How to start a cybersecurity company in Switzerland: penetration testing law, incident reporting, data protection and export controls

No licence to start a cybersecurity company in Switzerland, only optional qualifications

No federal act requires a licence, an approval or a registration to sell cybersecurity services. The Information Security Act (ISA, LSI in French) organises the reporting of cyberattacks and the support provided by the Federal Office for Cyber Security (FOCS, OFCS in French).

Qualifications help you sell. According to orientation.ch, the federal PET diploma of Cyber Security Specialist is open to holders of a Swiss vocational certificate in IT or communications with at least two years of practice in information security or cybersecurity. An ISO/IEC 27001 certification of the company is likewise a commercial argument, not an obligation.

Guarding property, protecting people and transporting valuables fall under a different regime, the intercantonal concordat on security companies (CES), whose Geneva text targets physical security without mentioning IT. If your project includes guards or an alarm monitoring centre, read our guide to starting a security company in Switzerland instead. For a purely IT-based SOC, the text does not settle the question: ask the canton where you plan your registered office.

Penetration testing: where an audit ends and an offence begins

Swiss criminal law has no notion of a pentest. It punishes unauthorised access, and the decisive word is authorisation: “Any person who obtains unauthorised access by means of data transmission equipment to a data processing system that has been specially secured to prevent their access shall be liable on complaint to a custodial sentence not exceeding three years or to a monetary penalty” (Art. 143bis para. 1 SCC).

A penetration test reproduces exactly these acts, with the consent of whoever controls the system, and Art. 14 SCC draws the consequence: “Any person who acts as required or permitted by the law, acts lawfully even if the act carries a penalty under this Code or another Act.” The law supplies no template authorisation letter: drafting the document that sets out what the client allows is your job.

The official French text of Art. 143bis adds a detail the English translation leaves out: the system must belong to someone else (“appartenant à autrui”). When the client’s application runs at a hosting provider or a cloud provider, the client’s consent alone may not cover that third party’s infrastructure. Your scope document should separate the two.

Tools and passwords: an offence prosecuted ex officio

The second criminal rule concerns your tooling. Art. 143bis para. 2 SCC punishes “Any person who markets or makes accessible passwords, programs or other data that they know or must reasonably believe are intended to be used to commit an offence under paragraph 1”. Unlike paragraph 1, it contains no “on complaint” wording, so no complaint is needed.

Holding offensive tools for authorised work is not targeted as such; handing them to anyone who asks may be. Art. 144bis no. 2 follows the same logic for programs that destroy data, with six months to ten years for those who act for commercial gain. Put in writing who may use your tools, who receives credentials harvested during a test and how they are destroyed afterwards.

Running a SOC: cyberattack reporting to the FOCS

Since 1 April 2025, critical infrastructure must report cyberattacks to the FOCS within 24 hours of discovery (Art. 74e para. 1 ISA), with sanctions applying since 1 October 2025. A federal press release of 29 September 2025 counted 164 such attacks reported in six months.

Many SOC clients appear in Art. 74b ISA: universities, public authorities, banks, insurers and financial market infrastructures, hospitals on a cantonal list, medical laboratories, energy, transport and telecommunications. A report is due when the attack endangers the functioning of the infrastructure, leads to manipulation or leakage of information, involves blackmail, threats or coercion, or went unnoticed for a long period (Art. 74d ISA). The Cybersecurity Ordinance treats an attack as unnoticed for a long period when it took place more than 90 days earlier. The FOCS allows 14 days to complete an incomplete report.

Art. 17 para. 2 of the Cybersecurity Ordinance (OCyS in French) opens a commercial offer: one or more organisations subject to the duty may hand the reporting process, individually or jointly, to a third-party organisation. Your SOC contract must then state who detects, who assesses and who files on time.

Your own systems may also be in scope. Letter t of Art. 74b covers providers of digital security or trust services, provided they have a registered office in Switzerland, and the ordinance exempts providers that do not serve third parties for payment. A security firm selling to clients likely falls within the wording, but the FOCS has the final word and may issue a decision on coverage (Art. 74a para. 2 ISA).

