Critical infrastructure
Make resilience measurable, with incidents and NIS2.
SWISS FRAMEWORKS · ICT MINIMUM STANDARD
ICT Minimum Standard: maturity instead of a checklist.
The Confederation’s minimum standard for improving ICT resilience is aimed at critical infrastructure operators and any organisation that wants to measure its cyber resilience. Varmo includes it as a framework and rates each measure with a maturity level from 0 to 4.
Platform framework from the Pro plan
Scope
108 measures organised by the Identify, Protect, Detect, Respond and Recover functions of the NIST Cybersecurity Framework, in the Confederation’s wording.
- Wording and priority as published by the Confederation
- 23 categories with their purpose
- Notes on where the implementation is documented in Varmo
Maturity levels 0 to 4
Each measure receives a maturity level with a justification, from 0 (not implemented) to 4 (dynamic, continuously reviewed and improved). The evaluation follows the assessment tool: average per category, per function and overall, compared with a target (default 2.6).
- Radar chart per function
- Measures that are not applicable, with a justification, are not counted
- An assessment is valid for 12 months, after which a task reminds you
A suggestion from your data
Varmo suggests a maturity level for each measure and explains it: based on implementation and evidence, approved policies and documents, regular controls, and improvements and reviews over the last 12 months. You accept the suggestion or rate differently; only what you confirm is saved.
Mappings
The minimum standard is mapped to NIST CSF 2.0 via NIST’s official crosswalk, and to ISO/IEC 27001 Annex A and NIST SP 800-53 via the references in the standard. This shows where one implementation also covers other frameworks. Mappings and coverage are included from the Pro plan.
Maturity for other frameworks, too
From the Pro plan, you can switch on maturity ratings for any framework, such as the NIST CSF or your own requirements.
Related
ICT baseline protection (Switzerland)
The Confederation’s minimum requirements per system.
NIST CSF 2.0
NIST’s Cybersecurity Framework.
Frequently asked questions
How does it differ from ICT baseline protection?
ICT baseline protection (directive Si001) sets mandatory minimum requirements per system for the Federal Administration. The ICT Minimum Standard is a voluntary recommendation and measures the maturity of the whole organisation. Varmo includes both.
Can the result be compared with the assessment tool?
Yes. Varmo calculates like the assessment tool: average per category, per function and overall, excluding measures that are not applicable. You set the target yourself; the default is 2.6.
FREE · ABOUT 5 MINUTES
How far along is your ISMS? Take the ISO 27001 self-assessment.
A traffic light per clause, your next steps and the right plan. No sign-up; your answers stay in your browser.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.