The ICT Minimum Standard for SMEs – explained
The federal ICT Minimum Standard was written for operators of critical infrastructure, but it is explicitly applicable to any organisation. For SMEs it is a good framework: concrete, freely available and without the overhead of a full management system. This is how it is built, and how to get started.
What it is about
The “Minimum standard for improving ICT resilience” was developed by the Federal Office for National Economic Supply (FONES) together with external experts; since March 2024 the BACS has been responsible for it. The current version dates from May 2023 and takes ISO/IEC 27001:2022 into account, among others.
The standard explicitly does not see itself as a competitor to international standards but as a compatible, leaner way in. “ICT resilience” means that an organisation should not only fend off attacks and disruptions but also detect them, respond to them and recover from them. That is exactly what the five functions represent.
Structure: 5 functions, 23 categories, 108 measures
- Identify29inventory, risks, governance, suppliers
- Protect39access, training, data, maintenance
- Detect18anomalies, monitoring
- Respond16response plan, communication, analysis
- Recover6recovery plan, improvements
Each measure has an identifier made up of function, category and number. “PR.AC-1”, for example, is the first measure in the Access Control category (AC) of the Protect function (PR). The 23 categories:
| Function | Categories |
|---|---|
| Identify (ID) | Asset Management, Business Environment, Governance, Risk Assessment, Risk Management Strategy, Supply Chain Risk Management |
| Protect (PR) | Access Control, Awareness and Training, Data Security, Information Protection Processes and Procedures, Maintenance, Protective Technology |
| Detect (DE) | Anomalies and Events, Security Continuous Monitoring, Detection Processes |
| Respond (RS) | Response Planning, Communications, Analysis, Mitigation, Improvements |
| Recover (RC) | Recovery Planning, Improvements, Communications |
Rating: 0 to 4 and your own target
The standard rates each measure on a scale from 0 to 4 (our translation of the German original):
| Value | Meaning |
|---|---|
| 0 | Not implemented |
| 1 | Partially implemented, not fully defined and approved |
| 2 | Partially implemented, fully defined and approved |
| 3 | Implemented, fully or largely, static |
| 4 | Dynamic, implemented, continuously reviewed and improved |
The values result in averages per function and an overall picture that the standard places in four tier levels from “partial” to “adaptive”. Important: the example values in the standard are explicitly not targets. Every organisation defines its own risk appetite and derives the protection level per category from it. For an SME with few systems a different target may be right than for an energy utility.
The standard comes with an assessment tool as an Excel file. For a one-off baseline this is enough. As soon as several people contribute, evidence has to be collected and results are to be compared over the years, a spreadsheet reaches its limits.
A pragmatic start: five steps for SMEs
- Assign responsibility. One person coordinates; management carries the responsibility and releases resources. In small companies this is often the same person – what matters is that someone explicitly takes it on.
- Build an inventory. Which devices, systems, cloud services and data exist, and which of them are critical for the business? Without an inventory every further assessment is uncertain. This is category ID.AM.
- Assess honestly. Go through all measures and rate the current state – not the planned one. Briefly note what each rating is based on.
- Rank gaps by risk. Not everything at once. Start where an outage or data loss would do the most damage. In many SMEs these are basics such as access rights and multi-factor sign-in, updates, tested backups and a simple incident plan.
- Plan and repeat. Every gap gets an owner and a deadline. After one year at the latest you assess again and see what has improved.
Common pitfalls
- Rating too high the first time. “We have that” does not yet mean “it is documented and reviewed”. Rate what you can prove.
- Technology only. The Identify, Respond and Recover functions are largely organisational. That is exactly where first assessments often reveal gaps.
- Forgetting the IT service provider. Many SMEs have outsourced their IT. The responsibility still remains with the company. Ask your provider for evidence.
- Once and never again. The benefit only comes with repetition. Schedule the next assessment straight away.
Frequently asked questions
Is the ICT Minimum Standard mandatory for SMEs?
For most companies, no. It is a recommendation. According to the BACS it is currently mandatory in the sector standards for electricity and gas supply. Customers or clients can, however, require it by contract.
Can you be certified against the ICT Minimum Standard?
The standard does not provide for certification as ISO/IEC 27001 does. It describes a self-assessment that an external firm can also review. If you need a certificate, choose ISO/IEC 27001 – work on the ICT Minimum Standard is a good basis for it.
Do all 108 measures have to be implemented?
You should assess all of them so the picture is complete. Which level you aim for per category is your decision, based on your risk. Record measures that do not apply to you together with a reason.
With the SEC Swiss Edition
For SMEs that want to implement exactly this standard there is the SEC Swiss Edition: Audhive in security audit mode with the catalogue fixed to the ICT Minimum Standard 2023 – as a cloud subscription or an annual licence for your own server. It contains all 108 controls with objective, expected documentation and guidance, assessment with maturity levels, data requests for evidence and the report as PDF. The standard itself remains unchanged: Audhive ships the measures in the official wording in German, English, French and Italian (obvious errors corrected and marked), plus its own working aids; the federal original is authoritative (origin of the catalogue). Prices under SEC Swiss Edition. How Audhive’s six-level rating scale works is explained in Understanding maturity levels.
Sources
- Federal Office for Cybersecurity (BACS): ICT minimum standards (page in German) – “Minimalstandard zur Verbesserung der IKT-Resilienz”, version May 2023, and assessment tool
- NIST: Cybersecurity Framework