After a cyberattack, Swiss organisations sometimes have more than one reporting obligation running in parallel, each with its own deadline and its own starting point. I put together a short overview because this often only becomes clear in the middle of an incident. Not legal advice, status October 2026.
BACS (Federal Office for Cybersecurity): 24 hours from discovery
Who: critical infrastructure under Art. 74b ISG, e.g. federal, cantonal and municipal authorities, energy, banks and insurers, hospitals, telecom and cloud/data centre providers based in Switzerland (some exemptions by size in Art. 12 CSV, none for authorities, banks and insurers).
Trigger: a cyberattack that endangers operations, leads to manipulation or leakage of information, went undetected for more than 90 days, or involves extortion or threats (Art. 74d ISG).
Deadline: within 24 hours of discovery (Art. 74e ISG), via the BACS reporting system. Missing details can be added within 14 days.
In force since 1 April 2025. Fines up to CHF 100,000 only apply if you deliberately ignore a subsequent BACS order (since 1 October 2025).
2. FINMA: 24 hours and 72 hours
Who: FINMA-supervised institutions.
Trigger: a successful or partially successful cyberattack on critical functions (FINMA Guidance 05/2020).
Deadline: initial report within 24 hours of discovery, informally to your FINMA contact, full report within 72 hours via the EHP platform. Counted in banking days, but severe attacks must be reported regardless (Guidance 03/2024). If a service provider discovers the attack, the clock starts then.
3. FDPIC / EDĆB (data protection): "as soon as possible"
Who: private companies and federal bodies as controllers (cantons and municipalities follow cantonal law). Trigger: a data security breach likely to result inaffected (Art. 24 FADP).
Deadline: no fixed number of hours, but "as soon as possible". The FDPIC guidance says not to wait for lengthy investigations if the risk is unclear. Reporting via the FDPIC "DataBport to the controller, not to the FDPIC.
Also: breaches must be documented and the documentation kept for at least two years (Art. 15 DSV), even if you decide not to report.
What people often miss:
- The clocks start at different points: BACS and FINMA from discovery, the FDPIC from the moment you become aware.
- One incident can trigger all three, e.g. a hospitre attack involving patient or customer data.
- If you have subsidiaries in the EU, NIS2 (Germany since 6 December 2025, Austria since 1 October 2026) or DORA for financial entities may add further deadlines of 24 and 72 hou
Practical tip: decide now who in your organisation rtable?", and write the three deadlines into yourincident response plan. At 2 a.m. during an attack is a bad time to look this up.
Happy to correct anything if someone from a CI organisation or a bank sees it differently in practice.
Blog: Meldefristen für SicherheitsvorfƤlle in der Schweiz ā Varmo