Hospitals are critical infrastructure, with cyber-reporting duties and a responsibility that reaches into the board. We cleanly distinguish the Swiss ISG/BACS duty from the EU NIS2 directive and close your gaps with a gap analysis, reporting-process playbooks and an ISMS, legally led and independent.
For hospital leadership, boards, executive management, CFOs, CISOs and cantonal operators
A cyberattack on a hospital hits not just data but operations and patient safety. That is precisely why the legislator treats healthcare provision as critical infrastructure.
In Switzerland, operators of critical infrastructure are subject to a cyber-reporting duty towards the Federal Office for Cybersecurity (BACS), based on the Information Security Act (ISG). Hospitals and parts of healthcare provision can fall within its scope. Serious cyber incidents must be reported to the BACS within a short deadline.
Whether your organisation is concretely subject to the duty, which thresholds apply and within what deadline you must report, needs to be assessed case by case. The detailed deadlines and exact scope are still partly being specified. We clarify this classification cleanly before we set up any process.
We treat the topic as a governance and compliance question: not as a technology purchase, but as the demonstrable organisation of responsibility, processes and escalation paths around an incident.
NIS2 and the Swiss reporting duty are often lumped together. That is risky, because applicability, deadlines and obligations differ. We separate the two regimes cleanly.
NIS2 is an EU directive. Switzerland has not adopted it. NIS2 can therefore only directly bind entities that have an establishment or operations within the EU, for example a Swiss hospital group with sites or subsidiaries in an EU member state. For a hospital operating purely in Switzerland, NIS2 itself imposes no direct obligation.
Hospitals operating purely in Switzerland are instead subject to the Swiss cyber-reporting duty under the ISG, enforced by the BACS. This is a self-standing regime with its own thresholds and deadlines and must not be confused or merged with NIS2.
For organisations with a foot in the EU, both regimes can apply side by side. We build you a clear applicability map: which entity falls under which regime, with which deadline and which reporting channel, so that nobody is looking for the wrong authority during an incident.
Orientation, not legal advice. We verify scope, thresholds and deadlines case by case. Details are still partly being specified.
| Regime | What it requires | Who it binds | Status |
|---|---|---|---|
| Switzerland: ISG / BACS reporting duty | Reporting serious cyber incidents to the BACS within a short deadline; operators of critical infrastructure | Swiss operators of critical infrastructure (assess hospital case by case) | in force (verify detailed deadlines) |
| EU: NIS2 directive | Risk management, reporting duties and management responsibility for essential and important entities | only entities with an EU establishment or operations (not for purely Swiss organisations) | EU law, not adopted by Switzerland |
| Revised FADP (data protection) | Separate notification of data-security breaches to the FDPIC, its own logic alongside the cyber-reporting duty | all controllers in Switzerland processing personal data | in force since 1 Sep 2023 |
In a hospital, cybersecurity is a leadership matter. Responsibility cannot be delegated to IT, but it can be organised and evidenced cleanly.
Cyber risks belong to the non-delegable duties of care of top leadership. We make oversight manageable: clear roles, reporting lines and a documented risk picture that the board can genuinely understand and own.
With our vCISO, your organisation gains accountable security leadership that steers strategy, risk acceptance and reporting to executive management, without you having to build a costly full-time role.
An ISMS aligned with ISO 27001 anchors risk management, controls and incident handling in an auditable system. That is exactly the structure that reporting-duty regimes and supervisory bodies want to see.
Where a SIDD lawyer advises in a legal capacity, your information may be covered by professional secrecy under Art. 321 of the Swiss Criminal Code, in addition to contractual confidentiality. We clarify the exact scope per mandate, especially for sensitive incident information.
We advise in German, French and English, relevant for French-speaking Switzerland and for organisations with EU parent companies where NIS2 and ISG/BACS must be steered side by side. Because we do not sell an in-house SOC, our recommendations stay independent.
We maintain the risk picture, controls and reporting processes in a structured way, on request in our Swiss Priverion Platform. In case of a regulator request, the evidence is available as maintained tooling instead of scattered across emails.
Our mandate is readiness and assessment, preparing responsibility, processes and evidence. Explicitly not a managed-SOC or 24/7 monitoring service.
We prepare the organisational interfaces and escalation paths so that your organisation can act quickly and correctly during an incident. The actual operation of monitoring and the technical incident handling we coordinate with your specialised providers. We do not replace them.
Critical-infrastructure/NIS2 24h readiness check
Fixed fee
The fast entry: are you subject to the reporting duty, and could you report on time and via the right channel today?
Reporting-process & playbook package
on request
From the gap to a working process: documented reporting workflows and prepared escalation paths.
vCISO & ISMS governance
on request
Ongoing security leadership: ISMS build-up aligned with ISO 27001 and continuous responsibility via our vCISO.
These topics interlock in a hospital:
Certification-ready ISMS tailored to healthcare data flows.
Tabletop exercises, playbooks and governance, before the incident.
External data-protection advisor for hospitals, FDPIC breach notification included.
All compliance and security topics for healthcare at a glance.
Our tool: LexCommand
LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the Priverion Platform.
The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.
Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.
LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.
We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.
For your applicability map and the reporting-process playbooks, concretely: LexCommand keeps the Swiss ISG/BACS duty and the EU NIS2 directive in separate jurisdictions and sets the obligations side by side with sources, so that every deadline and reporting channel traces back to a retrievable primary source.
Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.
NIS2 is an EU directive that Switzerland has not adopted. It directly binds only entities with an establishment or operations in the EU. A hospital operating purely in Switzerland is instead subject to the Swiss cyber-reporting duty under the ISG, enforced by the BACS. Organisations with EU sites or subsidiaries can fall under both regimes. We assess this concretely for your structure.
The Swiss cyber-reporting duty requires reporting serious incidents to the BACS within a short deadline. The exact thresholds and detailed deadlines must be assessed case by case, as they are still partly being specified. That is precisely why we prepare your reporting process so that you can act on time and via the right channel.
No. We do not operate an in-house SOC and do not offer ongoing monitoring or technical incident handling. Our mandate is readiness and governance: we prepare responsibility, processes, interfaces and escalation paths and coordinate with your specialised IR providers, insurers and authorities. This keeps our advice independent.
Cyber risks belong to the duties of care of top leadership and cannot be delegated to IT. We prepare the risk picture in board-ready form, clarify roles and reporting lines, and give the board a documented basis on which to exercise and own its oversight.
With the fixed-fee critical-infrastructure/NIS2 24h readiness check. It clarifies whether and under which regime you are subject to the reporting duty, checks your reporting capability and delivers a prioritised gap list with a board-ready report. After that you decide on playbooks, ISMS and an ongoing vCISO mandate.
Start with the critical-infrastructure/NIS2 24h readiness check: classification ISG/BACS vs. NIS2, a check of your reporting capability and a prioritised gap list, with a board-ready report.