ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

France

vVersion 2.0, September 2017 (ANSSI-GP-042), 42 measures across 10 themes

10 domains

42 controls

ANSSI Guide d'hygiene informatique, the French national cybersecurity agency baseline of 42 measures across 10 themes for strengthening the security of an information system.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (10)

ANSSI Hygiene I: Raise Awareness and Train (measures 1 to 3)

3 controls

Controls in the ANSSI Hygiene I: Raise Awareness and Train (measures 1 to 3) domain of ANSSI Guide d'hygiene informatique (42 mesures, v2.0) — 3 controls
Code	Title	Description
ANSSI-HYG-01	Train Operational Teams in Information System Security	Train the teams that operate the information system in security, covering security integration for project managers, sec...
ANSSI-HYG-02	Raise User Awareness of Basic Security Practice	Inform every user on arrival and regularly thereafter of the security stakes, the rules to follow and the expected behav...
ANSSI-HYG-03	Control the Risks of Outsourced Information System Management	Assess the risks specific to outsourcing before externalising the information system or its data, and reflect the result...

ANSSI Hygiene II: Know the Information System (measures 4 to 7)

4 controls

Controls in the ANSSI Hygiene II: Know the Information System (measures 4 to 7) domain of ANSSI Guide d'hygiene informatique (42 mesures, v2.0) — 4 controls
Code	Title	Description
ANSSI-HYG-04	Identify the Most Sensitive Information and Servers and Maintain a Network Diagram	Identify the information and servers that are most sensitive to the entity and maintain an up to date diagram of the net...
ANSSI-HYG-05	Maintain an Exhaustive Inventory of Privileged Accounts	Hold and keep up to date a complete inventory of privileged accounts across the information system.
ANSSI-HYG-06	Organise Joiner, Leaver and Role Change Procedures	Define and operate procedures covering the arrival, departure and change of function of users, so that access rights are...
ANSSI-HYG-07	Authorise Network Connection Only for Managed Equipment	Permit connection to the entity network only for equipment that the entity manages, and control the connection of any ot...

ANSSI Hygiene III: Authenticate and Control Access (measures 8 to 13)

6 controls

Controls in the ANSSI Hygiene III: Authenticate and Control Access (measures 8 to 13) domain of ANSSI Guide d'hygiene informatique (42 mesures, v2.0) — 6 controls
Code	Title	Description
ANSSI-HYG-08	Identify Each Person by Name and Separate User and Administrator Roles	Give each person accessing the system a nominative account, and keep user roles separate from administrator roles so tha...
ANSSI-HYG-09	Assign the Correct Rights on Sensitive Resources	Grant rights on the sensitive resources of the information system according to need, and review them so that access rema...
ANSSI-HYG-10	Define and Verify Password Selection and Sizing Rules	Define rules on the choice and length of passwords and verify that they are applied.
ANSSI-HYG-11	Protect Passwords Stored on Systems	Protect passwords held on systems so that they cannot be recovered, avoiding storage in clear text or in reversible form...
ANSSI-HYG-12	Change Default Authentication Elements on Equipment and Services	Change the authentication elements supplied by default on equipment and services before they are placed in service.
ANSSI-HYG-13	Prefer Strong Authentication Where Possible	Use strong authentication wherever it can be deployed, in particular for privileged access and for access from outside t...

ANSSI Hygiene IV: Secure Workstations (measures 14 to 18)

5 controls

Controls in the ANSSI Hygiene IV: Secure Workstations (measures 14 to 18) domain of ANSSI Guide d'hygiene informatique (42 mesures, v2.0) — 5 controls
Code	Title	Description
ANSSI-HYG-14	Apply a Minimum Security Level Across the Whole Estate	Define and apply a minimum level of security across the whole computing estate, including hardening of the operating sys...
ANSSI-HYG-15	Protect Against Threats Related to Removable Media	Protect the information system against the threats associated with removable media, including control of their use and i...
ANSSI-HYG-16	Use a Centralised Management Tool to Standardise Security Policies	Use a centralised management tool so that security policies are applied uniformly across the estate.
ANSSI-HYG-17	Enable and Configure the Local Firewall on Workstations	Enable and configure the local firewall on workstations so that unnecessary inbound connections are blocked.
ANSSI-HYG-18	Encrypt Sensitive Data Transmitted Over the Internet	Encrypt sensitive data transmitted over the internet, using cryptographic mechanisms consistent with the published recom...

