A cyberattack response plan sets out in advance who decides, who to alert, how to restore data and what to tell customers. In Switzerland, a small or medium-sized enterprise (SME) remains responsible for its own incident. The Federal Office for Cybersecurity (FOCS) only steps in to provide support. This document therefore answers the question "what to do after a cyberattack", including reports to the authorities.
This plan complements the basics of SME cybersecurity, such as updates and two-factor authentication. It does not replace prevention: it organises the hours following an attack. This article distinguishes between the facts reported by our sources and our own analysis.
Key figures
- 6% of Swiss SMEs suffered a serious cyberattack within three years, according to the "SME Cybersecurity 2026" study, compared with 4% in 2024 and in 2025.
- 7% of SMEs have already been victims of extortion, according to the same study.
- Nine in ten SMEs make backups, but only a quarter regularly test restoring them.
- 40% of SMEs would be prepared to report an incident to the FOCS.
- The FOCS on-call line operates 24 hours a day; incidents are classified on four levels, from "low" to "critical".
- Since 1 April 2025, operators of critical infrastructure have been required to report their cyber incidents to the FOCS.
Why does an SME need a written plan?
Because no one will manage the incident for it. "In Switzerland, incident management is the responsibility of the affected organisation itself; the FOCS acts in a subsidiary capacity," Roman Hüssy told PME magazine. He is co-head of Govcert, the FOCS response team.
The office has no power to issue directives. It is the company that chooses between a forensic analysis, to understand the attack, and immediate measures to contain it. Our analysis: this choice is easier to make calmly if it has been discussed before the incident.
This type of plan remains uncommon. According to the SME cybersecurity study 2026, published on 22 October 2026, emergency plans are significantly less common than technical measures. The study does not give a precise figure for their share. Security audits and supplier checks lag behind to the same extent.
To gauge its starting point, an SME cybersecurity test provides an initial assessment. Companies looking for a more comprehensive framework can rely on the Confederation's ICT minimum standard (information and communication technologies).
Who does what during a cyberattack?
The first decision is to appoint a person responsible at management level. The 2026 study makes this its first recommendation and observes that more SMEs are doing so. Cybersecurity thus becomes a matter for management, no longer just for the IT department.
Our analysis: a useful plan assigns at least three roles, with names rather than vague job titles.
- the person who decides: shutting down a system, choosing analysis or restart, filing a complaint;
- the person or service provider who carries out the technical work and applies the recommendations received;
- the person who speaks to employees, customers and the authorities.
Which contacts should be included in the plan?
An up-to-date contact list is the simplest part of the plan, and the most often neglected. Among common mistakes, Roman Hüssy cites outdated contact details, which slow down alerts.
Our sources make it possible to lay the groundwork:
- the FOCS, reachable via a reporting form or its on-call line, available 24 hours a day;
- the Federal Data Protection and Information Commissioner (FDPIC), in Bern, whose hotline answers Monday to Friday from 10 a.m. to 11:30 a.m., on 058 462 43 95;
- the IT service providers and software suppliers that hold the company's data.
Service providers deserve special attention. At the end of September 2026, an attack on a software supplier made it possible to steal data from the pension fund of the City of Zurich. This data had been transferred to the supplier in preparation for a change of management system. Our analysis: an SME must know who holds its data, and whom to call at each of them.
Why test backups, and not just make them?
A backup only protects if it can be restored in time. According to the 2026 study, nine in ten SMEs make backups, but only a quarter regularly test restoring them.
"It is not enough to back up data. SMEs must regularly test whether they can quickly resume their business after a cyberattack," stresses Anu Anthamatten, project manager at digitalswitzerland.
What is at stake is measured in working time. Among the 44 affected SMEs in the sample, the heavy work of restoring systems is mentioned 16 times, as often as the emotional burden. Financial damage only comes next, with 10 mentions.
Our analysis: the plan can set the frequency of restore tests and the person who carries them out. Our sources give neither a rule on offline backups nor a recommended frequency.
What to do in the first hours after a cyberattack?
The process described by the FOCS starts with contact. The affected company reaches the office via the form or the on-call line. According to Roman Hüssy, Govcert then provides first aid and an initial technical assessment, "like a fire service". The incident is then classified according to its severity.
The recommendations received must be applied in full. Roman Hüssy cites their partial implementation as a common mistake, because it allows attackers to spread.
The case of the online magazine Republik, in 2026, shows the cost of a delay. Unknown parties exploited a vulnerability in Metabase, a data analysis tool. "The security vulnerability had been known since 6 August, but we did not take the necessary countermeasures in time," the magazine acknowledged.
For malware, the FOCS published on 6 October 2026 the measures to take in the event of a suspected infection. Our analysis: the plan benefits from referring to these official pages rather than copying technical instructions that are bound to change.
Which reports should be made after the incident?
Three steps recur in recent Swiss cases, and they are not aimed at the same recipients.
| Step | Who is concerned | What our sources say |
|---|---|---|
| Report to the FOCS | Any company; mandatory for operators of critical infrastructure | Voluntary for an SME; obligation to report without delay since 1 April 2025 for critical infrastructure |
| Notification to the FDPIC | Company whose personal data may have been affected | Republik and the supplier PK Softech reported their incident to the Commissioner |
| Criminal complaint | Company that fell victim to the attack | The pension fund of the City of Zurich filed a criminal complaint |
The FOCS receives voluntary reports from companies and helps them take the necessary steps. For an SME that does not operate critical infrastructure, this report remains optional.
The Commissioner is the supervisory authority for data protection. It ensures that private companies do not process personal data unlawfully. Its questions give an idea of what an SME must be able to document.
A dated example: PK Softech, a software supplier to several pension funds, reported an attack to the Commissioner on 8 October 2026. On 23 October 2026, the Commissioner opened a formal investigation into the company. It wants to establish three points:
- the personal data that the funds had entrusted to the supplier;
- the legal framework for these transfers and how it was applied in practice;
- the extent of the stolen information.
Our analysis: an SME that keeps an inventory of its data and its service providers can answer these questions more quickly. The plan is the right place to keep it.
How to inform customers and staff?
The people affected first want to know what still works. The City of Zurich stated that its fund and the payment of pensions remained operational. The pension fund of Swiss Post specified that the pension assets and pensions were not at risk.
They then want to know which data is at stake. The Swiss Post fund listed the data that may have been affected, such as name, address and social security number. Republik detailed the categories accessed and specified that no credit card data had leaked.
Our analysis: a leak makes scams more credible. Contact details combined with an IBAN number make it possible to write a highly targeted fraudulent email. Warning customers and employees about such messages therefore belongs in the communication set out in the plan.
Timing matters too. In the case of the pension funds, it was up to each fund to inform the people affected once its analysis was complete.
What our sources do not specify
- The legal conditions and the deadline for notifying the FDPIC after a data breach.
- A rule on offline backups or a recommended testing frequency.
- An official response plan template for SMEs, or the exact share of SMEs that have one.
Further resources can be found in the protecting your business section.
