---
schema: 1
kind: policy
title: "Canton Aargau adopts its information-security ordinance (InfoSiV) and sets 1 January 2027 for the information-security law and ordinance, with a specialist unit to receive directive and enforcement powers and a cyber coordination office at the cantonal police"
headline: "Aargau's information-security law and ordinance take effect 1 January 2027; a specialist unit is to get directive powers"
summary: >
  The Aargau government council announced on 2026-11-06 that it adopted the information-security ordinance (InfoSiV) and that the information-security law (InfoSiG) and the ordinance enter into force on 1 January 2027. An information-security specialist unit is to advise cantonal bodies with directive and enforcement powers, and a cantonal cyber coordination office, headed from that date by Bernhard Droz, and a personnel-security-vetting unit sit at the cantonal police.
discovered_at: "2026-11-07T04:02:00Z"
updated_at: null
event_date: "2026-11-06"
run_id: 2026-11-07T0256Z-intel
priority: routine
immediate_action: null
tags: [policy]
regions: [switzerland]
sectors: [public-sector]
entities: ["policy:aargau-infosig-infosiv-2026"]
techniques: []
affected_products: []
cves: []
sources:
  - url: "https://www.ag.ch/de/medien/medienmitteilungen?mm=bulletin-zur-regierungsratssitzung-b790d5a8-ec12-4162-98c6-daac664c6033_de"
    publisher: "Kanton Aargau, Departement Finanzen und Ressourcen (Bulletin zur Regierungsratssitzung)"
    date: "2026-11-06"
    role: primary
  - url: "https://www.netzwoche.ch/news/2025-02-24/kanton-aargau-will-cybersicherheit-staerken"
    publisher: "Netzwoche"
    date: "2025-02-24"
    role: corroborating
closed_sources: []
evidence:
  - quote: "The Government Council has adopted the ordinance on information security (InfoSiV) and at the same time decided that the information-security legislation (InfoSiG and InfoSiV) comes into force on 1 January 2027. (translated from German)"
    original: "Der Regierungsrat hat die Verordnung über die Informationssicherheit (InfoSiV) verabschiedet und gleichzeitig die Inkraftsetzung der Informationssicherheitsgesetzgebung (InfoSiG und InfoSiV) auf den 1. Januar 2027 beschlossen."
    publisher: "Kanton Aargau"
    source_url: "https://www.ag.ch/de/medien/medienmitteilungen?mm=bulletin-zur-regierungsratssitzung-b790d5a8-ec12-4162-98c6-daac664c6033_de"
  - quote: "An information-security specialist unit is to advise the cantonal bodies and be equipped with powers to issue directives and to enforce, so that an effective, uniform detection and defence strategy can be implemented. (translated from German)"
    original: "Eine Fachstelle für Informationssicherheit soll die kantonalen Stellen beraten und mit Weisungs- und Durchsetzungsbefugnissen ausgestattet werden, um eine schlagkräftige einheitliche Erkennungs- und Abwehrstrategie umsetzen zu können."
    publisher: "Kanton Aargau"
    source_url: "https://www.ag.ch/de/medien/medienmitteilungen?mm=bulletin-zur-regierungsratssitzung-b790d5a8-ec12-4162-98c6-daac664c6033_de"
verification: single-source
sourcing_note: >
  Single source, the canton's own communiqué, which is the primary source for its own legislation. The communiqué does not give the date of the government meeting, and its wording is that the specialist unit is to be equipped with directive and enforcement powers, so the powers are the canton's stated plan.
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions: []
updates: []
migrated_from: null
---

The Aargau government council adopted the information-security ordinance (InfoSiV) and decided that the information-security legislation, the law (InfoSiG) and the ordinance, enters into force on 1 January 2027 (translated from German) ([Kanton Aargau, 2026-11-06](https://www.ag.ch/de/medien/medienmitteilungen?mm=bulletin-zur-regierungsratssitzung-b790d5a8-ec12-4162-98c6-daac664c6033_de)). The canton says the law anchors uniform standards and a holistic information-security system in the cantonal administration, that an information-security specialist unit is to advise the cantonal bodies and be equipped with directive and enforcement powers so that one detection and defence strategy can be implemented, and that a further specialist unit for personnel security vetting and a cantonal cyber coordination office are being set up, both at the cantonal police (translated from German) ([Kanton Aargau, 2026-11-06](https://www.ag.ch/de/medien/medienmitteilungen?mm=bulletin-zur-regierungsratssitzung-b790d5a8-ec12-4162-98c6-daac664c6033_de)). The government elected Bernhard Droz, currently head of IT forensics and cybercrime at the cantonal police, as head of the cyber coordination office from 1 January 2027 (translated from German) ([Kanton Aargau, 2026-11-06](https://www.ag.ch/de/medien/medienmitteilungen?mm=bulletin-zur-regierungsratssitzung-b790d5a8-ec12-4162-98c6-daac664c6033_de)).

The communiqué says nothing about communes or other bearers of public tasks. In February 2025 Netzwoche reported that a majority in the consultation approved bringing them into the law's scope and that entry into force was then planned for 1 July 2026, so the final text decides whether communal bodies are bound ([Netzwoche, 2025-02-24](https://www.netzwoche.ch/news/2025-02-24/kanton-aargau-will-cybersicherheit-staerken)).

**Exposure:** Aargau cantonal bodies from 1 January 2027; whether communes and other bearers of public tasks fall in scope is not stated in the communiqué.

**Defender takeaway:** from 1 January 2027 Aargau cantonal bodies answer to one information-security specialist unit that is to be equipped to issue binding directives, so the 2026 task is reading the ordinance and the directives the specialist unit issues; the canton describes the unit's planned powers and not detailed duties, and communal IT owners should read the final text to see whether they are covered.