What if, after so much waiting, NIS2 became an outdated baseline before it was even passed into law? Not outdated through excessive rigor, but by default: the directive sets a minimum baseline for cybersecurity, while attacks, meanwhile, wait for no enactment.
On 8 July 2026, the European Commission referred four member states to the Court of Justice of the European Union for failing to transpose NIS2: France, Spain, Ireland and the Netherlands. In France, the deadlock centers on Article 16 bis of the Resilience bill, which would prohibit the state from requiring encrypted communication providers to build in backdoors. This clause, specific to the French text, pits a senator and part of the cybersecurity community against domestic intelligence services.
This disagreement has, however, changed nothing about a message ANSSI has repeated for months: the legislature’s delay must not become the organizations’ delay. That is precisely where the opportunity NIS2 represents lies, provided one understands what the directive actually requires, and what it merely touches on.
Should Organizations Wait for NIS2 to Pass Before Acting?
No. ANSSI has said so publicly on several occasions: the legislative delay does not change the need for concerned businesses to structure their security now around the objectives of the French Cyber Framework (ReCyF).
ReCyF, published as a working document on 17 March 2026, already details twenty security objectives across four pillars. It will not become legally binding until the law is enacted, but it already serves as the reference the agency will use during future inspections. Waiting for the decree to start is like waiting for the exam to open the textbook.
Why So Many Organizations Haven't Started Yet
This gap comes down to three structural causes, widely shared across organizations.
Regulatory overload is one of them. NIS2, DORA, GDPR and soon the AI Act overlap, each with its own scope and deadlines, which makes prioritization difficult for a mid-sized legal department or IT team.
Budget pressure weighs just as heavily. Structuring security governance, mapping suppliers, or testing business continuity requires an investment rarely provisioned in advance, especially when every line of spending is scrutinized.
Legislative uncertainty has, finally, produced a paradoxical effect. Several organizations chose to freeze investment while waiting for a final text, an understandable caution that now works against them as the delay drags on.
What Sets an Organization That's Getting Ahead Apart
Some organizations treat NIS2 as a text to monitor until it becomes law. Others already apply its principles, without waiting for a decree to force their hand. This choice, seemingly minor, produces gaps that are measured in months, sometimes years, the day an incident occurs.
This difference rarely shows up in leadership speeches. Instead, it lives in operational details, how a service contract was written, how often a crisis plan is actually tested, or how quickly a decision can be made outside business hours. These details, taken one by one, are what separate an organization that gets ahead from one that merely reacts.
NIS2: A Minimum Baseline, Not a Ceiling
The directive imposes a common baseline on all essential and important entities. That baseline deserves to be seen for what it truly is: a minimum calibrated against a snapshot of the threat landscape from when the text was adopted in late 2022, not against today’s.
ANSSI’s Panorama de la cybermenace 2025, published on 11 March 2026, illustrates this gap. The agency handled 3,586 security events over the year, with a clear shift in how attackers operate. Ransomware compromises fell slightly, from 141 to 128 recorded cases, but data exfiltration incidents jumped by more than 50%, rising from 130 to 196 cases. A properly backed-up system allows encrypted files to be restored. It does not, however, undo the publication of data already stolen. Yet the minimum continuity measure required by NIS2 remains built first around the encryption scenario, less around silent theft.
The speed of vulnerability exploitation has also changed in nature. According to the same report, nearly 29% of vulnerabilities exploited in 2025 were exploited the very day they were disclosed, or even before, as illustrated by campaigns against Ivanti Connect Secure VPN devices via the CVE-2025-0282 and CVE-2025-0283 flaws. The minimum patch management measure required by NIS2 assumes a reasonable window to apply a fix. That reasonable window barely exists anymore for internet-facing devices.
ANSSI also notes a growing blur between state-sponsored actors and financially motivated cybercriminal groups, which complicates defenses designed around a single attacker profile.
