{"id":237612,"date":"2026-11-04T09:00:00","date_gmt":"2026-11-04T08:00:00","guid":{"rendered":"https:\/\/www.rister.ch\/?p=237612"},"modified":"2026-10-29T14:26:59","modified_gmt":"2026-10-29T13:26:59","slug":"cybersecurity-company-geneva","status":"publish","type":"post","link":"https:\/\/www.rister.ch\/en\/post\/cybersecurity-company-geneva\/","title":{"rendered":"Setting up a cybersecurity company in Geneva: SOC services, penetration testing, incident reporting and data protection"},"content":{"rendered":"
\n

You can open a cybersecurity company in Geneva without asking anyone for a licence. A GmbH or an AG entered in the Geneva commercial register is all you need to sell audits, run a security operations centre (SOC) or answer incident calls. The pressure comes from your buyers. Banks have had to report cyberattacks to the federal authorities within 24 hours since 1 April 2025, sensitive federal contracts can bring a security vetting of your company, and a penetration test stays lawful only inside the limits your client has signed. This guide reflects the law on 29 October 2026.<\/p>\n<\/div>\n

\n

Contents<\/h3>\n
    \n
  1. A cybersecurity company in Geneva needs no licence<\/a><\/li>\n
  2. Penetration testing and the Criminal Code<\/a><\/li>\n
  3. Bank clients and cyberattack reporting<\/a><\/li>\n
  4. Is your SOC itself covered by the reporting duty?<\/a><\/li>\n
  5. Federal contracts and company security vetting<\/a><\/li>\n
  6. Logs, mailboxes and client databases: acting as a processor<\/a><\/li>\n
  7. Export controls on your tools<\/a><\/li>\n
  8. GmbH or AG for a team from abroad<\/a><\/li>\n
  9. Five mistakes we see<\/a><\/li>\n
  10. FAQ<\/a><\/li>\n<\/ol>\n<\/div>\n

    A cybersecurity company in Geneva needs no licence<\/h2>\n

    Swiss federal law has no licence for penetration testers and no approval scheme for SOC providers. The statutes that shape your work, from the Criminal Code (CP) to the Information Security Act (LSI), set rules on how you operate. None of them controls who may enter the market.<\/p>\n

    Qualifications are a sales argument, not a gate. The federal certificate for Cyber Security Specialists (brevet f\u00e9d\u00e9ral) and ISO\/IEC 27001 certification of your company help with banks; neither conditions registration or any contract.<\/p>\n

    Geneva applies one text that sits close to the subject: the intercantonal concordat on security companies (CES, RSG I 2 14). Its Article 4(1) covers the surveillance or guarding of movable and immovable property, the protection of persons and the secure transport of goods or valuables, including services provided through installations such as alarm centres. Information technology is not mentioned, and the text gives no answer on whether it would reach a SOC.<\/p>\n

    Guards and alarm centres are a separate trade, covered in our article on setting up a security company in Geneva<\/a>. If your offer mixes physical and digital security, clear the point with the canton before you file for registration.<\/p>\n

    Penetration testing and the Criminal Code<\/h2>\n

    What turns an intrusion into a penetration test is the system owner’s written consent. The computer offences of the Criminal Code target access that is unauthorised: anyone who \u201cobtains unauthorised access by means of data transmission equipment to a data processing system that has been specially secured to prevent their access\u201d faces up to three years, on complaint (Art. 143bis(1) CP). Article 14 CP adds that a person who \u201cacts as required or permitted by the law, acts lawfully\u201d.<\/p>\n

    Your engagement letter is where that permission takes shape. With a bank or an international organisation, expect to negotiate each of these points:<\/p>\n

    \n\n\n\n\n\n\n\n\n\n
    Contract clause<\/th>\nWhat it settles<\/th>\nProvision at stake<\/th>\n<\/tr>\n<\/thead>\n
    List of systems, IP ranges and applications in scope<\/td>\nWhich assets belong to the client and may be tested<\/td>\nArt. 143bis(1) CP, which in French speaks of a system belonging to another person<\/td>\n<\/tr>\n
    Written consent of hosting and cloud providers<\/td>\nInfrastructure the client rents but does not own<\/td>\nArt. 143bis(1) CP<\/td>\n<\/tr>\n
    Excluded techniques, such as destructive tests<\/td>\nThe risk of altering or deleting data<\/td>\nArt. 144bis(1) CP<\/td>\n<\/tr>\n
    Handling of data obtained during the test<\/td>\nSensitive personal data, common in private banking<\/td>\nArt. 179novies CP<\/td>\n<\/tr>\n
    Liability cap<\/td>\nMinor negligence only<\/td>\nArt. 100(1) CO<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Sources: Swiss Criminal Code (SR 311.0), version of 1 October 2026; Code of Obligations (SR 220). The clauses reflect contract practice: the law prescribes no standard content for a penetration test.<\/p>\n<\/div>\n

    Your tooling falls under a stricter rule. Article 143bis(2) CP punishes anyone who \u201cmarkets or makes accessible passwords, programs or other data\u201d that they know or must reasonably believe will be used for unauthorised access. That offence needs no complaint: the public prosecutor acts on its own motion. Log who can reach your tools and recovered credentials.<\/p>\n

    Bank clients and cyberattack reporting<\/h2>\n

    Banks, insurers and financial market infrastructures are on the list of organisations that must report cyberattacks to the Federal Office for Cybersecurity (OFCS). Article 74b(1)(e) LSI names companies subject to the Banking Act, the Insurance Supervision Act and the Financial Market Infrastructure Act. The duty has applied since 1 April 2025, and penalties for failing to report since 1 October 2025.<\/p>\n

    If you run a SOC for these clients, four figures will end up in your service agreement:<\/p>\n