The question sits near the top of most customer security questionnaires: who is responsible for information security at your company? In many Swiss SMEs the answer only comes into existence at that moment. Someone from the management team types in the name of the IT manager, because he is the closest thing to it, and sends the form off. The company now has an information security officer. In an SME that is often the whole procedure: a name in a field, no conversation, no time budget, no decision rights.
The IT manager finds out when the customer asks who maintains the risk register. By then he has a role he never negotiated, and a week that was already full.
An information security officer in an SME needs more than the appointment. Without a time budget, without authority and without a reporting line to management, the role stays a name in a customer questionnaire. Four things make it hold: a written role description with decision rights, 20 to 30 percent of a full-time position, a fixed reporting rhythm, and a person who is not also accountable for running IT.
Why the name in the form is not yet a role
With an appointment, management distributes responsibility. Without time, authority and a reporting line, all that remains of it is the feeling of being in charge. That carries for a while. Then comes the moment when the person has to choose between operations and security, and operations wins, because it is louder. A production system that has stopped calls you, an unaddressed supplier risk does not.
The Swiss Federal Office for Cybersecurity (BACS) states in its baseline protection guidance for companies and public bodies that cybersecurity is more than a technical task for the IT department, and is instead a core management duty. Management decides where money for protecting critical processes goes. An officer can prepare those decisions. Taking them is not in their hands.
This is exactly where things get muddled in practice. Management reads the appointment of an information security officer as delegation and considers the topic handed over. The appointed person believes they are allowed to decide, notices at the first budget request that they are not, and stops filing requests. After that, information security continues at the level it would have reached without the appointment, only now with a name in the questionnaire.
What does an information security officer in an SME actually do?
An information security officer keeps the risks visible, prepares decisions for management, and makes sure decisions that have been taken arrive in day-to-day operations with evidence behind them. Four tasks recur in almost every company: maintaining a current picture of the risks, obtaining decisions rather than taking them, keeping evidence in order, and answering customer questions and audits. On top of that comes readiness for the incident that eventually arrives.
What is not in the role matters just as much: configuring firewalls and restoring backups. That is IT operations, and it stays where it belongs. In the role, someone checks whether operations hold up what management has assumed. One person tests the restore, another looks at the record and asks questions when none has existed for over a year.
The unglamorous core of the job is translation. Upwards: turning a technical finding into a business decision, with cost, deadline and an owner. Downwards: turning a management resolution into a measure that someone has in their calendar. Anyone who handles both directions needs little tooling. When both are missing, the company buys tools and hopes.
| What the appointment letter says | What the role needs in practice |
|---|---|
| "responsible for information security" | a list of the decisions this person may take alone, with everything else going to management |
| "in consultation with IT" | access to contracts, licence lists, the risk register and the quotes from service providers |
| "in addition to the current function" | a share of a full-time position in the annual objectives, subtracted from existing duties rather than added on top |
| "reports as required" | a fixed slot every quarter with management or the board, including the quarters when nothing is burning |
Who can take on the role in an SME?
An information security officer in an SME needs closeness to operations, access to management and the ability to say uncomfortable things calmly. A security certification is not a criterion for that; standing your ground is. What is ruled out is the combination that occurs most often in SMEs: being accountable for running IT and judging whether the protection is sufficient at the same time.
That is not a question of trust, but a question of roles. Whoever built the backup design is the wrong person to tell management that it does not meet the recovery time everyone agreed on. Not out of dishonesty. It is simply that hardly anyone enjoys finding fault with their own work, and in that setup management hears both things from the same person: the assessment and the all-clear.
This is why management teams in SMEs without their own security department often place the role outside IT, usually in quality management or in finance and risk. People who know audit logic, take evidence seriously, and do not go quiet in a management meeting. The technical side can be supplied to them, the discomfort cannot.
If the role stays with the IT manager because there is nobody else in the house, it needs a second pair of eyes from outside. Someone who looks at the risk register without having built it, and who informs management without a conflict of loyalty. When that point has been reached usually shows up more clearly in the four triggers that tell you an SME needs a CISO than in the headcount.
How much time does an information security officer need?
In our experience 20 to 30 percent of a full-time position in normal operations, at companies with 100 to 300 employees. During the build-up of an ISMS, or in the weeks before a certification or customer audit, considerably more, and less again afterwards. At zero percent and goodwill, what you get is documents nobody maintains.
