An IT contractor leaves the company. Are their access rights revoked the same day? Their cloud permissions, removed? Their presence in SaaS integrations, deleted? In most French mid-sized companies, the honest answer is no, maybe, or we are not entirely sure.
This kind of situation, ordinary and well-documented, is precisely what the Référentiel Cyber France is about to make legally unacceptable. Published by ANSSI, the French national cybersecurity agency, in version 2.5 dated 17 March 2026, the ReCyF is the operational reference for the French transposition of the NIS2 directive (Network and Information Security, second version). This working document is not yet legally binding, the bill on critical infrastructure resilience is still being adopted. But its level of detail is advanced enough for every concerned organisation to know exactly what is coming.
The gap between what organisations do today and what the ReCyF requires is wide. And it is measurable.
What the ReCyF Is, and Who It Applies To
The framework structures twenty security objectives across four pillars: governance, protection, defence and resilience. The first fifteen apply to all important and essential entities under NIS2, estimated at several thousand organisations in France spanning sectors as varied as banking, healthcare, energy, transport, digital services and manufacturing. The final five apply only to essential entities, subject to the most demanding requirements.
Each objective answers the question “what to do.” The acceptable means of compliance proposed by ANSSI answer the question “how to demonstrate it during an inspection.” This second level is critical: ANSSI will not settle for a statement of intent. It will verify evidence.
What many organisations have not yet factored in is that pressure will not come from ANSSI alone. Large corporations subject to NIS2 as essential entities, like those already subject to DORA (Digital Operational Resilience Act), the European regulation on digital operational resilience for the financial sector in force since January 2025, have not waited for the final version of the ReCyF to raise their own standards. And they will not stop at their own walls.
DORA requires banks, insurers and payment institutions to map their critical technology providers, integrate precise security clauses into their contracts, and periodically verify supplier compliance. These obligations do not stay within legal departments. They flow into tenders, contracts and supplier qualification questionnaires. A mid-sized company providing IT services, software development or consulting to a bank is already receiving, or will very shortly receive, a cybersecurity maturity questionnaire from that client. If its answers fall short, the contract is at risk, not just its regulatory compliance status.
NIS2 will replicate this dynamic at a far broader scale. Being a subcontractor or partner of a NIS2 essential entity without a documented security posture exposes a company to commercial exclusion before any ANSSI inspection is even on the horizon.
The First Gap: Governance Belongs to the CEO, Not the CIO
Most mid-sized companies today manage cybersecurity something like this: a CIO or an IT provider handles the topic, escalates alerts when needed, and the rest of management considers the matter resolved. The ReCyF closes that door.
Objective 2 is explicit: the digital security governance framework is placed under the responsibility of the executive director. They approve the information systems security policy. They validate the compliance action plan. They answer for it during an ANSSI inspection.
This shift is not symbolic. NIS2 provides for sanctions of up to 10 million euros or 2% of global turnover for essential entities, and personal liability for executives in cases of repeated serious breaches. The ReCyF translates this responsibility into concrete, documented, verifiable obligations.
For a company whose CEO has never approved a single security policy document, this is a change of posture, not a technical adjustment.
Second Gap: Your Suppliers Are Part of Your Extended Attack Surface
Objective 3 requires organisations to map all IT service providers and suppliers involved in their operations, identify a point of contact for each, and ensure through contractual means that their security practices meet the organisation’s own obligations. Objective 10 extends this workstream inside the information system itself: individual accounts for every user and automated process, access rights strictly limited to operational need, and an annual review of all active permissions.
Both obligations point to the same blind spot. In practice, most mid-sized companies do not know precisely what access their providers have on their systems, whether those accesses are documented, or whether their contracts contain any verifiable security clause. They know even less how many internal accounts are active but unused, created for a project that ended or registered to an employee who left months ago.
A study conducted in 2025 on 680,000 cloud accounts analysed during incident response engagements found that 99% had excessive access rights, some unused for more than 60 days. This is not a sector-specific anomaly. It is the mechanical consequence of ordinary operations: every new hire, every role change, every new project generates permissions. Without a systematic revocation process, those permissions accumulate. Nobody removes them because nobody has a complete list.
One documented incident from 2025 shows what this enables in practice: attackers used valid access tokens from an integration between two commercial tools to gain entry into a target company’s environment. The post-incident investigation revealed that the company had nearly 100 active third-party connections in its systems, many dormant, some registered to former employees. Nobody had a complete list. The ReCyF makes this situation non-compliant.
Third Gap: Resilience Is Tested, Not Improvised
Objective 13 requires backups tested at least once a year and protected against ransomware through offline storage. Objective 15 requires regular exercises. For essential entities, a three-year training programme covering incident management, cyber crisis response and business continuity.
These two objectives point to an uncomfortable reality: many organisations believe they have a recovery plan because they have backups. They discover during an actual incident that restoration fails, that backups were also encrypted by the ransomware, or that nobody knows precisely how to activate the crisis plan. Data from incident response engagements in 2025 shows that in 26% of extortion cases, attackers had compromised the backups. The ReCyF anticipates this scenario by making testing mandatory and documented.
Fourth Gap: Detection Cannot Be Delegated Without a Decision
Objective 12 requires an organisation, processes and tools to identify and respond to security incidents. For essential entities, Objective 20 goes further: continuous security monitoring capable of processing logs and security events within 24 hours, with a minimum retention period of three months.
This is the most demanding obligation in the framework in terms of detection capability. For a mid-sized company without a dedicated team, it means either hiring or outsourcing to an ANSSI-qualified detection provider. Neither option is set up in a matter of weeks. Essential entities that have not yet started this workstream are accumulating structural delay.
Four Questions Every Executive Should Be Able to Answer
The ReCyF is not a document to file away pending the final version. It is the most precise picture currently available of what ANSSI will verify during inspections. And the pressure will not come from ANSSI alone: it will come, likely sooner, from large clients already cascading these requirements through their supply chains.
The starting point comes down to four questions every executive should be able to answer without hesitation. Who is responsible for digital security in my organisation, and is it formalised? Do I have a complete list of my providers and their access rights? Were my backups tested this year? And if a major incident occurred tonight, who calls whom, in what order?
If any of those answers is unclear, the ReCyF has identified a gap. This is exactly the kind of assessment that Stroople, holder of the Expert Cyber label awarded by Cybermalveillance.gouv.fr, conducts for mid-sized companies seeking to turn this regulatory constraint into an operational security posture.
Key Takeaways
- The ReCyF version 2.5 of 17 March 2026 is the operational reference for NIS2 in France. A working document, not yet binding, but advanced enough to start preparing now.
- Pressure will not come from ANSSI alone. Large corporations subject to NIS2 and DORA are already cascading these requirements to their providers and subcontractors through contracts and qualification questionnaires.
- Four priority workstreams for any concerned organisation: formalised governance under CEO authority, mapping of third-party access, annual review of user rights, documented continuity testing.
Source: ANSSI, ReCyF version 2.5 dated 17 March 2026, working document on the French transposition of the NIS2 directive.
Stroople, holder of the Expert Cyber label awarded by Cybermalveillance.gouv.fr, supports mid-sized and regulated companies in their NIS2 compliance journey and security posture structuring.
Move toward NIS2 compliance with the support of our cybersecurity experts
Our experts support you at every stage, from assessing your obligations to implementing the required security measures.
