ICT Minimum Standard (Switzerland)
The 108 measures with maturity levels 0–4.
SOLUTIONS · CRITICAL INFRASTRUCTURE
Critical infrastructure resilience, made measurable.
Energy, water, health, transport or telecommunications: operators of critical infrastructure have to prevent outages, detect attacks and respond quickly. Varmo measures maturity against the Confederation’s ICT Minimum Standard and links it with risks, measures and incidents.
WHAT YOU GET
- ICT Minimum Standard with maturity levels 0–4 from Pro
- Download the Confederation’s completed assessment tool
- NIS2 and NIST CSF 2.0 with mappings
- Dependencies on systems and service providers
- Report, handle and follow up security incidents
1. Maturity under the ICT Minimum Standard
Each of the 108 measures receives a maturity level from 0 to 4 with a justification. Varmo suggests it based on your data: implementation and evidence, approved policies, regular controls. The evaluation follows the Confederation’s assessment tool, per category, per function and overall against the target.
- Radar chart per function
- Completed assessment tool as an Excel file
- A task when an assessment is more than 12 months old
2. Dependencies and risks
Critical services depend on systems, sites and service providers. You map these dependencies in the asset structure, and protection requirements are inherited along the chain. The risk analysis evaluates threats such as ransomware or the failure of a service provider, and for every risk it is clear who acts next.
3. Security incidents
Employees report incidents from their phones, too. You record assessment, containment, communication and preservation of evidence in the incident history, and the follow-up closes it. Since 1 April 2025, critical infrastructure operators in Switzerland must report cyberattacks to the Federal Office for Cyber Security (FOCS, formerly NCSC) within 24 hours.
Several frameworks, one implementation
The ICT Minimum Standard is mapped to NIST CSF 2.0, ISO/IEC 27001 and NIST SP 800-53, and NIS2 to NIST CSF 2.0 and ISO/IEC 27001. This shows where one implementation covers several requirements; the coverage view shows the status by CSF function. Important for organisations that also operate in the EU.
Need-to-know and hosting in Switzerland
Responsibility grants access: people see their own objects, and roles are only for overview tasks. The data is stored in Switzerland, and the operator only sees it with your time-limited approval. You can require a second factor for the whole organisation.
Related
NIS2
The obligations of entities in the EU.
Security incidents
Report, handle and follow up incidents.
Assets & protection requirements
Dependencies and protection requirements in detail.
Frequently asked questions
Who counts as critical infrastructure in Switzerland?
Art. 74b ISA lists the authorities and organisations subject to the reporting obligation, for example in energy, water, health, transport, telecommunications and finance. Whether your organisation is one of them must be checked against the Act; Varmo does not replace a legal assessment.
Is the ICT Minimum Standard mandatory?
For most organisations, it is a recommendation of the Confederation. Some industry rules are based on it, and it is regarded as the benchmark for the resilience of critical infrastructure in Switzerland.
Does Varmo report cyberattacks to the FOCS?
No. Reports are made via the FOCS reporting form. In Varmo, you record the incident from the report through to the follow-up, including external communication.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.