Swiss federal auditors say cyber incident reporting hub is ready for mandatory 24-hour regime
Published · Updated
What happened
The Swiss Federal Audit Office reported that the Federal Office for Cybersecurity's Cyber Security Hub can support mandatory 24-hour cyber-incident reporting by critical infrastructure operators and that incident-response staffing is sufficient.
Why it matters
The audit provides a fresh official basis for Swiss authorities to proceed with enforcement, onboarding, and operational testing of a reporting system tied to cyber obligations for operators of essential services. It also narrows one common implementation defense from regulated entities: that the state platform itself is not ready.
On 4 November 2026, the Swiss Federal Audit Office said the Federal Office for Cybersecurity's Cyber Security Hub is technically and organizationally robust enough to operate the mandatory 24-hour cyber-incident reporting regime for critical infrastructure operators. The audit also said staffing for incident response is sufficient. The finding gives Bern a current readiness check on the state's reporting backbone just as compliance and enforcement choices move from design to operation.
Watch for
Federal Office for Cybersecurity publication on or after 2026-11-05 of updated guidance for mandatory 24-hour incident reporting by critical infrastructure operators Federal Department of Finance statement on or after 2026-11-05 setting implementation or enforcement steps tied to the Cyber Security Hub audit finding Swiss Federal Audit Office release on or after 2026-11-05 of the full audit text or recommendations specifying remaining control gaps No Federal Office for Cybersecurity notice by 2026-11-08 announcing a phased rollout, grace period, or reporting-volume stress test for the hub
Researched and written by AI from the sources listed, under published rules. How V³ Aware is made