Those percentages stand against the obvious alternative, a permanent hire. The salary data from jobs.ch shows an average of around CHF 155'000 gross per year for a chief information security officer in Switzerland, based on 191 submissions. Add social contributions and several months of searching. For an SME with 150 employees that is not a realistic figure, and it is not needed either. How the arithmetic compares with an engagement is broken down in the honest calculation of what a CISO costs.
The more expensive option is almost always the quiet one: an appointment at zero percent. It costs nothing in the budget and still produces work, because every customer questionnaire and every audit turns into its own project. More protection, fewer tools, lower cost starts right here. With time and authority, the appointed person knows within months which licences stay. Without either, the company keeps signing off whatever the service providers propose.
A food producer with 170 employees: who ends up carrying the role
An anonymised example from practice. A food producer, around 170 employees, two sites, an IT team of three plus an external provider running operations. A large retail customer demands a named contact for information security in the framework agreement, with name and function. Management appoints the IT manager as information security officer, because it has to happen quickly.
Six months later the topic is stuck. In that time the IT manager has carried out a migration and run the role exactly as far as the customer asked about it. The risk register consists of a consultancy report from two years ago. Nobody has ever decided which of the gaps listed in it are accepted.
Management then gives the role to the head of quality management, with 20 percent of her position and a written mandate. The reasoning is practical rather than technical: the quality lead has run audits in the food sector for years, knows the mechanics of evidence, finding and corrective action, and sits in the management meeting. The IT manager stays technically accountable and becomes her most important supplier.
What changes as a result sounds like little and works quickly. The twelve open points from the old report get sorted: four implemented, five scheduled, three knowingly accepted and signed off by management. The next customer questionnaire goes out in two days instead of three weeks. And two licences are dropped, because going through the contracts the IT manager sees that one tool does the same as another. The licence savings cover roughly the 20 percent of a position. That the arithmetic works out this way is no law of nature. We have seen it often enough to mention it in the budget conversation.
What makes the appointment hold
Four things decide whether the appointment carries in everyday operations:
- A role description with authority. Not only tasks, but the decisions this person may take alone, and the threshold above which management has to be involved.
- Time that is subtracted elsewhere. A share of the position in the annual objectives. A role on top of a full workload is a statement of intent.
- A reporting line that does not detour via the IT lead. A fixed quarterly slot with management or the board, with room in it for bad news.
- A deputy. Two weeks of holiday or a resignation must not bring the topic to a halt, and decisions have to be readable, not merely remembered.
If the experience to fill this role is missing in-house, the answer is not necessarily a hire. What carries instead is an internal person with a mandate and time, who checks in at a fixed rhythm with someone who has seen many security programmes from the inside. In our experience this setup gets further than an advertised position that nobody suitable applies for over half a year. Which forms that can take, from a second opinion for an existing IT lead through to security leadership on a mandate, is set out in the packages and prices on the homepage.
If the role is already filled at your company, no new organisation is needed. The question is enough: has the appointed person brought about a decision this month? If not, something from the four things above is missing, and that is a job for management rather than for the appointed person.
Frequently asked questions
Does a Swiss SME have to appoint an information security officer?
No general Swiss law requires an information security officer. The role becomes binding along three other routes: ISO 27001 requires in clause 5.3 that roles and responsibilities for information security are assigned and communicated. Organisations covered by the ISG, the Swiss information security act, need a functioning ISMS by the end of 2026, and an ISMS without named accountability does not exist. And customers demand a named contact in the contract, which in practice takes effect fastest.
Can our data protection adviser take the role on as well?
Possible, but these are two mandates. A data protection adviser under the nDSG, the revised Swiss data protection act, is voluntary in Switzerland and looks at the processing of personal data. Information security also covers production data and costings, as well as the availability of systems that hold no personal data at all. The overlap in inventory and technical measures is large, the perspective is not. Anyone bundling both into one person should budget the time for both and keep the reporting lines separate.
What happens if the appointed person resigns?
That shows how much of the role was anchored in the organisation and how much of it sat in one head. It can be tested beforehand: if the risk register, the decisions and the open measures are documented and a deputy knows the current state, the handover costs weeks. If everything sits in email threads and memories, the topic starts over, and the next customer questionnaire reaches a company without a contact.