NIS2 and Switzerland: Affected Without Being a Member

Switzerland is not an EU member, so NIS2 does not apply here. That is the simple answer. In practice it is wrong, or at least incomplete: the directive reaches Swiss companies via detours, and more reliably than many would like.

In short: NIS2 is EU Directive 2022/2555 on network and information security. It obliges companies in 18 sectors to implement concrete security measures and reporting duties. Swiss companies are not legally covered, but they are drawn in through EU subsidiaries, services in the EU and, above all, through the contracts of their EU customers.

Briefly: what NIS2 actually is

NIS2 is the second EU directive on network and information security, in force since January 2023; member states had to transpose it into national law by 17 October 2024. It covers “essential” and “important” entities in 18 sectors, roughly from 50 employees or 10 million euros in revenue. It demands risk-management measures (Art. 21), reporting obligations and personal accountability of management bodies: executive boards must approve the measures, oversee them and undergo training.

The reporting obligation has three stages: an early warning within 24 hours, a full notification within 72 hours and a final report after one month. The fines are painful: up to 10 million euros or 2 percent of global revenue for essential entities, up to 7 million or 1.4 percent for important ones.

Who is affected: the 18 sectors

Annex I of the directive lists the sectors of high criticality, Annex II the “other critical” sectors. Together:

• High criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, management of ICT services (B2B), public administration, space.
• Other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, machinery, vehicles), providers of digital services (marketplaces, search engines, social networks), research.

For Swiss suppliers the second group is the more relevant one: whoever manufactures components for a German machine builder, provides IT services to an Austrian hospital or delivers packaging to a food group is supplying a NIS2 entity and gets its obligations passed on by contract.

The ten minimum measures under Art. 21

The directive does not prescribe products, but ten areas that every affected entity must cover “in line with the state of the art”. Exactly this list resurfaces later in the supplier questionnaires:

1. Risk analysis and security policies for information systems
2. Handling of security incidents (incident response)
3. Business continuity: backup, recovery, crisis management
4. Supply chain security, including direct suppliers
5. Security in acquisition, development and maintenance, with vulnerability management
6. Procedures to assess the effectiveness of the measures
7. Cyber hygiene and staff training
8. Cryptography and, where appropriate, encryption
9. Human resources security, access control and asset management
10. Multi-factor authentication and secured communication

Compare these ten points with ISO 27001 and you will find almost all of them again. The standard is the simplest way to demonstrably meet NIS2 requirements. What that path looks like for a Swiss SME is described in ISO 27001 for Swiss SMEs.

Three ways NIS2 reaches Switzerland

1. Subsidiaries in the EU. If you operate an establishment in a member state, you fall under its national implementation law there, directly, no detour. The Swiss parent then effectively supplies the requirements so the subsidiary is compliant.

2. Services in the EU. If you provide digital services in the EU (cloud, managed services, DNS) you can fall within scope regardless of where your company is based, and may even have to appoint an EU representative.

3. The supply chain. The most common case: NIS2 obliges regulated companies to manage the security of their supply chain. They do that with the instrument they have: contracts. Swiss suppliers receive questionnaires, audit rights and security annexes to the framework agreement. You can ignore that, but you will foreseeably lose business.

Direct, semi-direct, contractual: in the end the requirement lands in the same inbox at the Swiss company.

What a supplier questionnaire asks

The questionnaires that have been arriving at Swiss suppliers since 2024 look very much alike. Typical blocks:

• Organisation: Is there a person responsible for information security? A security policy signed by management? A certification (ISO 27001, TISAX)?
• Technology: MFA for all remote access? Encrypted backups, tested regularly? Patch deadlines for critical vulnerabilities? EDR on all endpoints?
• Incidents: How quickly do you inform us about an incident that affects our data? Is there an incident response plan?
• Your suppliers: How do you vet your own suppliers and cloud services?

The last point is the uncomfortable one: the obligation travels further down the chain. Whoever answers the questionnaire will soon have to send it out themselves.

And Switzerland itself?

In parallel, Switzerland has caught up: the revised Information Security Act (ISG) has been in force since 2024, and since 1 April 2025 operators of critical infrastructure must report cyberattacks within 24 hours to the Federal Office for Cybersecurity (BACS). That is narrower in scope than NIS2, but points in the same direction: cybersecurity is moving from state of the art to legal obligation. How such an attack typically unfolds, and where it can be stopped, is shown in Anatomy of an attack.

Add to that the revised Data Protection Act (nDSG), which since 1 September 2023 demands “appropriate technical and organisational measures” and makes data security breaches reportable. Whoever can answer NIS2 questionnaires honestly has usually met the nDSG requirements as well, since the measures overlap to a large extent.

NIS2 and ISG compared

If you have to serve both, as a supplier to an EU customer and as an operator of critical infrastructure in Switzerland, you should know the differences:

	NIS2 (EU)	ISG reporting duty (CH)
Who	18 sectors, from approx. 50 staff	Operators of critical infrastructure
First report	24 hours (early warning)	24 hours to the BACS
Follow-up reports	72 hours, final report after 1 month	Supplement within 14 days
Catalogue of measures	Ten areas under Art. 21	No exhaustive list
Sanctions	Up to 10 million euros or 2 % of revenue	Fines for breach of the reporting duty

The catalogue under Art. 21 is the more demanding part: the Swiss reporting duty says that you must report, NIS2 additionally says what you must have implemented beforehand.

Three misconceptions I often hear

• “We are under 50 employees, so we are out.” The threshold applies to the regulated entity, not to its suppliers. A ten-person business that supplies a NIS2 customer gets the same questionnaire as a corporation.
• “Our IT provider takes care of that.” Responsibility cannot be outsourced, only implementation. The questionnaire carries your name, not the provider’s.
• “A certificate solves this.” ISO 27001 helps enormously, but the scope has to be right: a certificate for the Zurich site says nothing about production in Poland.

What I recommend to companies

The first step costs nothing: clarify whether you are affected. Do I have EU subsidiaries? Do I provide services in the EU? Do I supply regulated companies? If you answer yes to any of these, the second step is a gap assessment, sensibly against ISO 27001, since its measures largely cover the NIS2 requirements and are equally recognisable to Swiss customers. The measures and evidence do not have to live in Excel: CISO Assistant already ships ISO 27001 and NIS2 as frameworks. The third step is uncomfortable but honest: read the contractual security annexes from your EU customers before you sign them. And what all of this may cost is the next question, and the security budget check gives a range for Swiss companies in two minutes.

For Swiss companies, NIS2 is not distant EU bureaucracy. It is the template for what customers will now demand contractually, and whoever has the basics in order answers the questionnaires in hours instead of weeks.