Your company as a processor under the FADP

A SOC that reads log files, or an incident response team that opens mailboxes, handles personal data on behalf of its client. The Federal Act on Data Protection (FADP, LPD in French) makes it a processor: “a private person or federal body that processes personal data on behalf of the controller” (Art. 5 let. k FADP).

• A legal basis: processing may be assigned to a processor by contract or by legislation (Art. 9 para. 1 FADP).
• Appropriate security: controller and processor must guarantee “a level of data security appropriate to the risk by taking suitable technical and organisational measures” (Art. 8 para. 1 FADP).
• No subcontractor without consent: “The processor may only assign processing to a third party with prior approval from the controller” (Art. 9 para. 3 FADP).
• Breach notification to the client: “The processor shall notify the controller of any breach of data security as quickly as possible” (Art. 24 para. 3 FADP).

The FADP sets no figure. The 72 hours often quoted come from the EU General Data Protection Regulation, not from Swiss law. Clients have a concrete reason to ask for a data processing agreement: Art. 61 FADP provides for a fine of up to 250,000 francs for anyone who wilfully assigns processing without meeting Art. 9 paras. 1 and 2.

Export controls: goods, not services

The Goods Control Act (GCA) defines goods as “commodities, technologies and software” (Art. 3 let. a GCA). A penetration test sold to a foreign client appears in no entry of the control list, so the service itself requires no licence from the State Secretariat for Economic Affairs (SECO).

Building tools changes the picture. Annex 2 of the Goods Control Ordinance (GCO, OCB in French) lists systems and software designed or modified to generate, command and control, or deliver intrusion software (entries 4A005 and 4D004), together with the technology for developing such software (4E001.c). Exporting them requires “an export licence from the State Secretariat for Economic Affairs (SECO)” (Art. 3 para. 1 GCO), and a legal entity must provide “proof of reliable internal controls on compliance with the export control regulations” (Art. 5 para. 2 GCO). A separate ordinance on goods for internet and mobile communications surveillance adds an individual SECO licence for the same entries.

Two exclusions protect day-to-day work. According to a note to entry 4E001, entries 4E001.a and 4E001.c cover neither vulnerability disclosure nor cyber incident response, and software in the public domain escapes control altogether. Internal sharing is another matter: sending a proprietary tool to a consultant abroad is a transfer, and Art. 14 para. 1 let. b GCA punishes anyone who “passes on to or brokers technology or software for a recipient abroad without the required licence”.

Foreign founder, legal form and VAT

An EU or EFTA national who settles in Switzerland to pursue a self-employed activity receives a residence permit valid for at least five years, provided they prove that establishment (Agreement on the Free Movement of Persons, Annex I, Art. 12). Other nationals need a cantonal admission, granted where it serves the country’s economic interests, the financial and operational requirements are met and the founder has sufficient independent means (Art. 19 FNIA). In both cases, the company “must be able to be represented by a person who is resident in Switzerland”: a managing director or manager of a GmbH (Art. 814 para. 3 CO), a board member or executive officer of an AG (Art. 718 para. 4 CO).

The GmbH, with 20,000 francs of fully paid-up capital (Art. 773 para. 1 CO), suits a small testing team. The AG, with 100,000 francs of capital, at least 50,000 paid up (Art. 621 and 632 CO), suits a company expecting investors. See our guide to the incorporation of a company in Switzerland

Your client contracts are mandates under Swiss law: “The mandatee is liable to the mandator for the diligent and faithful performance of the business entrusted to him” (Art. 398 para. 2 CO). A liability cap can cover minor negligence, never intent or gross negligence: “Any agreement purporting to exclude liability for unlawful intent or gross negligence in advance is void” (Art. 100 para. 1 CO).

On VAT, registration becomes mandatory once annual turnover reaches 100,000 francs, counting turnover “on Swiss territory and abroad” (Art. 10 para. 2 let. a VAT Act), at the standard rate of 8.1% (Art. 25 para. 1). An audit sold to a foreign business is supplied where the recipient “has its registered office or a permanent establishment for which the service is provided” (Art. 8 para. 1 VAT Act): the place of supply is then the client’s country, not Switzerland.

