NIS 2 in France: understanding the directive, anticipating compliance, and assessing its impact

The NIS 2 Directive has a clear ambition: strengthening cybersecurity across the European Union. It significantly expands the scope of the previous NIS Directive and now applies to 18 sectors of activity. In France, transposition is still underway, but the direction is already clear: in-scope organisations will be required to implement appropriate risk management measures, report significant incidents, and demonstrate their level of preparedness.

The directive distinguishes between two categories of entities: Essential Entities (EE) and Important Entities (IE). This distinction reflects a principle of proportionality: the level of expected requirements depends on the organisation’s criticality, size, and, in some cases, revenue.

Companies can assess whether they fall within the regulatory scope using the simulator made available by ANSSI.

To support practical implementation, ANSSI has also published ReCyF (“Référentiel Cyber France”), a framework translating NIS 2 requirements into concrete operational security objectives.

Understanding NIS 2: three core obligations, four foundational pillars

To approach NIS 2 without immediately delving into legal detail, two reference points are useful. First, the directive revolves around three primary obligations:

• provide specific information to the competent authority;
• implement appropriate cybersecurity risk management measures;
• report significant security incidents

Second, ReCyF provides a highly operational framework structured around four major pillars:
 

Governance - Protection - Defence - Resilience 

This analytical framework is particularly useful: NIS 2 is not limited to deploying appropriate technical tools. Above all, the directive expects organisations to demonstrate their ability to manage cybersecurity strategically, reduce risk exposure, respond effectively to incidents, and maintain operational continuity during a crisis.

The four key pillars

Governance 

NIS 2 clearly brings cybersecurity into the scope of executive accountability. The topic is no longer solely the responsibility of IT departments or technical teams: management bodies are expected to approve implemented measures, monitor their deployment, and ensure that the cybersecurity strategy is effectively governed.

Within ReCyF, this pillar notably covers digital security governance, asset inventory management, ecosystem oversight, and integration of cybersecurity considerations into HR processes. For Essential Entities, it also includes risk-based approaches and information system audits.

Protection

This pillar encompasses measures aimed at reducing organisational exposure to cyber threats. It includes securing remote access, protection against malicious code, identity and access management, and privileged administration control.

In practical terms, these safeguards aim to limit both the likelihood and the potential impact of incidents.

Defence

Even with robust protection mechanisms in place, organisations must assume that incidents may occur. NIS 2 therefore requires the ability to detect, assess, respond to, and report incidents through a structured process.

Within ReCyF, this logic is reflected in objectives relating to incident identification and response, as well as — for Essential Entities — security monitoring of information systems.

Resilience

The final pillar is often the most tangible for executive leadership: what happens if a major incident occurs despite preventive measures?

NIS 2 expects organisations to be able to back up their data, restore systems, resume operations, and manage cyber crises effectively. ReCyF addresses backup strategies, business continuity, disaster recovery, crisis management, and testing exercises.

The regulation does not only aim to prevent incidents — it also requires organisations to remain operational when they occur.

ISO 27001 and NIS 2: differences and complementarities in achieving compliance

ANSSI’s comparative mapping shows strong alignment between ISO 27001 / ISO 27002 and a significant portion of ReCyF expectations, particularly in areas such as governance, security policies, roles and responsibilities, supplier risk management, backup procedures, business continuity, audit processes, and risk-based approaches.

ANSSI provides a detailed correspondence table mapping ReCyF NIS 2 requirements against ISO 27001 controls.

However, the expected level of implementation is not identical. ReCyF is often more prescriptive in how measures should be applied. For example, it requires:

• at least annual review of the Information Security Policy (PSSI);
• backup testing at least once per year;
• risk analysis review at least every three years;
• explicit periodic reviews of specific control mechanisms;

Where ISO standards allow flexibility in organisational implementation, the NIS 2 framework more frequently defines a specific cadence or structured baseline.

The comparison also highlights differences in scope. Under ISO 27001, risk management measures apply primarily to the ISMS scope defined by the organisation. Under ReCyF, compliance assessment covers the entity’s entire information system and is not limited to a self-defined perimeter.

The same operational logic applies to requirements such as:

• ecosystem mapping;
• maintenance of contact points;
• account deactivation timelines;
• periodic review of accounts and privileges;
• communication filtering based on a default-deny approach

Another key point: several ReCyF measures explicitly refer to ANSSI guidance, particularly regarding encryption of remote access, authentication mechanisms, privileged administration, and compensating controls where standard requirements cannot be fully implemented. ISO 27001 and ISO 27002 establish principles, but do not typically prescribe implementation at this level of national specificity.

Finally, the ANSSI document shows that certain ReCyF expectations are only partially covered — or not explicitly addressed — by ISO 27001 and ISO 27002. Examples include cyber crisis management frameworks, dedicated training and simulation exercises, securing directory trust anchors, implementing segregated administration networks, and certain requirements related to security monitoring.

At first glance, NIS 2 may appear highly technical, but its underlying message is straightforward: in-scope organisations must improve cybersecurity governance, strengthen system protection, enhance incident response capabilities, and ensure operational continuity.

In France, ReCyF provides a concrete translation of these expectations. For organisations already engaged in DORA or ISO 27001 initiatives, the appropriate approach is not to start from scratch, but to identify which existing components can be reused, reinforced, or adapted as part of a coherent compliance roadmap.