Each family of measures shown above answers a concrete operational question, not an administrative checkbox. Yet by design, they remain a regulatory floor set several years ago. An organization that builds its security for its own business continuity naturally goes beyond that floor along the way. An organization that aims only for compliance risks stopping exactly at that floor, at the very moment attackers have already changed their methods.
What Others Are Already Doing
Pressure will not come from ANSSI alone. Large corporations subject to NIS2 as essential entities, as well as those already subject to DORA in the financial sector, have not waited for the final version of the text to raise their own requirements toward suppliers.
In practice, this translates into security clauses built into contracts, cyber maturity questionnaires sent ahead of a tender, and compliance audits required before a contract is even signed. A company approached by a large regulated client is receiving, or will soon receive, this kind of questionnaire. An insufficient answer does not just jeopardize regulatory compliance, it jeopardizes the contract itself.
Cyber insurers are following a similar trend, gradually factoring an organization’s security maturity into coverage terms. This still-emerging shift is drawing an unofficial deadline that often arrives ahead of the legal one.
Where to Start, Concretely
Before investing in AI-powered technologies, it makes more sense to go back to the reference text on the subject rather than improvise a list of best practices.
For an organization operating only in France, that reference text is ReCyF. Its twenty security objectives, spread across four pillars, governance, protection, defense and resilience, are enough to structure a full roadmap without needing another framework.
For an organization present in several European countries, however, ReCyF is not enough: each member state implements NIS2 within its own national framework. This is precisely where the mapping table published by ENISA becomes useful. It links the European Commission’s Implementing Regulation (EU) 2024/2690, which sets the technical baseline common to the whole Union, to national frameworks (ReCyF in France, CyFun in Belgium, ENS in Spain, among others) as well as to widely adopted standards such as ISO 27001 and the NIST Cybersecurity Framework. An organization already certified to ISO 27001 therefore covers, without realizing it, a significant share of NIS2’s requirements, regardless of the country it operates in.
Either way, four workstreams deserve immediate priority, ahead of the others that later structure the roadmap.
- Governance and risk management, with a formalized security policy and a recognized risk analysis method, such as EBIOS Risk Manager or ISO 27005.
- Incident management, from detection to notification, the area most directly exposed to an ANSSI inspection.
- Business continuity, backups and recovery plans tested under real conditions rather than merely documented, and designed for a data-theft scenario as much as an encryption one.
- Supply chain security, with an inventory of suppliers ranked by criticality.
Preparing for an Upgrade That Could Be Substantial
Some organizations will find, once they start this work, only a limited gap with ReCyF’s objectives. Others will uncover a deeper undertaking, touching governance, network architecture or identity management. This second scenario is not an exception, it reflects years in which security followed the growth of the business without always receiving a proportional investment.
Key takeaway: ANSSI has said it unambiguously, the legislature’s delay must not become the organizations’ delay. The question is not whether NIS2 will apply, but since when a company will have started preparing, on a baseline that will necessarily evolve beyond its current minimum.
Structuring this trajectory starts with an honest diagnosis of the current gap, followed by a response capability available whenever an incident occurs, not only during business hours.
Whatever the size of that gap, Stroople accompanies organizations through every stage of it: offensive security to expose real weaknesses before attackers do, advisory and GRC to structure governance and crisis readiness, managed security to provide round-the-clock detection and response, and learning programs to turn every employee into a line of defense.
Move toward NIS2 compliance with the support of our cybersecurity experts
Our experts support you at every stage, from assessing your obligations to implementing the required security measures.
Share:
Related Posts
NIS2 Transposition Delay: Why Waiting Is Costing France Already
Thirty-eight years. That’s not a real statistic, just an image of how outdated an abandoned…
What If the NIS2 Directive Were Already Just a Minimum Baseline?
What if, after so much waiting, NIS2 became an outdated baseline before it was even…
NIS2 in France: The Gap the ReCyF Exposes
An IT contractor leaves the company. Are their access rights revoked the same day? Their…