ANSSI Cybersecurity Framework

France

v2023

16 domains

23 controls

French National Cybersecurity Agency framework

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (16)

Audit

1 controls

Controls in the Audit domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-PASSI	PASSI Qualified Audit Providers	Security audits of sensitive systems should be performed by PASSI qualified providers covering 5 audit families.

Cloud Security

1 controls

Controls in the Cloud Security domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-SECNUMCLOUD	SecNumCloud Qualification	Cloud service providers serving French sensitive workloads should hold SecNumCloud qualification covering security, sove...

Critical Infrastructure

2 controls

Controls in the Critical Infrastructure domain of ANSSI Cybersecurity Framework — 2 controls
Code	Title	Description
ANSSI-LPM-OIV	LPM OIV Obligations	Operators of Vital Importance comply with sectoral security rules, incident reporting, and ANSSI inspection.
ANSSI-NIS2-OSE	NIS2 OSE Obligations (France Transposition)	Essential and important entities under NIS2 French transposition implement cybersecurity measures and incident notificat...

Cryptography

1 controls

Controls in the Cryptography domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-CRYPTO	Cryptography Recommendations	Use ANSSI-recommended algorithms, key sizes, and protocols for protecting data confidentiality and integrity.

Cyber Hygiene

5 controls

Controls in the Cyber Hygiene domain of ANSSI Cybersecurity Framework — 5 controls
Code	Title	Description
ANSSI-HYGIENE-01	Information Systems Inventory	Maintain an up-to-date inventory of information systems, hardware, software, and network assets.
ANSSI-HYGIENE-02	User Authentication	Implement strong authentication with unique accounts, robust passwords, and multi-factor for sensitive access.
ANSSI-HYGIENE-03	Workstation Security	Workstations are hardened, patched, equipped with antivirus, and configured with least privilege.
ANSSI-HYGIENE-04	Network Segmentation	Segment networks to limit lateral movement and separate sensitive zones from general user network.
ANSSI-HYGIENE-05	Remote Access Security	Secure remote access via VPN with strong authentication, encryption, and endpoint compliance checks.

Detection

2 controls

Controls in the Detection domain of ANSSI Cybersecurity Framework — 2 controls
Code	Title	Description
ANSSI-HYGIENE-07	Logging and Monitoring	Collect and retain security logs centrally with correlation and alerting on suspicious activities.
ANSSI-PDIS	PDIS Security Incident Detection Providers	Detection service providers (SOC) serving OIV/OSE should hold PDIS qualification.

Governance

1 controls

Controls in the Governance domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-HOMOLOG	Security Homologation Decision	Authority responsible decides to authorise operation of a system based on residual risk acceptance.

Identity

1 controls

Controls in the Identity domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-PVID	PVID Identity Verification Providers	Identity verification providers serving regulated French use cases follow PVID requirements with ANSSI qualification.

People

1 controls

Controls in the People domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-HYGIENE-10	Awareness and Training	Provide regular cybersecurity awareness for all staff with role-specific training for IT and administrators.

Privileged Access

1 controls

Controls in the Privileged Access domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-HYGIENE-06	Administration Workstations	Privileged administration uses dedicated, hardened workstations isolated from general internet and email.

Public Sector

1 controls

Controls in the Public Sector domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-RGS	RGS Security General Reference	French public administration information systems comply with the RGS for confidentiality, integrity, availability, and a...

Resilience

1 controls

Controls in the Resilience domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-HYGIENE-08	Backup and Recovery	Implement regular backups, offline copies, and tested restoration procedures.

Response

2 controls

Controls in the Response domain of ANSSI Cybersecurity Framework — 2 controls
Code	Title	Description
ANSSI-HYGIENE-09	Incident Response Capability	Establish incident detection, response, and CERT-FR coordination procedures with defined roles.
ANSSI-PRIS	PRIS Incident Response Providers	Incident response providers for OIV/OSE require PRIS qualification covering response capability.

Risk Management

1 controls

Controls in the Risk Management domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-EBIOS-RM	EBIOS Risk Manager Method	Use EBIOS Risk Manager for digital risk management with strategic and operational scenarios.

Third Party

1 controls

Controls in the Third Party domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-SUPPLY-CHAIN	Supply Chain Security	Assess and contractually require cybersecurity measures from suppliers and integrators handling sensitive systems.

Trust Services

1 controls

Controls in the Trust Services domain of ANSSI Cybersecurity Framework — 1 controls
Code	Title	Description
ANSSI-EIDAS-QTS	eIDAS Qualified Trust Services	Trust service providers offering qualified signatures, seals, timestamps, or website authentication must be qualified un...

Your Compliance Coverage

If you comply with ANSSI Cybersecurity Framework, you already cover:

NIST SP 800-53 Rev 5

61%

14 controls mapped

Compare →

ISO 20000-1

1 controls mapped

Compare →

ISO 19011

1 controls mapped

Compare →

+ 5 more: ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence (4%), ISO 13485 (4%)

See all 8 mapped frameworks ↓

Maps to 8 other frameworks

23 total controls

NIST SP 800-53 Rev 5

14 source controls mapped|14 target controls covered

61%

ISO 20000-1