Gov­ern­ments.

² The Fed­er­al Cy­ber Se­cur­ity Del­eg­ate chairs the Group.

³ The CyCG shall in­form rep­res­ent­at­ives of oth­er fed­er­al ad­min­is­trat­ive units that are act­ive in con­nec­tion with cy­ber risks about its agenda and may in­vite them to at­tend in­di­vidu­al meet­ings. Where mat­ters have a for­eign policy di­men­sion, it may in­volve the Fed­er­al De­part­ment of For­eign Af­fairs (FD­FA). In ad­di­tion it may in­volve ex­perts from the private sec­tor and the uni­versit­ies.

⁴ The CyCG has the fol­low­ing tasks in par­tic­u­lar:

a.

It as­sesses cur­rent cy­ber risks and their po­ten­tial de­vel­op­ment on the basis of in­form­a­tion from the do­mains of cy­ber se­cur­ity, cy­ber de­fence and cy­ber pro­sec­u­tion.

b.

It con­tinu­ously eval­u­ates the ex­ist­ing sys­tems in the do­mains of cy­ber se­cur­ity, cy­ber de­fence and cy­ber pro­sec­u­tion and checks wheth­er these are ad­ap­ted to the threat situ­ation.

c.

It provides sup­port, if ne­ces­sary with oth­er of­fices, for in­ter­de­part­ment­al in­cid­ent man­age­ment.

d.

It in­forms the Fed­er­al Se­cur­ity Core Group (SCG) about cy­ber in­cid­ents and de­vel­op­ments that are rel­ev­ant to for­eign and se­cur­ity-policy.

⁵ The three de­part­ments rep­res­en­ted in the CyCG shall make in­form­a­tion avail­able for the joint as­sess­ment of a situ­ation.

⁶ The Fed­er­al In­tel­li­gence Ser­vice is re­spons­ible for present­ing the over­all cy­ber threat situ­ation to the CyCG.