Cyberattack: deciding within 24 hours

At 8:17, a team spots unusual connections. By 9 o’clock, it still does not know whether data has left the system, yet the regulatory clock may already be running. Since 1 April 2025, certain critical-infrastructure operators have had to report qualifying cyberattacks to the Federal Office for Cyber Security within 24 hours of detection. Waiting for a perfect diagnosis is one mistake; reporting before the right scope and decision owner are known is another. This article follows the first hours of an incident: what the organisation must assess, who decides, how unknowns should be handled and why communication is also a matter of commercial trust. It then considers how a cyber specialist could turn that pressure into a purchasable crisis exercise and continuing work. A scenario is not presented as an executed campaign, and official incident statistics are not treated as market size. General information based on official sources available on 6 August 2026. It is no substitute for legal advice or incident analysis.

The Swiss reporting duty adds a regulatory decision to the technical handling of certain incidents. Since 1 April 2025, affected operators have had to connect detection time, scope, observed effects, responsibility and submission to the Federal Office for Cyber Security within 24 hours.

Parliament adopted the amendment to the Information Security Act on 29 September 2023. The Federal Council then set 1 April 2025 for the revised Act and Cybersecurity Ordinance to enter into force. The duty does not cover every company. It applies to public bodies and organisations defined as critical-infrastructure operators, subject to the stated exceptions.

How to read the diagram. The deadline requires a sufficiently grounded decision, not absolute certainty. The first submission may be completed within fourteen days.

Text alternative. The team timestamps the signal, assesses scope and effects, and reports before 24 hours when the threshold is met or uncertainty cannot be resolved in time. Missing information is completed in the final file.

Diagram sources. Federal Office for Cyber Security, Information on the reporting obligation and Frequently asked questions.

The FOCS names energy and drinking-water supply, transport, and cantonal and municipal administrations among the relevant areas. Its 2025 annual report refers to Articles 73 onwards of the Information Security Act, Article 74b for the organisations covered and the Cybersecurity Ordinance for exceptions. Where coverage is uncertain, the organisation may ask the FOCS for a formal decision. A sector label alone is therefore insufficient.

The 24 hours begin when the cyberattack is detected, not when the technical investigation ends. An affected organisation should preserve the time of the first reliable signal, assign assessment immediately and prepare a report even while some information remains unknown.

“Detection” requires the team to distinguish the raw signal, its recognition as a security event and the discovery of facts that may trigger the duty. A workable procedure names who makes that judgement and preserves what was known at each stage. Without a timestamped log, the reasoning is reconstructed after the event and management cannot show the basis of its decision.

An incident crosses the threshold when it affects an organisation covered by the rules and produces a stated effect: endangering operations, manipulating or leaking information, late detection, blackmail, threat or coercion. An attack that does not affect the critical function does not automatically trigger the duty.

This two-stage assessment—organisation first, event second—prevents every alert becoming a mandatory report. The FOCS gives the example of a denial-of-service attack against a non-critical application. If essential services remain unaffected and there is no apparent propagation risk, interruption of that application alone is not automatically sufficient.

The first-hours file should answer practical questions. Which critical function depends on the affected system? What effect is already observed? Could information have been manipulated or disclosed? Is extortion involved? How long was the event present before discovery? Answers may change, but their source and timestamp must remain visible.

The affected organisation retains the decision even where a service provider analyses the attack or submits the report. Technical teams establish facts, business owners explain operational effects, management assigns the decision, and the partner prepares evidence without becoming the responsible party by default.

The FOCS states that an IT provider or managed-service provider may in some cases report on a client’s behalf, but the delegation must be documented. It does not remove the organisation’s responsibility. A shared mailbox or generic team name is no substitute for a named primary and deputy who can be reached.

Uncertainty should be treated from the first alert as information to assign, not a reason to wait. Classify each point as confirmed, probable or unknown. Give every unknown an owner, next verification step and explicit effect on the reporting decision.

The FOCS says an initial communication must be made within 24 hours even when all information is not yet available. A final report can follow within fourteen days. This supports speed only if hypotheses are not presented as facts.

Three scenarios help. If the critical function is clearly affected, escalation and submission should not wait for the investigation report. If the effect remains uncertain but evidence points in one direction, report what is known and document checks in progress. If there is no demonstrated link between the affected application and the critical function, retain the reasoning, monitor for propagation and reassess when facts change.

The same discipline improves communication with customers, partners and authorities. The organisation can state what is confirmed, what it is already protecting and when the next update will come. That avoids both silence without a deadline and premature reassurance that later needs correction.

