The Federal Council has instructed the Federal Department of Defence, Civil Protection and Sport (DDPS) to draft a standalone Federal Act on Cybersecurity, with a consultation draft due by June 2027 S1. The new law will consolidate three separate parliamentary motions into a single statute rather than amending existing legislation piecemeal, marking the first formal signal of structural change to Switzerland's cybersecurity governance framework. For Swiss financial institutions and critical infrastructure operators, this is a leading indicator of compliance shifts that will unfold across 2027 and 2028, well before any provision becomes binding.
Why a Standalone Act, Not Amendments
The decision to draft entirely new legislation rather than modify existing laws is itself a notable signal S1. Switzerland's current cybersecurity obligations are scattered across FINMA circulars, the Information Security Act (ISA), and the Federal Act on Data Protection (FADP), each with different scopes, reporting triggers and enforcement mechanisms. A standalone Act suggests the Federal Council wants a unified statutory foundation rather than continued incremental patching of sector-specific rules, and that choice alone raises the stakes for how existing frameworks will eventually be reconciled or absorbed.
This matters for compliance teams because a single consolidating statute changes how overlapping obligations are interpreted. Where today a regulated entity might reconcile FINMA circular language against FADP breach-notification duties separately, a Federal Cybersecurity Act could impose a baseline set of requirements that existing sectoral rules must sit beneath or defer to. Understanding which three parliamentary motions are being folded into the draft will be essential once the consultation text is published, since the substance of those motions is the clearest early indicator of the Act's eventual scope. Institutions that have historically treated FINMA, ISA and FADP compliance as three separate workstreams should begin asking whether that separation will survive a consolidating statute.
What Swiss CISOs Should Watch For
Swiss financial entities should treat the June 2027 consultation draft as the first concrete opportunity to assess how the Act will interact with sector-specific frameworks they already operate under S1. The Federal Council's stated intent is to strengthen national cybersecurity governance, which implies the Act is likely to touch incident reporting, minimum security baselines, and possibly supervisory powers that extend beyond what FINMA circulars or ISA reporting duties currently cover. Governance, risk and compliance functions should not assume the new Act will simply mirror current sectoral practice.
Because the draft is still nine months away, compliance officers have a genuine window to engage before obligations are fixed in statute. Swiss financial-sector trade bodies and individual institutions can use the consultation period that follows the June 2027 draft to flag conflicts with existing FINMA and ISA requirements, request transition periods, or seek clarity on overlapping reporting channels. Entities that wait until the Act is finalised in parliament will have far less influence over how it is scoped, and will face a compressed implementation timeline once the statute is passed.
Timeline Pressure and the Parliamentary Path Ahead
A June 2027 consultation draft implies the substantive parliamentary debate, amendment process, and eventual passage will play out across 2027 and 2028 S1. That sequencing gives Swiss enterprises a multi-year runway, but it also means governance teams need to start tracking the dossier now rather than waiting for a near-final text. Legislative drafting in Switzerland regularly shifts scope during consultation and parliamentary review, so early visibility into the motions being consolidated is more valuable than waiting for a stable draft. Boards and audit committees should expect this dossier to surface in regulatory risk reporting well ahead of any binding deadline.
For CISOs at banks, insurers and critical infrastructure operators, the practical task today is mapping current FINMA, ISA and FADP obligations against the Federal Council's stated intent to strengthen national governance, so that gaps and redundancies are already identified when the consultation draft lands. Programs built on this mapping will be far better positioned to respond to formal consultation feedback requests and to anticipate which existing circulars or reporting frameworks are candidates for consolidation or replacement. This preparatory discipline costs little now and pays off disproportionately once the statutory text narrows the range of plausible outcomes.
◆ Key Takeaway
Start mapping existing FINMA, ISA and FADP cybersecurity obligations now, so your organisation can respond quickly and substantively when the DDPS consultation draft appears in June 2027.
- Assign a compliance owner to track the DDPS drafting process and the three consolidated parliamentary motions ahead of the June 2027 consultation release.
- Map current FINMA circular, ISA and FADP cybersecurity obligations to identify overlaps the new Act may consolidate or supersede.
- Prepare internal briefing materials now so legal and risk teams can respond rapidly once the consultation draft text is public.
- Engage industry associations early to help shape consultation feedback on sector-specific reporting and governance requirements.
- Avoid locking long-term compliance architecture decisions to current FINMA or ISA frameworks that may be restructured by the new Act.
- Monitor parliamentary committee activity through 2027 and 2028 as the Act moves from consultation draft to passage.
- Budget for a transition period in 2027-2028 planning cycles, since statutory requirements may shift before the Act is finalised.
Positioning Swiss Compliance Programs for Structural Change
The Federal Council's mandate to DDPS is not yet law, and the specifics of what the Act will require remain undefined until the June 2027 consultation draft is published S1. But the decision to consolidate three parliamentary motions into one standalone statute, rather than continue amending sectoral rules, is itself the clearest signal yet that Swiss cybersecurity governance is heading toward a unified statutory model. Financial-sector readers should treat this as a governance planning input, not merely a legal-affairs footnote.
Swiss financial-sector compliance officers who begin tracking this dossier now, rather than when the draft text appears, will be better positioned to influence scope during consultation and to adapt existing FINMA, ISA and FADP-aligned programs with minimal disruption. The nine months before the June 2027 draft are the critical preparation window; how enterprises use that time will shape how smoothly they absorb whatever statutory obligations ultimately emerge from Switzerland's first dedicated Federal Cybersecurity Act.