Audit of infrastructure and resources for reporting operations
Bern, 04.11.2026 — Effective since 1 April 2025, critical infrastructure operators must report cyberattacks to the National Cyber Security Centre (NCSC) within 24 hours. For this purpose, the NCSC uses the Cyber Security Hub (CSH) online platform, via which reportable incidents and up-to-date threat and vulnerability data can be exchanged.
The Swiss Federal Audit Office (SFAO) conducted an audit to determine whether the NCSC has a robust cyber reporting platform, both technically and organisationally, and sufficient staffing to perform its statutory tasks in connection with the reporting obligation. It concluded that CSH enables efficient report processing and that the staffing of the incident management team is sufficient.