ANSSI Hygiene IX: Supervise, Audit and Respond (measures 36 to 40)

5 controls

Controls in the ANSSI Hygiene IX: Supervise, Audit and Respond (measures 36 to 40) domain of ANSSI Guide d'hygiene informatique (42 mesures, v2.0) — 5 controls
Code	Title	Description
ANSSI-HYG-36	Enable and Configure Logging on the Most Important Components	Enable and configure the logs of the most important components of the information system so that events can be reconstru...
ANSSI-HYG-37	Define and Apply a Backup Policy for Critical Components	Define and apply a backup policy covering the critical components of the information system, and verify that restoration...
ANSSI-HYG-38	Carry Out Regular Security Checks and Audits and Apply the Corrective Actions	Carry out regular security checks and audits of the information system and apply the corrective actions that they identi...
ANSSI-HYG-39	Designate an Information System Security Officer and Make the Role Known	Designate a person responsible for information system security and make that role known to the staff.
ANSSI-HYG-40	Define a Security Incident Management Procedure	Define a procedure for managing security incidents, covering how they are reported, handled and closed.

ANSSI Hygiene V: Secure the Network (measures 19 to 26)

8 controls

Controls in the ANSSI Hygiene V: Secure the Network (measures 19 to 26) domain of ANSSI Guide d'hygiene informatique (42 mesures, v2.0) — 8 controls
Code	Title	Description
ANSSI-HYG-19	Segment the Network and Partition the Zones	Segment the network into zones and enforce partitioning between them so that a compromise in one zone does not extend to...
ANSSI-HYG-20	Secure Wi-Fi Access Networks and Separate Usage	Secure the Wi-Fi access networks and separate the different uses so that guest and internal access do not share the same...
ANSSI-HYG-21	Use Secure Protocols Wherever They Exist	Use the secure version of a protocol wherever one exists, in place of the unprotected equivalent.
ANSSI-HYG-22	Put in Place a Secure Internet Access Gateway	Route outbound internet access through a secure gateway that filters and logs the traffic.
ANSSI-HYG-23	Partition Internet Facing Services from the Rest of the Information System	Place services visible from the internet in a partitioned zone separated from the rest of the information system.
ANSSI-HYG-24	Protect the Corporate Mail Service	Protect the professional mail service, including filtering of malicious content and protection of the mail flows.
ANSSI-HYG-25	Secure Dedicated Network Interconnections with Partners	Secure the dedicated network interconnections established with partners so that partner access is limited and controlled...
ANSSI-HYG-26	Control and Protect Access to Server Rooms and Technical Areas	Control and protect physical access to server rooms and technical areas.

ANSSI Hygiene VI: Secure Administration (measures 27 to 29)

3 controls

Controls in the ANSSI Hygiene VI: Secure Administration (measures 27 to 29) domain of ANSSI Guide d'hygiene informatique (42 mesures, v2.0) — 3 controls
Code	Title	Description
ANSSI-HYG-27	Prohibit Internet Access from Administration Workstations and Servers	Prohibit internet access from the workstations and servers used to administer the information system.
ANSSI-HYG-28	Use a Dedicated and Partitioned Network for Administration	Use a dedicated and partitioned network for administration of the information system.
ANSSI-HYG-29	Limit Administration Rights on Workstations to Operational Need	Limit administration rights on workstations to what operational need requires.

ANSSI Hygiene VII: Manage Mobile Working (measures 30 to 33)

4 controls

Controls in the ANSSI Hygiene VII: Manage Mobile Working (measures 30 to 33) domain of ANSSI Guide d'hygiene informatique (42 mesures, v2.0) — 4 controls
Code	Title	Description
ANSSI-HYG-30	Apply Physical Protection Measures to Mobile Devices	Apply physical security measures to mobile terminals so that loss or theft is prevented or its effect limited.
ANSSI-HYG-31	Encrypt Sensitive Data, in Particular on Equipment That May Be Lost	Encrypt sensitive data, in particular on equipment that could be lost or stolen, so that the data remains protected if t...
ANSSI-HYG-32	Secure the Network Connection of Devices Used for Mobile Working	Secure the network connection of workstations used away from the entity premises, so that traffic is protected when untr...
ANSSI-HYG-33	Adopt Security Policies Dedicated to Mobile Terminals	Adopt security policies specific to mobile terminals such as smartphones and tablets, covering their configuration and t...

ANSSI Hygiene VIII: Keep the Information System Up to Date (measures 34 and 35)

2 controls

Controls in the ANSSI Hygiene VIII: Keep the Information System Up to Date (measures 34 and 35) domain of ANSSI Guide d'hygiene informatique (42 mesures, v2.0) — 2 controls
Code	Title	Description
ANSSI-HYG-34	Define an Update Policy for Information System Components	Define a policy for updating the components of the information system and apply it so that corrections are deployed with...
ANSSI-HYG-35	Anticipate the End of Maintenance of Software and Systems	Anticipate the end of maintenance of software and systems and limit software dependencies so that unsupported components...

ANSSI Hygiene X: Going Further (measures 41 and 42)

2 controls

Controls in the ANSSI Hygiene X: Going Further (measures 41 and 42) domain of ANSSI Guide d'hygiene informatique (42 mesures, v2.0) — 2 controls
Code	Title	Description
ANSSI-HYG-41	Conduct a Formal Risk Analysis	Conduct a formal risk analysis of the information system so that the security measures applied follow from the risks ide...
ANSSI-HYG-42	Prefer Products and Services Qualified by ANSSI	Prefer, where the need arises, products and services that carry an ANSSI qualification, drawing on the published catalog...

