France’s national cybersecurity agency, ANSSI, has just opened the NIS2 pre-registration portal. On the very same 24 November 2025, Germany announced the full transposition of NIS2 into national law. Several other EU Member States — including the Netherlands, Denmark, Finland, Estonia and Lithuania — have already completed their transposition, while France is only entering the initial operational phase.
With NIS2, the number of regulated entities in France will surge from roughly 600 to nearly 15,000. The shift is profound, affecting sectors that historically operated outside cyber-regulatory obligations: local authorities, healthcare providers, industrial companies, transport operators, digital service providers and consulting firms exceeding certain thresholds.
What NIS2 Changes for Executives
NIS2 represents a major shift. It replaces prescriptive checklists with a continuous, risk-driven approach aligned with each organisation’s operations, dependencies and critical processes.
Security Becomes Fully Integrated
The directive covers IT, OT and physical security. A compromised badge, uncontrolled access to technical rooms or a shared workstation can now trigger impacts comparable to a classic cyberbreach. Strong authentication, systematic encryption, continuous monitoring and centralised identity management (IAM/PAM) become foundational requirements. Access must now be designed as a continuum — from the physical entry point to administrative privileges.
The Supply Chain Becomes a Business Risk
The latest ENISA Threat Landscape 2025 shows that 10.6% of cyberattacks in Europe originate from the supply chain. SaaS vendors, hosting providers, managed service providers, software developers and OT operators can all become vectors for sophisticated attacks.
NIS2 therefore requires active vendor oversight: assessments, strengthened contractual clauses, evidence-based controls, vulnerability monitoring and shared governance with critical suppliers. Third-party risk management is no longer optional — it is a core continuity challenge.
Incidents Become a Governance Matter
Organisations must detect, qualify and notify incidents within 24 hours. This demands solid internal structures: defined responsibilities, escalation pathways, investigation capabilities, integrated supervision (SOC, CIO, CISO) and coordination with top management and communications teams. Responsiveness is now both a regulatory obligation and a resilience capability.
Why Pre-Registration Matters
The ANSSI portal is not a basic form. It is the foundational brick of NIS2 compliance: inventory of sites, networks, domains, IP ranges, operational contacts and activities. These data points will underpin all future obligations: access governance, supplier supervision, incident reporting and interaction with authorities.
Pre-registration forces organisations to clarify their perimeter, governance model and critical assets. It is a structuring step before the law comes fully into force.
A key warning is needed: pre-registration does not constitute validation or approval by ANSSI. It is not a certification of compliance or maturity. It is a preparatory step, nothing more.
Executives should take this moment to launch a structured effort across three areas: detailed mapping of critical dependencies, updated cybersecurity clauses in contracts, and objective assessment of key suppliers — especially those handling sensitive data or supporting essential business functions.
NIS2 is no longer about documentation; it is about real control of the ecosystem.
NIS2: A Constraint, but Also a Strategic Opportunity
Beyond regulatory pressure, NIS2 enables organisations to strengthen resilience, improve third-party oversight, modernise identity management, integrate physical security into cybersecurity governance and enhance operational monitoring.
France’s pre-registration launch sends a clear message: the work must begin now.
For executives, NIS2 is not a compliance task — it is a strategic investment in operational continuity and digital trust.
Move toward NIS2 compliance with the support of our cybersecurity experts
Our experts support you at every stage, from assessing your obligations to implementing the required security measures.
Share:
