The Cyber-Safe label is a Swiss cybersecurity certification designed for SMEs, municipalities and small organisations. Created in 2018 and run by the Swiss Association for the Cybersecurity Label (ASLaC), it starts with a neutral assessment of the current situation and ends with a verification of the measures taken. According to its website, cyber-safe.ch, 250 SMEs and 200 Swiss municipalities hold the label.
For a small or medium-sized enterprise (SME), the label serves above all to find out where it stands, to obtain an action plan and to show its efforts to its customers. It extends an SME cybersecurity approach that starts with the basics. This page distinguishes between what the association claims, what the labelled organisations say and our own analysis.
What is the Cyber-Safe label?
The Cyber-Safe label presents itself as "the Swiss cybersecurity label". Its motto fits in three words: "Human. Reliable. Accessible." The association describes itself as neutral and independent.
Its requirements are developed by ASLaC. The website presents Cyber-Safe as an implementation partner for the national cybersecurity strategy of the Federal Office for Cyber Security (NCSC).
The label also claims to be recognised by the Confederation in its national cyber strategy. It claims the backing of the major Swiss insurers, the main professional umbrella organisations and the associations of municipalities. Its home page does not name these partners.
Why a cybersecurity label for an SME?
The association starts from an observation of inequality in the face of cyber risks. Multinationals and large companies have the resources and skills to deal with them. SMEs, municipalities, foundations and other small organisations, it says, are "often ill-equipped".
Recent Swiss figures confirm how exposed SMEs are. According to the SME Cybersecurity Study 2026, published on 22 October 2026, 6% of SMEs suffered a serious cyberattack in three years. This share reaches up to 16% among SMEs with at least ten employees.
The gap lies mainly in organisation, according to the same study. More than 80% of SMEs install updates and nine in ten make backups. But only around a third regularly train their staff or keep an inventory of their systems. Security audits and emergency plans remain much less widespread.
Our analysis: this organisational ground is precisely what a label based on an external audit targets. The process forces the company to establish who does what, and not just to install tools.
How does the labelling process work?
The website describes a five-part approach, each part linked to a benefit:
- an assessment of the current situation, to find out where the organisation stands and who does what;
- recommendations, to prepare to deal with a crisis;
- an action plan, to secure systems and data;
- a verification of the actions, to strengthen the trust of customers and partners;
- additional protection, in the form of favourable premiums with partner cyber insurers.
The work relies on auditors. The website lists 17 of them across Switzerland. Its experts support organisations and help them find solutions and providers suited to their needs.
One testimonial details the process in practice. Andrew Blair, head of IT services and solutions at Zurich International School, first describes a pre-assessment. This is followed by an in-depth review of systems and data processing, then the updating of all documentation.
In this case, the process ended with two full-day audits. Andrew Blair describes it as long, but very valuable. The process took place in English, with other languages available.
Who has already obtained the Cyber-Safe label?
The label claims 250 SMEs and 200 municipalities labelled across Switzerland. The certified organisations have between 3 and 248 employees, according to the website. The label is therefore also aimed at very small organisations.
The published testimonials cover a variety of profiles. They include Socorex, Bhaasha, AUBEP, the municipality of Roche, Cavin-Baudat (Vallée de Joux) SA and Digital Lab SA, Zurich International School and the Foundation for Vocational and Continuing Education (FFPC).
What do labelled organisations take away from it?
Labelled organisations stress above all the discovery of their weak points. At Socorex, Tatjana Van Bogaert considers the audit process "rigorous but extremely beneficial". It made it possible to identify and strengthen the company's weak points.
The preparation also leads to concrete changes. Gopal Krishnamani, founder of Bhaasha, cites improvements to infrastructure, IT platforms and risk management processes.
The label is renewed, and its requirements evolve. Jean Bourgeois, president of AUBEP, is going through the certification for the second time. He notes that the requirements "evolve and become stricter from one session to the next". At the FFPC, the renewal prompted reflection on the risk of passing sensitive information to artificial intelligence (AI).
Municipalities also see value in it. Aurélie Tulot, mayor of Roche, points out that "zero risk does not exist". The label nevertheless helped the municipality identify its critical points and anticipate risks.
Our analysis: these testimonials are selected and published by the label itself. They show the perceived value of the process, not its measured effectiveness against attacks.
Label, test or standard: which tool to choose?
A Swiss SME has several assessment tools available, which do not answer the same question. The free SME cybersecurity test gives a first picture. The Confederation's ICT minimum standard serves as a checklist. The label adds an outside view and a verification.
| Tool | Who runs it | What it provides | Its limitation |
|---|---|---|---|
| Cybersecurity-Check | Tool stemming from the national strategy, version 4.0 of November 2025 | A free self-assessment in a few minutes | It relies on the company's own answers |
| ICT minimum standard | The NCSC, since March 2024 | A reference framework and a self-assessment tool in Excel format | Optional for an SME, binding only for electricity and gas |
| Cyber-Safe label | ASLaC, since 2018 | An assessment of the current situation, an action plan and a verification by an auditor | Neither price nor duration published on the home page |
Our analysis: these tools complement each other more than they compete. The free check helps prepare an audit and set priorities. The label is better suited to an organisation that wants an external review and a signal to show its customers.
Other practical pages can be found in our protecting your business section.
Does the label lower the cyber insurance premium?
The website promises "favourable premiums" with partner cyber insurers. Its home page names neither these insurers nor the size of the discounts.
Insurance is no substitute for prevention. "Cyber insurance can mitigate risks, but it does not replace personal responsibility," Jesús Pampín, head of the cyber risk competence centre at Swiss Mobiliar, pointed out at the presentation of the 2026 study.
Key figures
- 2018: the Cyber-Safe label was created.
- 250 SMEs labelled across Switzerland, according to the website.
- 200 Swiss municipalities labelled.
- 17 auditors active across Switzerland.
- Between 3 and 248 employees in the labelled organisations.
- More than 25,000 phishing emails sent, according to the website's counter.
What we don't know yet
The cyber-safe.ch home page leaves several questions open:
- the price of the labelling and its renewal;
- the label's period of validity and the frequency of audits;
- the detailed list of requirements and any link with the ICT minimum standard;
- the time needed to obtain the label;
- the partner insurers and the size of the discounts;
- the context in which the phishing emails were sent;
- the date on which the displayed figures were last updated.
The website also offers to assess your organisation, without describing this tool on its home page.
Sources
- Cyber-Safe, the Swiss cybersecurity label (cyber-safe.ch)
- "SME Cybersecurity 2026" study by Swiss Mobiliar and its partners, as reported by 2clics.com
- NCSC Cybersecurity-Check and ICT minimum standard, as reported in our pages on the test and the standard
