# ICT Minimum Standard under the Electricity Supply Ordinance (StromVV, Art. 5a) > Since 1 July 2024, the recommendations of the Minimum Standard for Improving ICT Resilience (ICT Minimum Standard, May 2023 edition) have been binding, per the respective protection level under Annex 1a, under Art. 5a of the Electricity Supply Ordinance (StromVV, SR 734.71) for grid operators, for generators and storage operators with a total of 100 MW or more of controllable capacity via a single system, and for service providers able to permanently remote-control such installations. The Swiss Federal Electricity Commission (ElCom) can demand proof of the protection level being reached at any time. - Type: Regulation, Statutory - Scope: Switzerland - As of: 24 September 2026 - Page: https://sacosi.ch/en/norms/ikt_minimalstandard_stromvv - Regulatory Check: https://sacosi.ch/en/regulation#normencheck ## When does ICT Minimum Standard (StromVV) apply to you? - Industry: Energy (Likely applies): As a company in the energy industry, you are in principle a candidate as a grid operator, generator or storage operator under Art. 5a StromVV - whether you are specifically covered depends on your role and, for generation or storage, on the 100 MW threshold of controllable installed capacity. - Activity: Critical infrastructure (applies if additionally: Industry: Energy) (Likely applies): As an energy company, you count among critical infrastructure - in the energy sector, Art. 5a StromVV precisely narrows the circle of those obliged to grid operators, larger generators/storage operators of 100 MW or more, and their remote-control service providers; check whether you fall into one of these three categories. Critical infrastructure outside the energy industry does not fall under this ordinance. - Activity: Operational technology (OT plant) (applies if additionally: Industry: Energy) (Likely applies): You operate or control OT installations (operational technology) in the energy sector - if these serve electricity generation, storage or grid operation, or you can permanently remote-control such installations for third parties, the ICT Minimum Standard under Art. 5a StromVV may apply to you. OT installations outside the energy industry are not covered. - Role towards customers: Operator (applies if additionally: Industry: Energy) (Recommend individual review): As the operator of an installation in the energy sector, you should check case by case whether you fall under one of the three categories named in Art. 5a(1) StromVV: grid operator, generator/storage operator with 100 MW or more (except nuclear power plants), or a service provider with permanent remote-control access to such installations. ## Exceptions - Operators of nuclear power plants are expressly exempted from the obligations for generators under Art. 5a(1)(b) StromVV; they are subject to their own nuclear-energy-law safety requirements. - Generators and storage operators whose installations together have less than 100 MW of capacity, or which cannot be controlled via a single system, are not covered under Art. 5a(1)(b) StromVV. - The internationally recognised standards named within the ICT Minimum Standard itself are not binding on their own (Art. 5a(2) StromVV); what is binding are the ICT Minimum Standard's recommendations, even where these refer to such standards. ## Obligations - Implement the recommendations of the ICT Minimum Standard (May 2023 edition) according to the protection level assigned to one's own role or installation under Annex 1a StromVV (Art. 5a(1) StromVV). - Demonstrate to ElCom, on request, that the respective protection level has been reached (Art. 5a(3) StromVV). ## Evidence - Evidence documentation on the protection level reached (A, B or C) towards ElCom. - Documentation of the implementation of the individual ICT Minimum Standard recommendations per assigned protection level (Annex 1a StromVV). ## Deadlines - 1 July 2024: Art. 5a StromVV (protection against cyber threats / ICT Minimum Standard) enters into force (AS 2024 282). ## Penalties Art. 5a StromVV itself does not provide for a penalty provision of its own. ElCom can demand proof of the protection level being reached at any time (Art. 5a(3) StromVV) and order measures as part of its general supervisory and directive powers under the Electricity Supply Act (StromVG). A specifically quantified sanction provision for non-compliance with the ICT Minimum Standard could not be found in the ordinance text read (see unsicher). ## Frequently asked questions **What exactly is the ICT Minimum Standard?** A catalogue of recommendations for improving ICT resilience (May 2023 edition). Per the footnote to Art. 5a StromVV, it is available free of charge from the Federal Office for National Economic Supply (FONES) via www.bwl.admin.ch or by email to info@bwl.admin.ch. Art. 5a StromVV declares its recommendations binding for certain electricity-supply actors, depending on the protection level. **Who determines which protection level (A, B, C) applies to my company?** The assignment is made under Annex 1a StromVV. The exact assignment criteria were not examined in the full text of Annex 1a in this research; only the general three-tier structure is known from a professional source (see unsicher). **Is the ICT Minimum Standard the same as an NCSC document?** No. The ordinance text itself (footnote 27 to Art. 5a StromVV) refers to the Federal Office for National Economic Supply (FONES) as the source, not to the NCSC/BACS. This attribution, taken directly from the ordinance's text, differs from an originally assumed NCSC responsibility. ## Open points of the research - The exact assignment criteria for protection levels A, B and C to individual company categories (Annex 1a StromVV) were not read in full text; the classification 'A = most important companies, B = medium-sized, C = smaller actors' comes from a professional article (InfoGuard, secondary), not directly from the ordinance's text. - Per the footnote to Art. 5a StromVV, the ICT Minimum Standard is obtained via the Federal Office for National Economic Supply (FONES, www.bwl.admin.ch); a responsibility of ncsc.admin.ch for this specific document was not confirmed in this research. - A specific sanction provision for breaches of Art. 5a StromVV was not found; whether and how ElCom sanctions breaches case by case (e.g. based on the StromVG) was not researched. ## Sources - [Stromversorgungsverordnung (StromVV), SR 734.71, Art. 5a Schutz vor Cyberbedrohungen (konsolidierter Stand am 1. Januar 2025, Art. 5a eingefügt durch Änderung vom 31. Mai 2024, in Kraft seit 1. Juli 2024)](https://www.fedlex.admin.ch/eli/oc/2024/282/de), Bundeskanzlei / Fedlex (Änderungserlass AS 2024 282, wirksam in der konsolidierten StromVV SR 734.71), retrieved 24 September 2026 - [IKT-Minimalstandards nach StromVV: So vermeiden Sie ein Blackout-Szenario](https://www.infoguard.ch/de/blog/ikt-minimalstandards-nach-stromvv), InfoGuard AG (Fachartikel), retrieved 24 September 2026 --- A professional assessment based on publicly available sources, not legal advice. Whether a given rule applies in your specific case depends on circumstances that are not fully captured here. Source: SACOSI, Situational Awareness Consulting by Ivo Schönberner (https://sacosi.ch).