Swiss regulation, governance and GRC work
The second line of defence is where risk and compliance sit: between the business that owns the risk and the audit that checks it. This is written from there. What Swiss information security regulation actually requires, checked against the German text, and what the work itself is like.
Every circular is built the same way, and the parts that decide whether one applies to you are mostly not the parts you would start reading. What the cover page settles, why the table of ticked boxes is not the answer, and where the deadline actually hides.
The board has to approve a disruption tolerance for each critical function and renew it annually. Checked against the circular text, including the three transitional clocks and what the testing requirement really says about tabletop exercises.