We approach cybersecurity from an adversarial-economic perspective — investment must match the value of the information at stake. That negotiation belongs where decisions are actually made: between board, legal, and compliance.
From strategic positioning through legally defensible valuation to regulatory practice. Sector- and size-agnostic, from SME to multinational.
We work at the level where security decisions are actually made — between board, legal, and compliance. Need-to-protect, doctrine, and investment logic are not delegated here; they are negotiated.
Independent assessments that hold up before insurers, in due diligence, and in proceedings. We quantify what others merely assert — state of the art, duty of care, loss potential.
We translate directives into operational reality — without buzzword theatre, with verifiable trails. Strong at the Switzerland / EU interface, from entry into force to audit.
With the NIS-2 Directive and the Cyber Resilience Act, the EU is articulating its most comprehensive cybersecurity expectation to date. Swiss companies are not directly bound — but via EU subsidiaries, EU markets, and supply chains the pressure passes through almost without gap.
The NIS-2 Directive replaces the original 2016 NIS Directive and moves cybersecurity definitively out of the IT basement and into the boardroom. It covers not only classical critical infrastructure but also manufacturers of critical products, digital services, waste management, public administration, and a substantial share of manufacturing.
Addressees fall into two categories — "essential" and "important" entities. The difference lies mainly in the intensity of oversight and the fine ceiling. For both, executive management bears personal responsibility.
While NIS-2 governs the security of organisations, the Cyber Resilience Act (CRA) addresses the security of products — more precisely, all "products with digital elements" placed on the EU internal market. From the IoT sensor via industrial components to standalone software.
The direction is unambiguous: security-by-design becomes mandatory, the CE mark will include cybersecurity, and responsibility does not end at the sale — manufacturers must guarantee product-specific vulnerability management and security updates for the defined "support period".
Switzerland is not an EU Member State — the NIS-2 Directive and the CRA do not apply directly. It is nevertheless an illusion to think Swiss companies are unaffected. The effect travels through three channels, and it is real.
An establishment in the EU is directly subject to the local NIS-2 transposition — with all reporting duties and fine ceilings.
Anyone offering digital services from Switzerland into the EU — cloud, managed services, DNS — often falls directly within scope.
EU customers are required to vet their suppliers on cybersecurity. NIS-2 is thus passed "downstream" — through contracts rather than statutes.
In parallel, Switzerland is tightening its own framework. The Information Security Act (ISG) has been in force since January 2024; since 1 April 2025, a 24-hour reporting duty applies to operators of critical infrastructure vis-à-vis the Federal Office for Cybersecurity (BACS). Breaches can be fined up to CHF 100,000. An expansion of scope towards NIS-2 logic is foreseeable.
The regulatory wave does not start in 2027 — it has been in motion since 2024. The dates below are the pillars. Preparation begins several quarters earlier.
No sales pitch.
Fifteen minutes of clarity about what you actually need to protect.
Tell us briefly about your situation. We respond within 24 hours with an honest assessment — no obligation, no mailing list.
Your enquiry was opened in your email program — please send it from there. If nothing appeared, write directly to contact@clypeus.ch.