The EU’s NIS2 directive (Network and Information Security 2) significantly raises the cybersecurity bar for a wide range of organizations across Europe — well beyond the large operators already covered by the original NIS directive. In France, its implementation goes through a national law still being finalized: here’s where things stand and how to get moving without waiting for the final legislative green light.
What NIS2 changes
Compared to the original NIS directive, NIS2 significantly widens the scope of covered sectors (energy, health, transport, digital infrastructure, but also public administration, waste management, manufacturing, and many others) and introduces two categories of organizations: essential entities and important entities, with obligations proportional to their criticality. The text places particular emphasis on three points: leadership accountability for security governance, rapid reporting of significant incidents to the authorities, and supply chain security (your providers and subcontractors are now part of the scope to secure).
Where France stands
NIS2’s transposition into French law is happening through the Résilience bill, which covers NIS2 together with DORA (digital operational resilience for finance) and the CER directive (critical entities resilience). The final adoption timeline is still to be confirmed — we recommend following ANSSI’s official updates rather than a fixed date, as things are evolving regularly.
While waiting for the final text, ANSSI has made available the Référentiel Cyber France (ReCyF), which lists the recommended security measures to meet NIS2’s objectives. This framework isn’t mandatory in itself, but organizations that rely on it now will be able to point to it during future audits — making it an excellent starting point for structuring a compliance effort without delay.
Am I affected?
With the broader scope of covered sectors, far more mid-sized and small businesses than before will fall within NIS2’s scope — either directly, or indirectly as a supplier to an essential or important entity. ANSSI offers a self-assessment tool, MonEspaceNIS2, to get an initial sense of your status. It’s a good starting point, to be confirmed afterward with dedicated support if the result is positive or unclear.
Where to start, concretely
– Assess your status (essential entity, important entity, or supplier to a covered entity) using ANSSI’s MonEspaceNIS2 tool.
– Map your critical information systems and your main suppliers/subcontractors.
– Compare your current practices against the Référentiel Cyber France (ReCyF) to identify gaps.
– Set up (or test) a procedure for detecting and quickly reporting incidents.
– Involve leadership: NIS2 puts accountability on governing bodies, not just the IT department.
Getting ahead of this now avoids scrambling to comply once the text is formally adopted — and it’s often, in itself, a good opportunity to modernize your security posture.