GovCERT.ch

GovCERT.ch
Name	GovCERT.ch
Native name	Swiss Government Computer Emergency Response Team
Formation	2015
Headquarters	Bern
Jurisdiction	Swiss Confederation
Parent organization	Federal Office for Cybersecurity

GovCERT.ch

GovCERT.ch is the Swiss government computer emergency response team charged with cybersecurity incident handling, situational awareness, and coordination for Swiss federal entities. It operates within the Swiss federal administration's security architecture alongside national and international actors, providing incident response, threat intelligence, and advisory services to protect critical infrastructure and public administration IT systems. The unit engages with regional authorities, private sector operators, and multilateral organizations to mitigate cyberthreats affecting the Swiss state and its partners.

Overview

GovCERT.ch functions as a national point of contact for handling computer security incidents affecting the Swiss Confederation, linking operational incident handling with strategic policymaking in the Federal Office for Cybersecurity. Its remit covers incident detection, analysis, reporting, vulnerability handling, and information sharing across federal agencies such as the Federal Department of Defence, Civil Protection and Sport, the Federal Department of Finance, and cantonal institutions. GovCERT.ch contributes to national cyber resilience initiatives coordinated with international bodies including the European Union Agency for Cybersecurity, the North Atlantic Treaty Organization, and the Organization for Security and Co-operation in Europe. The service interacts with sectoral computer emergency response teams like CERT-CH, national CERTs such as the Computer Emergency Response Team of Ukraine, and industry partners including telecommunications operators, cloud providers, and energy utilities.

History

The creation of GovCERT.ch followed shifts in Swiss cybersecurity strategy that responded to incidents, legal reforms, and international cyber diplomacy. Its establishment built on earlier Swiss efforts involving the Federal Office for Information Technology, System and Telecommunication and lessons from incidents seen by national institutions during the 2000s and 2010s, influenced by events like the NotPetya campaign and high-profile compromises affecting states and corporations. GovCERT.ch evolved alongside initiatives such as the National Cybersecurity Strategy, cantonal emergency planning, and multiyear programs with partners including the World Economic Forum and the International Telecommunication Union. Over time it has adapted to technological changes exemplified by cloud migration led by firms such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform, and has engaged with research from institutions like the Swiss Federal Institute of Technology in Zurich, the University of Geneva, and private cybersecurity firms such as Kaspersky Lab, CrowdStrike, and Palo Alto Networks.

Organization and Governance

GovCERT.ch is situated administratively under the Federal Office for Cybersecurity within the Federal Department of Justice and Police, subject to oversight from the Federal Council and coordination with the Federal Chancellery. Its governance framework references Swiss federal law and interdepartmental agreements involving the Federal Office of Police, the Federal Department of Defence, Civil Protection and Sport, and the State Secretariat for Migration where relevant. Operational governance includes liaison with cantonal police services, the Swiss Armed Forces' information infrastructure units, and civilian agencies like the Federal Office of Public Health and the Swiss Federal Railways. Leadership comprises cybersecurity professionals with backgrounds in institutions such as the Federal Intelligence Service, the European Central Bank cybersecurity teams, and private sector boards including CISOs from UBS, Credit Suisse, and Swisscom.

Responsibilities and Services

GovCERT.ch provides incident coordination, malware analysis, forensic support, early warning, and dissemination of security advisories to federal organs, critical infrastructure operators, and partner organizations. It maintains situational awareness through sensors, threat feeds, and collaboration with international platforms such as the Computer Security Incident Response Team community, the NATO Cooperative Cyber Defence Centre of Excellence, and INTERPOL. Services include digital forensics, vulnerability coordination, vulnerability disclosure handling similar to protocols used by the Open Web Application Security Project, and secure communication channels for crisis coordination akin to those used in major incident response exercises like Cyber Storm. It issues technical alerts, best-practice guides, and participates in capacity-building alongside universities, standards bodies like ISO, and industry alliances including the Forum of Incident Response and Security Teams.

Incidents and Response Activities

GovCERT.ch has responded to a range of incidents including ransomware outbreaks, targeted intrusions, supply-chain compromises, and distributed denial-of-service attacks affecting public-sector services and critical infrastructure. Response activities have involved coordination with prosecutors from the Office of the Attorney General, evidence handling for judicial processes parallel to cases in the European Court of Human Rights, and cross-border collaboration with agencies such as the Bundeskriminalamt, the French National Cybersecurity Agency, and the US Cybersecurity and Infrastructure Security Agency. Operational responses draw on forensic methods developed in research at institutions like ETH Zurich, incident playbooks used by major technology firms, and lessons from incidents involving malware families described by security vendors and CERTs worldwide.

Cooperation and Partnerships

International cooperation is central to GovCERT.ch's mission, including bilateral and multilateral engagement with the European Union, NATO partners, the United Nations initiatives, and regional CERT networks. It partners with academic institutions such as the University of Zurich, École polytechnique fédérale de Lausanne, and with think tanks including the Swiss Federal Institute of Technology research centers, as well as industry consortia like the Cloud Security Alliance and the Financial Services Information Sharing and Analysis Center. Collaboration extends to telecommunications companies, electricity grid operators, transport firms such as Swiss Federal Railways, and healthcare institutions where it liaises with hospital IT teams and public health agencies. GovCERT.ch also participates in exercises with NATO's Cooperative Cyber Defence Centre of Excellence, the European Union Agency for Law Enforcement Cooperation, and multinational incident response drills organized by the International Telecommunication Union.

Legal Framework and Policy Context

GovCERT.ch operates within Swiss legal instruments including statutes overseen by the Federal Assembly, cantonal emergency legislation, and regulations pertaining to information security and data protection enforced by the Federal Data Protection and Information Commissioner. Its activities intersect with legal domains addressed by the Federal Act on Data Protection, intelligence oversight mechanisms associated with the Federal Intelligence Service, and international obligations arising from treaties and agreements signed by Switzerland. Policy context includes the Swiss National Cybersecurity Strategy, directives from the Federal Council, and compliance requirements applicable to financial institutions regulated by the Swiss Financial Market Supervisory Authority and to critical infrastructure operators under sector-specific legislation.

Category:Computer security organizations Category:Organizations based in Bern Category:Information technology in Switzerland Category:Government agencies established in 2015