The official figures show that the system was used: the FOCS had received 164 mandatory reports after six months and 222 by the end of 2025. These counts describe reporting activity. They measure neither every cyberattack nor the number of cyber engagements available to service providers.

The six-month review listed distributed denial-of-service attacks, hacking, ransomware, credential theft, data leaks and malware among the most frequent attacks. The annual report to the end of December placed hacking ahead of denial-of-service and recorded the largest groups of reports in public administration, information and communication, finance and insurance.

These distributions can inform credible exercises. They cannot predict how many prospects will buy one. A defensible commercial audience still requires accessible organisations, a known level of readiness, a budget owner and a partner able to deliver without creating a bottleneck.

Prepared reporting protects trust by giving stakeholders a reliable timeline, named responsibilities and a scheduled next update. It does not prove the incident is resolved. It shows that the organisation can make and communicate decisions under pressure without overstating incomplete facts.

A customer, insurer or partner wants more than confirmation that a form was sent. It needs to understand what is affected, what emergency measures are underway, who leads the response and when unknowns will be resolved. The decision log links technical facts with commercial commitments without disclosing sensitive details unnecessarily.

Other duties may run in parallel. The Federal Data Protection and Information Commissioner states that a controller must report a data-security breach as soon as possible where it is likely to create a high risk to personality or fundamental rights. The FOCS notes that, on express request, its form can forward a report to certain other authorities, including the FDPIC or FINMA. This facility does not merge thresholds, deadlines or responsibilities; each duty needs case-specific review.

Trust is not maintained by promising perfect security. It comes from accurate communication: known time, known scope, acknowledged limits, assigned decisions and a stated follow-up.

The first purchase can be a bounded crisis exercise that tests the decision chain before a real incident. It should produce a scenario, timed sequence, decision log, gap list and improvement plan. It does not sell guaranteed compliance or unlimited incident response.

This entry offer does not require immediate replacement of security tools. The specialist observes how a signal moves from operations to the business, from assessment to management and from decision to simulated submission. Its value lies in visible gaps: unreachable contacts, ambiguous criteria, incomplete logs, absent deputies or unassigned customer communications.

For getfishnet, the route requires four commercial checks: enough genuinely accessible new accounts, a credible and available partner, pricing that supports expert time, and a payment path without a heavy deployment. Those facts must come from partner evidence; no campaign or revenue is claimed in this article.

Acquisition can identify the right accounts by combining regulatory signals, the organisation’s role, operational criticality and decision maturity. It excludes businesses outside scope, then tests channels without confusing editorial interest, a qualified meeting and cash received.

Research starts with organisations whose activities may fit the official categories, then adds critical dependencies, public notices, security recruitment, customer requirements and people able to sponsor an exercise. Channels may include search, content, sector partners, events, professional networks, email, telephone, voicemail and account-based outreach.

How to read the diagram. Every stage has an exit. An organisation outside scope, with no decision owner or no observable need should not be pushed into a proposal.

The relationship can continue when new systems, suppliers, scenarios or customer requirements create another decision to test. Continuity is not an automatic subscription. Every recurring intervention needs a trigger, an owner and a defined deliverable.

After the first exercise, a partner may support gap closure, rerun the scenario, integrate a new critical supplier or prepare for a customer requirement. A retainer or incident-response service makes sense only where responsibilities, response times and actual capacity are contractually defined.

Commercial tracking separates four proofs: qualified conversation, accepted proposal, payment received and continuation linked to a new need. Maximum penalties of CHF 100,000 and the 222 official reports cannot replace evidence of value, margin and delivery.

Useful sources separate the FOCS duty, data protection and supplier trust. The FOCS documents scope, deadlines, channels and the 2025 record; the FDPIC explains the treatment of data breaches likely to create a high risk.

Principal sources are the FOCS publications Information on the reporting obligation, Frequently asked questions, Six months of mandatory reporting and 2025 Annual Report; the Information Security Act and Cybersecurity Ordinance in Fedlex; and the FDPIC guide to reporting data-security breaches under Article 24 of the Data Protection Act.

The revised Data Protection Act article explains the threshold related to individuals. The IT and cybersecurity market page brings together the available insights.

A 24-hour duty can support a crisis-exercise offer, but it does not prove a profitable market. Action requires a credible partner, accessible accounts, a first purchase that can be invoiced and collected, and sufficient capacity to keep the promise after the sale.

The regulatory signal is documented; commercial value still needs evidence. The eligibility test compares your acquisition challenge, expertise, capacity and economics with the market before a tailored strategy is built. If the conditions are absent, the answer should remain no. Where there is a genuine fit, the next step is a bounded, measurable programme with clear owners.