ReCyF is the French cybersecurity framework based on the European NIS 2 Directive. It sets out 20 mandatory security objectives for critical and essential entities and specifies the acceptable means for demonstrating compliance.
The ReCyF is the French cybersecurity framework derived from the European NIS 2 Directive. It defines 20 security objectives for significant and critical entities and specifies the acceptable means for demonstrating compliance.
ReCyF (Référentiel Cyber France) is the national regulatory framework that translates the requirements of the European NIS 2 Directive into concrete measures for cyber risk management.
It consists of two distinct levels:
Safety objectives: These are the regulatory requirements established by decree. Compliance with them is mandatory. They answer the question "What should be done?"
Acceptable means of compliance: these are the specific measures proposed by ANSSI to achieve each objective. Their implementation is not mandatory (an entity may substitute alternative measures), but adopting them makes it easier to demonstrate compliance during an audit. They answer the question "How should this be done?"
The ReCyF is part of the national implementation of the NIS 2 Directive through the Draft Law on Critical Infrastructure Resilience and Strengthening Cybersecurity (PJL).
Its objective is twofold: to provide the entities concerned with a clear and actionable framework for improving their security, and to enable ANSSI to monitor compliance with these requirements in a consistent manner throughout the country.
The ReCyF applies to three categories of entities:
Theyare subject to security objectives 1 through 15. This foundation covers governance, system protection, defense, and basic resilience.
Theyare subject to all 20 objectives—the 15 shared with EIs, plus 5 additional objectives (16 through 20) that require, among other things, a risk-based approach, regular audits, hardened configurations, administration from dedicated resources, and security oversight.
Critical Infrastructure Operators (CIOs) may also be affected with regard to certain information systems, depending on how the LPM and ReCyF frameworks are ultimately aligned.
The principle of proportionality applies: Objectives 16 through 20 apply only to EE, due to their higher level of criticality.
The logic behind ReCyF is based on a clear distinction between the end (the goal) and the means (the way to achieve it).
An entity can demonstrate compliance with a requirement in two ways:
Certain methods also allow organizations to rely on recognized certifications or qualifications: the ISO/IEC 27001:2022 standard and ANSSI-certified services (PASSI, PACS, PAMS, PDIS) constitute acceptable evidence to meet all or part of certain objectives.
ReCyF organizes its 20 objectives around four pillars:
ReCyF is the French operational implementation of the requirements set forth in Article 21 of the NIS 2 Directive, which requires entities to take appropriate measures to manage the risks affecting their networks and information systems.
Each ReCyF security objective corresponds to one or more provisions of NIS 2. For example: OS12 (incident management) corresponds to Article 21.2.b; OS13 (business continuity) corresponds to Article 21.2.c; OS10 (identity management) corresponds to Article 21.2.j.
During an ANSSI audit, an organization may rely on several types of evidence:
Thedocument is currently a working draft (v2.5 dated March 17, 2026). Its final entry into force is contingent upon the publication of the decree issued pursuant to Article 14 of the draft law.
Essential Entitieshave more extensive obligations (20 objectives versus 15) and stricter requirements in certain areas, such as multi-factor authentication, network segmentation, monitoring, and a risk-based approach.
Yes, to some extent. An ISO/IEC 27001:2022 certification can be cited during an audit to demonstrate compliance with the objectives it covers, within the scope of the certification.
This isa specific measure proposed by ANSSI to achieve a specific objective. Its implementation is not mandatory, but if an organization implements it, it can cite it during an audit without having to further demonstrate its relevance.
Yes. When an entity outsources all or part of its information system, the system remains under its responsibility and is not considered a third-party information system as defined by the framework. The obligations therefore apply in full.
ReCyF is the French cybersecurity framework based on the European NIS 2 Directive. It sets out 20 mandatory security objectives for critical and essential entities and specifies the acceptable means for demonstrating compliance.
The Payment Card Industry Data Security Standard (also known as PCI-DSS for short) is a set of security standards designed to ensure that all companies accepting, processing, storing, or transmitting credit card information maintain a secure environment.
In today's cyber landscape, it is no longer enough to simply implement protection solutions. Compliance with standards and regulations has quickly become an essential parameter for ensuring information security—and therefore user confidence. Among these standards is SOC 2 (Service Organization Control 2), which has become indispensable.
