Thirty-eight years. That’s not a real statistic, just an image of how outdated an abandoned public IT system can feel while its legal update stays stuck in committee. It captures the summer we just had.
A second data breach at the French tax authority this year. A third cyberattack in six months at the Ministry of Education. Two different institutions, two different cases, one shared root cause: mismanaged access, not some brilliant zero-day.
Meanwhile, the law meant to strengthen cybersecurity across the French state and its critical businesses keeps sitting untouched. The extraordinary parliamentary session that opened on 1 July did not include the Resilience bill, the legislative vehicle for NIS2 in France. It’s late August now. Parliament is in recess. September is the only date anyone will commit to, the latest in a long line since the European deadline of 17 October 2024.
Twenty-two months behind schedule. The European Commission referred France to the Court of Justice of the European Union on 8 July for this delay, explicitly requesting financial penalties. CESIN, the French association representing CISOs, raised the alarm as early as 19 June: regulatory uncertainty is slowing down cybersecurity investment decisions, at the worst possible moment.
What's uncertain, and what isn't
Three things remain unsettled: the exact date of the vote, the precise sanctions regime, a handful of scope details. On all three, you have no leverage. Waiting changes nothing.
Everything else has been written since 2022.
Directive (EU) 2022/2555 has set this baseline for nearly four years. ANSSI’s French Cyber Framework, published in March, translates it into concrete objectives. No parliamentary debate will make asset inventories, vulnerability management, or the 24-hour incident notification requirement disappear.
What this summer's breaches reveal
Take the Ministry of Education. Three incidents in six months, three different systems, three different entry points. That’s not bad luck. It’s a symptom of a perimeter nobody fully controls anymore, a governance and asset visibility problem, precisely what Article 21 of NIS2 targets.
Take the tax authority. Access obtained through identity theft, a methodical extraction, none of it tripping the usual volume-based alerts. This wasn’t a system breached from outside. It was a legitimate access hijacked, for lack of proper control over who can access what, and behavioral monitoring rather than volume-based monitoring.
Both cases illustrate, better than any statistic could, why asset inventory and access control are the longest workstreams to run. The starting point is almost always wrong. You find active accounts you thought were closed, access rights inherited from a finished project, systems everyone forgot about. Mapping all that takes weeks. Passing a law takes days once it’s on the agenda.
The math is blunt. Waiting for the text to start means accepting a year of delay by the time of the first audit, facing a regulator with no reason to wait for you to catch up.
Four workstreams, one deadline
1. Qualify your status and structure governance
Check your essential or important entity status on MonEspaceNIS2, document the scope, subsidiaries included.
Owner: CISO and leadership. Effort: one day. Proof: a dated memo.
2. Map access rights and exposed attack surface
Run a review of privileged accounts and dormant access, starting with what’s visible from the internet.
Owner: CISO and IT. Effort: a few days. Proof: an up-to-date access register.
3. Build continuous detection and monitoring
Identify which systems and accounts need priority monitoring, the ones that, left unsupervised, enabled the silent extractions seen this summer.
Owner: CISO and SOC. Effort: varies by scope. Proof: a documented monitoring plan.
4. Train leadership and frontline teams alike
Add a cyber briefing to the next board meeting, with concrete numbers. Schedule an awareness session for the most exposed teams.
Owner: leadership and CISO. Effort: two hours for the board, an awareness program to build. Proof: meeting minutes and a training calendar.
The same bill also transposes the CER directive on critical infrastructure resilience. The delay carries a double stake. Whoever handles inventory and access now gets ahead on both fronts at once.
These four workstreams aren’t abstract categories. They mirror how Stroople is organized: Offensive Security to reveal what’s exposed, Managed Security to watch it around the clock, Cyber Advisory & GRC to turn that into governance a regulator can verify, and Learning to turn your teams into a first line of defense rather than a way in. We’re built this way because compliance was never really the goal. It’s what happens once an organization has done the slower, harder work of becoming genuinely resilient, work that takes months, not a signature. Start wherever your gap is widest. That’s where we can help first.
Move toward NIS2 compliance with the support of our cybersecurity experts
Our experts support you at every stage, from assessing your obligations to implementing the required security measures.
Share:
Related Posts
NIS2 Transposition Delay: Why Waiting Is Costing France Already
Thirty-eight years. That’s not a real statistic, just an image of how outdated an abandoned…
What If the NIS2 Directive Were Already Just a Minimum Baseline?
What if, after so much waiting, NIS2 became an outdated baseline before it was even…
NIS2 in France: The Gap the ReCyF Exposes
An IT contractor leaves the company. Are their access rights revoked the same day? Their…