The minimum standard for information and communication technology (ICT) is the Swiss Confederation's cybersecurity framework. Developed by the Federal Office for National Economic Supply (FONES), it has been the responsibility of the Federal Office for Cyber Security (NCSC) since March 2024. Mandatory for electricity and gas, it is recommended to other organisations, SMEs included.
For a small or medium-sized enterprise (SME), it serves above all as a checklist. The NCSC presents it as a “checklist for basic technical security”. It thus extends the steps of SME cybersecurity with a more structured framework.
This page explains where the standard comes from, what it contains and how an SME can use it. It distinguishes between facts published by the Confederation, statements by experts and our own analysis.
What is the ICT minimum standard?
The ICT minimum standard is an IT security framework designed to protect critical infrastructure from cyber risks. It targets vital sectors such as electricity, water supply, public transport and food.
Its starting point is a principle set out by the NCSC. Every company or organisation must first protect itself. But when critical infrastructure is at stake, the state must ensure that it functions properly.
This duty derives from the National Economic Supply Act of 17 June 2016 (NESA; SR 531). According to the NCSC, the standard reflects the state's determination to protect the population, the economy, institutions and administrations.
Who published the ICT minimum standard, and who manages it today?
The standard originated at FONES. This office developed preventive measures to strengthen the resilience of critical IT infrastructure. It then broke the general standard down into standards specific to each sector.
Responsibilities changed with the creation of the NCSC, the Confederation's centre of competence for cybersecurity. Since March 2024, the NCSC has been responsible for the ICT minimum standard.
To develop the sector-specific standards, the NCSC works with the industry associations of the critical sectors concerned. The industries thus take part in adapting the framework.
For whom is the standard mandatory?
The standard is a recommendation for all operators of critical infrastructure. It is binding for only two sectors:
- electricity, since 1 July 2024;
- gas, since 1 July 2025.
For other companies, it remains optional. The NCSC points out that it also helps them improve their own IT resilience. A service SME, a shop or a craftsman can therefore use it freely, with no obligation to comply.
What does the framework actually contain?
The framework consists of several documents published by the NCSC. The official page offers three types:
- the reference document “ICT - Minimum Standards - 2023”, as a PDF, posted online on 20 December 2024;
- a self-assessment tool in Excel format (revision 5), published on 2 June 2023;
- sector-specific minimum standards.
The sector-specific standards cover several areas. These are water supply, wastewater, food supply and gas supply. They also include public transport, electricity, waste disposal, district heating and cooling, and digital cultural assets.
Our analysis: the self-assessment tool is the most practical entry point for an SME. It lets the company measure where it stands before deciding what to improve.
How can an SME apply the ICT minimum standard?
An SME can start from the technical measures that the NCSC links to the ICT minimum standard. On its page dedicated to basic protection, the office lists six:
- take stock of the ICT environment, that is, know which devices, software and services the company uses;
- back up data;
- install security updates;
- use antivirus software and firewalls;
- secure remote access;
- segment networks, so that an intrusion does not spread to the whole system.
Technology is not enough, the NCSC insists. Organisational measures must complement it. The office notably cites staff awareness training, multi-factor authentication and clear responsibilities for the cloud and outsourced IT.
The NCSC makes it a management task, not simply a job for the IT department. Management decides where to invest to protect critical processes. When a measure is expensive, the office recommends weighing its cost against the risk of doing nothing.
To go further, the protecting your company section brings together our practical pages on the subject.
Key figures
- March 2024: the NCSC takes over responsibility for the ICT minimum standard.
- 1 July 2024: the standard becomes binding for the electricity sector.
- 1 July 2025: it becomes binding for the gas sector.
- More than 80% of Swiss SMEs carry out their software updates, according to the “SME Cybersecurity 2026” study.
- Only one SME in four checks that it can restore its backups, according to the same study.
Where do Swiss SMEs stand with regard to this framework?
The “SME Cybersecurity 2026” study, conducted by la Mobilière with several partners, provides an overview. The NCSC relayed its results on 22 October 2026.
On the technical side, SMEs are doing rather well. More than 80% install software updates and nine out of ten back up their data. Multi-factor authentication is part of everyday life for many companies.
The gap is organisational. Only about a third regularly train their staff or take inventory of their IT systems. Only one SME in four checks that it can actually restore its data in an emergency.
Our analysis: the inventory of systems is precisely the first technical measure linked to the ICT minimum standard. This is where an SME has the most room for improvement.
The stakes remain concrete. “Over the past three years, some 35,000 Swiss SMEs have suffered a cyberattack,” says Jesús Pampín, head of la Mobilière's Cyber Risk competence centre.
A dated example: what does the PHP flaw of 21 October 2026 show?
On Wednesday 21 October 2026, two critical flaws were reported in PHP, a programming language used by a great many websites. The NCSC recommended updating the affected systems immediately.
These flaws made it possible to take control of a website without a password, according to PME magazine. Attackers could also steal data or install malware. Details had leaked before the patch was available.
Several Swiss hosting providers then cut off access to their customers' websites. At Cyon, in Basel, more than 100,000 websites went offline. Customers of the St. Gallen software company Bexio, mostly SMEs, suffered an outage of several hours, according to the portal “Inside Paradeplatz”.
Our analysis: the episode illustrates two measures on the NCSC's list. You need to know which websites and tools rely on PHP, which requires an inventory. And you need to be able to install a patch quickly.
How much can a flaw cost an SME?
The cost depends on what was planned. “In the best case, companies only bear the costs of an emergency update and minor software updates,” Nicolas Mayencourt, founder and CEO of the Bern-based company Dreamlab Technologies, told Blick, as quoted by PME magazine.
A website offline for hours or days leads to lost revenue. An online shop no longer records orders and a service provider can lose bookings.
The worst-case scenario is blackmail after an intrusion. “That quickly runs into millions,” warns Nicolas Mayencourt. According to him, there have already been bankruptcies in Switzerland caused by ransomware attacks.
The expert also points out that the fundamental measures “are generally not even particularly expensive”. He cites up-to-date software, regular backups stored offline and two-factor authentication for sensitive systems. These precautions prevent attackers from spreading freely through the network.
Our analysis: this advice largely overlaps with the measures the NCSC associates with the ICT minimum standard. The framework does not prevent every attack, but it limits the damage when a flaw occurs.
What our sources do not specify
The NCSC's web pages do not detail the internal structure of the reference document. Its full content is in the PDF “ICT - Minimum Standards - 2023”, which we did not analyse for this page.
Nor do our sources give a typical budget for an SME. They also do not specify the time needed to fill in the self-assessment tool.