A worked case: a British founder in Zug

A former red team lead from London sets up a GmbH in Zug with 20,000 francs of capital, selling red teaming and managed detection. The United Kingdom is outside the EU and EFTA, so her own permit depends on a cantonal admission under Art. 19 FNIA. Until she moves, a Swiss-resident managing director represents the company. Every engagement starts with a signed statement of work; when a client’s platform runs in a third-party cloud, the scope stops at the client’s own tenant unless the provider consents in writing.

Her first managed detection contract comes from a Swiss private bank, an institution subject to the Banking Act and therefore covered by Art. 74b ISA. The data processing agreement bans subcontractors without the bank’s approval, and an annex hands the GmbH the reporting process. Before sending its in-house command and control framework to a contractor in London, the GmbH has it classified; since it falls under entries 4A005 and 4D004, it applies to SECO for a licence first.

Mistakes that expose the company

• Testing on a verbal agreement, then having to prove that access was authorised.
• Including a hosting provider’s server in the scope without that third party’s consent.
• Letting tools or credentials circulate beyond the team.
• Taking over a client’s reporting duty without a contract.
• Sending a proprietary tool abroad without a prior classification.
• Calling a certification mandatory in a proposal.

FAQ: starting a cybersecurity company in Switzerland

Do you need a licence to start a cybersecurity company in Switzerland?

No. No federal act requires a licence or approval to sell cybersecurity services. The federal PET diploma of Cyber Security Specialist and an ISO/IEC 27001 certification are optional selling points.

Is penetration testing legal in Switzerland?

Yes, when the person who controls the system authorises it. Unauthorised access under Art. 143bis para. 1 of the Criminal Code requires the absence of authorisation, and Art. 14 declares lawful any act permitted by law. The client’s consent does not automatically extend to the systems of a third-party hosting provider.

How quickly must a cyberattack be reported in Switzerland?

Within 24 hours of discovery for the critical infrastructure listed in Art. 74b of the Information Security Act, a duty in force since 1 April 2025. The FOCS grants 14 days to complete an incomplete report. A SOC can take over the process.

Does a cybersecurity company have to report attacks on its own systems?

Possibly. The Information Security Act covers Swiss-based providers of digital security services that serve third parties for payment. The FOCS can issue a decision on whether a company is covered.

Is a SOC a processor under Swiss data protection law?

Yes, as soon as it processes personal data for its client. It needs a contract or legal basis, appropriate security, the client’s prior approval for any subcontractor, and must report breaches to the client as quickly as possible. The FADP sets no 72-hour deadline.

Do you need a SECO licence to sell penetration tests abroad?

Not for the service itself. A licence is required to export or transfer tools that generate, control or deliver intrusion software, and the related development technology (entries 4A005, 4D004 and 4E001.c of Annex 2 GCO). Vulnerability disclosure and cyber incident response are excluded from entries 4E001.a and 4E001.c.

Sources

• Swiss Criminal Code (SCC), SR 311.0, Art. 14, 143bis, 144bis and 179novies
• Information Security Act (ISA), SR 128, Art. 74a to 74h (French)
• Cybersecurity Ordinance (OCyS), SR 128.51 (French)
• Federal Office for Cyber Security (FOCS)
• Federal Act on Data Protection (FADP), SR 235.1
• Goods Control Act (GCA), SR 946.202
• Goods Control Ordinance (GCO), SR 946.202.1
• Ordinance on goods for internet and mobile communications surveillance, SR 946.202.3 (French)
• Swiss Code of Obligations (CO), SR 220
• Federal Act on Value Added Tax (VAT Act), SR 641.20
• Agreement on the Free Movement of Persons (AFMP), SR 0.142.112.681, Annex I (French)
• Foreign Nationals and Integration Act (FNIA), SR 142.20, Art. 19
• orientation.ch, Cyber Security Specialist with federal diploma (French)