Your Compliance Coverage

If you comply with ANSSI Guide d'hygiene informatique (42 mesures, v2.0), you already cover:

NIST SP 800-161 Rev 1

100%

42 controls mapped

Compare →

NIST SP 800-53 Rev 5 MODERATE

100%

42 controls mapped

Compare →

FedRAMP Moderate

100%

42 controls mapped

Compare →

+ 31 more: NIST SP 800-53 Revision 5.1 HIGH (100%), FedRAMP High (100%)

See all 34 mapped frameworks ↓

Maps to 34 other frameworks

42 total controls

NIST SP 800-161 Rev 1

42 source controls mapped|47 target controls covered

100%

NIST SP 800-53 Rev 5 MODERATE

42 source controls mapped|86 target controls covered

100%

FedRAMP Moderate

42 source controls mapped|102 target controls covered

100%

NIST SP 800-53 Revision 5.1 HIGH

42 source controls mapped|87 target controls covered

100%

FedRAMP High

42 source controls mapped|101 target controls covered

100%

NIST SP 800-53 Rev 5

42 source controls mapped|80 target controls covered

100%

NIST SP 800-171 Rev 3

42 source controls mapped|67 target controls covered

100%

NIST Cybersecurity Framework 2.0

42 source controls mapped|59 target controls covered

100%

ISO 27001:2022

42 source controls mapped|50 target controls covered

100%

ISO 27002:2022

41 source controls mapped|49 target controls covered

98%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

41 source controls mapped|88 target controls covered

98%

PCI DSS 4.0

41 source controls mapped|97 target controls covered

98%

NIST SP 800-53 Rev 5 LOW

40 source controls mapped|58 target controls covered

95%

CMMC 2.0

40 source controls mapped|79 target controls covered

95%

SOC 2

40 source controls mapped|25 target controls covered

95%

CIS Controls v8

38 source controls mapped|94 target controls covered

90%

Azure Security Benchmark

37 source controls mapped|57 target controls covered

88%

C5 (Germany)

36 source controls mapped|60 target controls covered

86%

AWS Well-Architected Security Pillar

32 source controls mapped|41 target controls covered

76%

HIPAA Security Rule

30 source controls mapped|42 target controls covered

71%

ASD Strategies to Mitigate Cyber Security Incidents

30 source controls mapped|27 target controls covered

71%

NIST SP 800-66 Rev 2

29 source controls mapped|40 target controls covered

69%

UK Cyber Essentials

26 source controls mapped|34 target controls covered

62%

ACSC Essential Eight

20 source controls mapped|14 target controls covered

48%

NIST SP 800-172

14 source controls mapped|15 target controls covered

33%

APRA CPS 234

11 source controls mapped|14 target controls covered

26%

APRA CPS 230 Operational Risk Management

8 source controls mapped|9 target controls covered

19%

APPI

8 source controls mapped|5 target controls covered

19%

ISO/IEC 42001:2023

6 source controls mapped|7 target controls covered

14%

Australian Privacy Principles (APPs)

4 source controls mapped|1 target controls covered

10%

ISO 27701:2019

2 source controls mapped|2 target controls covered

ISO 27018:2019

1 source controls mapped|1 target controls covered

ISO 27017:2015

1 source controls mapped|1 target controls covered

ISO 37001:2016

1 source controls mapped|1 target controls covered

Compare ANSSI Guide d'hygiene informatique (42 mesures, v2.0) with NIST SP 800-161 Rev 1

Frequently Asked Questions

What is ANSSI Guide d'hygiene informatique (42 mesures, v2.0)?

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) is a compliance framework from France with 10 domains and 42 controls. ANSSI Guide d'hygiene informatique, the French national cybersecurity agency baseline of 42 measures across 10 themes for strengthening the security of an information system. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does ANSSI Guide d'hygiene informatique (42 mesures, v2.0) have?

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) has 42 controls organised across 10 domains. The largest domains are ANSSI Hygiene V: Secure the Network (measures 19 to 26) (8 controls), ANSSI Hygiene III: Authenticate and Control Access (measures 8 to 13) (6 controls), ANSSI Hygiene IV: Secure Workstations (measures 14 to 18) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does ANSSI Guide d'hygiene informatique (42 mesures, v2.0) map to?

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) maps to 34 other compliance frameworks. The top mapping partners are NIST SP 800-161 Rev 1 (100% coverage), NIST SP 800-53 Rev 5 MODERATE (100% coverage), FedRAMP Moderate (100% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with ANSSI Guide d'hygiene informatique (42 mesures, v2.0) compliance?

Start your ANSSI Guide d'hygiene informatique (42 mesures, v2.0) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ANSSI Guide d'hygiene informatique (42 mesures, v2.0) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 42 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required