The RGS was designed in a context wherethe French administration is becoming increasingly digitized: online services are becoming—for better or worse—a preferred channel for interactions between the state and citizens, businesses, and other public entities. This digital transformation has made it necessary to establish a robust security framework to protect sensitive data from cyberattacks, data leaks, and falsification.
This standard is mandatory for all public administrations in France. It applies to:
- all government departments,
- local authorities,
- public institutions,
- digital service providers that process data on behalf of these entities.
The whole point of the RGS is to define the minimum IT security requirements that these entities must comply with.
It is part of a broader approach to securing the government's digital ecosystem.
What does the General Security Reference Guide contain?
The RGS is structured around four main areas, often referred to by the acronym DICA.
- Availability: ensuring that the services concerned are accessible and operational whenever necessary. This requirement involves implementing measures to prevent service interruptions, such as the well-known denial-of-service (DDoS) attacks.
- Integrity: ensuring that information is not modified or altered in an unauthorized manner. Please note: this applies to both data in transit and stored data!
- Confidentiality: protecting sensitive information from unauthorized access through data encryption and strict access management.
- Authenticity: verify the identity of the actors (users, systems) involved in exchanges to ensure that the information does indeed come from the stated source.
The issue of security levels
The RGS establishes several security levels based on the criticality of the information systems and data processed. Each level is then associated with a set of specific technical and organizational requirements.
These requirements cover a (very) wide range of areas: identity and access management, communications protection, security incident management, business continuity, etc.
This security level classification system allows administrations to choose the measures best suited to their needs based onthe potential impact of a compromise of their information system.
How to comply with the RGS?
RGS certification is issued bythe French National Cybersecurity Agency (ANSSI), which is the authority responsible for implementing the standard. This certification attests that the solutions in question comply with RGS security requirements.
Good news: RGS is now available in Tenacy! You can now get guidance on compliance thanks to automatically generated action plans and easy tracking of your initiatives.
