Which security framework fits whom?
There is no single right framework. Which one fits depends on three questions: are there requirements you must meet? What do your customers and partners expect? And how much effort is reasonable for your size? An overview by type of organisation.
Three questions before choosing
1. Are there requirements? Some organisations must comply with a specific standard because of a law, a supervisory authority or a sector rule. Then the choice is largely made. Clarify this first, if in doubt with your legal adviser or your industry association.
2. What do customers and partners expect? If key customers require an ISO/IEC 27001 certificate, there is hardly a way around it. If they only ask about your security level in general, a recognised framework with a traceable assessment is often enough.
3. What is reasonable? A framework has to fit the organisation. A full ISMS to ISO/IEC 27001 means ongoing effort for documentation, audits and management review. For a small organisation with no need for certification, a leaner start can make more sense.
SMEs
For most Swiss SMEs the ICT Minimum Standard is a good starting point. It is freely available and written as concrete measures. Its five functions – Identify, Protect, Detect, Respond, Recover – cover the key topics without requiring a full management system.
The path to ISO/IEC 27001 stays open: the ICT Minimum Standard references the matching parts of the standard for each category. If you want to certify later, you build on the work already done. What a pragmatic start looks like is shown in The ICT Minimum Standard for SMEs.
Medium-sized and larger companies
Here several requirements often come together: international customers, tenders, a statutory auditor reviewing the internal control system. ISO/IEC 27001 is then an obvious yardstick because it is understood internationally and can be certified – even if not every company actually certifies.
Companies subject to an ordinary audit also have an internal control system (ICS) whose existence the auditor checks. IT controls such as access rights and change management belong to both worlds. It pays to align the security framework and the ICS. More in Internal control system (ICS).
Groups and holdings
In a group with several companies, the most important decision is to use one common framework for all of them. Only then can results be compared: which company is below target in which topic? Where is a shared solution worthwhile, such as central monitoring or training?
At the same time each company needs its own scope and its own owners. A tool should therefore keep tenants separate and still give group management an overall view.
Municipalities and public administrations
Municipalities and administrations are subject to cantonal rules on information security and data protection, which differ from canton to canton. Clarify first which ones apply. Where no particular method is prescribed, the ICT Minimum Standard is an obvious yardstick: it comes from the federal government, is freely available and clearly written.
If a municipality runs its own utilities – for electricity, gas or water, for example – the sector standards also apply to those areas (see below). In addition, cantonal and municipal administrations are in principle among the organisations that must report cyberattacks to the BACS; exceptions are set out in the ordinance.
Critical infrastructure operators
The ICT Minimum Standard is explicitly aimed at operators of critical infrastructure. For several sectors there are sector standards built on it, including water, wastewater, food supply, public transport, electricity, gas and district heating and cooling. According to the BACS, the sector standard for electricity supply has been mandatory since 1 July 2024 and the one for gas supply since 1 July 2025; for the other sectors it is a recommendation.
In addition, since 1 April 2025 operators of critical infrastructure must report cyberattacks to the BACS within 24 hours. Who is affected and what exactly has to be reported is described by the BACS on its website.
Service providers, advisers and fiduciaries
If you audit or advise many clients, what you need above all is one consistent method: the same catalogues, the same rating scale, the same report. This keeps results comparable, and new staff find their way quickly. Depending on the client, ISO/IEC 27001, the ICT Minimum Standard or a custom catalogue is used – often side by side.
IT service providers are also audited themselves: their customers want to know how well the provider’s own infrastructure is protected. An ISO/IEC 27001 certificate can replace or shorten questionnaires here.
Overview
| Organisation | Obvious starting point | When to go further? |
|---|---|---|
| SMEs | ICT Minimum Standard | ISO/IEC 27001 when customers require a certificate |
| Medium-sized and larger companies | ISO/IEC 27001 or ICT Minimum Standard, aligned with the ICS | Certification for customers or tenders |
| Groups and holdings | one common framework for all companies | Group-wide targets and comparison per topic |
| Municipalities and administrations | cantonal rules, otherwise ICT Minimum Standard | Sector standards for own utilities |
| Critical infrastructure | ICT Minimum Standard and sector standard | Sector obligations, reporting obligation |
| Service providers and advisers | one consistent method, the right catalogue per client | ISO/IEC 27001 for their own organisation |
The differences between ISO/IEC 27001 and the ICT Minimum Standard are explained in ISO 27001 vs. ICT Minimum Standard.
How Audhive helps
Audhive separates companies or clients as tenants, each with its own control set and roles; groups combine tenants, and the Executive Board shows all of them against the target. For each tenant you choose mode SEC (security audit), ICS (internal control system) or both. For SMEs that only need the ICT Minimum Standard there is the SEC Swiss Edition.
Sources
- Federal Office for Cybersecurity (BACS): ICT minimum standards and sector standards (page in German)
- Federal Council: press release on the reporting obligation for cyberattacks on critical infrastructure, 7 March 2025 (in German)
- Federal Office for Cybersecurity (BACS): website with information on the reporting obligation
- ISO: ISO/IEC 27001:2022