"How fit are Swiss companies in terms of ICT security - and what can they expect?"

Information and communication technologies (ICT) have long been the backbone of modern companies - especially in critical infrastructures. But how well are Swiss companies positioned in terms of cyber security? Which sectors are under particular pressure? And how can the path to a minimum ICT standard be achieved in practice?

We spoke to Michael Gempp, ICT security expert at CTE. He helps companies set up robust OT and IT infrastructures and knows the challenges first-hand.

What exactly does the ICT minimum standard cover - and why is it so important for companies?

The ICT minimum standard defines the basic requirements for information and communication technology - i.e. IT and OT - for organizations with increased protection requirements. The aim is to achieve a uniform minimum level of cyber security. This is particularly essential for operators of critical infrastructures, as an incident can have far-reaching consequences. But other sectors will also benefit: The standard is a pragmatic guideline for systematically improving your own security situation.

How do you go about reviewing a company's ICT security situation?

We start with a structured inventory - both technically and organizationally. We look at existing systems, processes, interfaces and responsibilities. With a structural analysis, we evaluate the current status in comparison to the requirements of the ICT minimum standard. From this, we derive specific measures - prioritized, practical and tailored to the company.

Which sectors are particularly affected or under particular pressure?

Especially companies with a high dependency on automated processes or networked control systems - i.e. energy suppliers, transport companies, waterworks, healthcare institutions or the manufacturing industry. In these areas, it is not only availability that is critical, but also the integrity and traceability of the systems. Regulations such as CySec-Rail or industry-specific requirements also increase the pressure to act.

Where are the most common security gaps - and why do they often go unnoticed?

Many vulnerabilities have their origins in a lack of organization: a lack of responsibilities, unclear processes, insufficiently documented systems. This has an impact on the technical conditions and allows security gaps that are then exploited. In OT, security is too often seen as a purely technical issue, but there is a lack of comprehensive security management. And because nothing "visibly" happens in everyday life, people underestimate how vulnerable they actually are.