Immediate answer
In a cyber attack, three goals come first: contain the spread, preserve evidence and stabilise operations in a controlled way. Alert the internal emergency organisation, isolate affected systems in line with the incident response plan and immediately start a log of times and decisions. Do not restart systems in an uncoordinated way, do not delete anything and communicate over a secure channel, external if necessary.
The timeline below is an operational sequence, not a general legal deadline. Whether and when the FDPIC, the NCSC, the police, a supervisory authority, the insurer or contractual partners must be informed has to be assessed separately.
The first 15 minutes
- Raise the alarm. Reach the IT leads, management and designated deputies through the channel prepared for this.
- Contain the spread. Disconnect affected devices and network segments; block compromised remote access. Do not reset or reinstall on your own initiative.
- Protect backups. Shield backups that are not yet affected and management access from the attackers.
- Start the log. Record the time of discovery, who reported it, visible symptoms, systems and every action with a timestamp.
- Use secure communication. If email may be compromised, do not coordinate through the same account or chat.
If people, medical care, industrial safety or other critical processes are at risk, the safety and continuity plan prepared for that situation takes precedence over this general guide.
Within 4 hours
Situation picture and evidence
- Narrow down the affected identities, devices, servers, cloud services, sites and data.
- Secure logs, suspicious messages, file names, timestamps and technical indicators.
- If you lack in-house expertise, bring in qualified incident response and forensics specialists.
- Coordinate rebuilding and recovery with forensics or the police where evidence may be relevant.
External help and financial containment
- Check the policy number, emergency hotline, approved providers and consent requirements; report the incident early in line with the policy terms.
- In the case of mistaken transfers or compromised bank access, contact the bank without delay using a known number.
- If a criminal offence is possible, involve the responsible cantonal police. The NCSC recommends reporting attempted cyber incidents as well.
- Switch critical business processes to tested emergency procedures and have every exception approved.
Within 24 hours
- Decide on and document reporting obligations. Assess Article 24 FADP, NCSC reporting scope, sector supervision, contracts and any cross-border elements separately.
- Set the communication. Inform staff, customers and partners only with confirmed facts, clear instructions and a named contact.
- Plan recovery. Close the attack path, secure identities, build clean systems and restore data only from verified backups.
- Record the loss. Document downtime, additional costs, external services and decisions as you go; do not reconstruct costs from memory.
- Schedule the next situation review. Record owners, open questions, risks and release criteria in writing.
Do not confuse the FDPIC and the NCSC
| Assessment | Timing | Key question |
|---|---|---|
| FDPIC, Article 24 FADP | as quickly as possible, if notifiable | Is a data security breach likely to result in a high risk for the persons concerned? |
| NCSC, legal obligation | within 24 hours of discovery | Is the organisation a covered critical infrastructure and is the cyber attack reportable? |
| NCSC, voluntary report | as early as possible | Can the report help assess the threat situation and warn others? |
The general Swiss FADP notification has no blanket 72-hour deadline. Foreign rules may apply in addition for internationally active companies. The guide to reporting obligations explains the details.
Printable one-page emergency plan and incident log
The following section is optimised for A4. Ctrl/⌘ + P prints only the emergency plan. Print it in advance, add names and numbers and keep it outside your production IT.
A4 · fill in offline · review every six months
Cyber emergency plan for the first hour
Organisation: · Version/date: · Owner:
1 · Alert and protect
- □ Emergency lead and IT alerted
- □ Affected systems/segments isolated
- □ Backups and admin access protected
- □ No uncoordinated restart/reset
- □ Secure communication channel activated
2 · Emergency contacts
Emergency lead:
IT/forensics:
Insurer/policy:
Bank/police:
Legal/data protection:
3 · Initial situation picture
| Discovered | Date/time: · by: |
|---|---|
| Symptoms | |
| Affected | Systems/data/sites: |
| Impact | Operations/people/third parties: |
4 · Incident log
| Time | Observation/action | Person | Approval/evidence |
|---|---|---|---|
Time: · Lead:
□ Insurer · □ NCSC · □ FDPIC · □ Police · □ other
What to avoid during an incident
- continuing to use compromised devices to copy data “just quickly”;
- deleting, restarting or resetting systems before evidence preservation and recovery have been agreed;
- coordinating through accounts or devices that are probably compromised;
- publicly asserting unconfirmed causes, perpetrators or data leaks;
- commissioning external services without checking that the immediate measure is necessary and contractually approved;
- mistaking a mere return to availability for a secure recovery.
What role does cyber insurance play?
Depending on the policy, cyber insurance may cover emergency coordination, forensics, legal advice, crisis communication, data recovery, business interruption or liability. Cover is not automatic: triggers, limits, sublimits, deductible, waiting period, security requirements, choice of providers and consent obligations must be checked in the specific contract.
Keep the policy and emergency number available offline. The coverage guide shows which contract points should be clarified before an incident.
Official sources
- NCSC: Incident – what next? Information for companies and authorities
- FDPIC: Data breach guide under Article 24 FADP
- NCSC: Reporting obligation for critical infrastructures
Content reviewed on 18 July 2026. This guide does not replace an incident response plan tailored to your company or individual technical, legal or insurance advice.