While many organizations were still waiting for France’s transposition of NIS2, ANSSI published the ReCyF — Référentiel Cyber France (v2.5) in March 2026. This working document is now the regulatory backbone of what’s coming, well before the formal decree lands.

Here’s what you actually need to understand.

1. This is no longer an IT topic — it’s a leadership topic

The ReCyF is explicit about this: digital security governance now falls under the personal responsibility of the executive in charge. They approve the security policy. They answer for any gaps.

Concretely, that governance framework has to include four things: a defined organization, clear roles and responsibilities for digital security, a process for managing compliance, and a formal information security policy (PSSI). That PSSI isn’t a one-off document, either. Your organization has to review it at least once a year, and it must cover, at minimum, encryption use, physical and logical access control, and the review of security measures already in place.

Cybersecurity has moved up to the executive committee. This time, it’s staying there.

2. Are you an “Entité Importante” (EI) or an “Entité Essentielle” (EE)?

This isn’t just a vocabulary question. The first 15 security objectives apply to both categories equally. Objectives 16 through 20 — formal risk analysis, information system audits, dedicated administration, and security supervision — apply only to EEs.

There’s another distinction worth knowing: only essential entities (EE) must designate a named point of contact for ANSSI, responsible for security incidents and all related communications. Important entities (EI) face no such obligation. In short, your EI/EE status doesn’t just affect your paperwork — it directly determines your compliance workload.

3. The structure of the obligations: What vs. How

The ReCyF separates two levels, and the distinction matters:

• Security objectives: mandatory. They define what you must achieve.
• Acceptable means of compliance: recommended by ANSSI, not mandatory on their own. They define how you can demonstrate that achievement during a control.

Among those means, a valid ISO 27001:2022 certification can demonstrate several objectives at once — governance chief among them. But it only counts for the systems actually covered by the certification’s scope. A certification that covers one business unit doesn’t automatically cover the rest of the organization.

4. The 4 concrete pillars to address

The framework rests on four clear pillars:

• Governance: mapping your information systems, defining your security policy, and controlling your supplier ecosystem.
• Protection: physical access, architecture, identity management, encryption.
• Defense: detecting and responding to incidents.
• Resilience: business continuity and disaster recovery plans, crisis management, and regular exercises.

Each pillar maps to a specific set of the ReCyF’s 20 security objectives, and each objective ties back to an article of the NIS2 directive itself. Nothing here is arbitrary — it’s European law translated into operational requirements.

What this actually changes

Many organizations assumed they could wait. The ReCyF closes that option. It sets a precise framework, with requirements that differ by EI/EE status, ANSSI controls that can happen at any time, and named accountability for the executive in charge.

The question is no longer “do we need to comply?” It’s “where do we start?”

Evaluate your maturity in 15 minutes

Want to assess your maturity against the ReCyF ahead of NIS2? SharpenCISO automates multi-framework pre-audits. You get your report and a preliminary action plan in 15 minutes, not weeks.

🌐 www.sharpenciso.com ✉️ contact@sharpenciso.com

#SharpenCISO #GRC #Cybersecurity #Founders #CISO #RSSI #NIS2 #DORA #ISO27001 #NIST #Compliance #SecurityByDesign