ReCyF: ANSSI’s framework for NIS 2, objective by objective

ReCyF, the Référentiel Cyber France, sets out the security measures that ANSSI, the French cybersecurity agency, expects from entities subject to NIS 2. Its current version, 2.5, is dated 17 March 2026 and is still released as a working document. It sets 20 security objectives and, for each one, proposes acceptable means of compliance. Objectives 1 to 15 apply to important and essential entities alike, objectives 16 to 20 to essential entities only.

The ReCyF 2.5 PDF

ANSSI publishes the framework on its MesServicesCyber portal: ReCyF, version 2.5 of 17 March 2026 (PDF, in French). A second document lists the changes made since the previous version: change log from v2.4 to v2.5 (PDF, in French). There is no official English version.

The document opens with a presentation and a glossary, then sets out the 20 objectives. Each objective starts with its statement, which is the obligation, followed by its acceptable means of compliance, numbered and marked EI (important entity) or EE (essential entity). Two annexes close the framework: the rationale for each objective in terms of risk, and the mapping to the provisions of the NIS 2 directive. ANSSI states that these annexes are for guidance only.

On the same day, the agency released a comparison tool that sets ReCyF against other frameworks, standards and regulations (ANSSI announcement, in French).

Security objectives and acceptable means of compliance

The framework works on two levels, and the difference matters on the day of an inspection.

The security objective answers the question “what?”. It is the obligation that the decree issued under article 14 of the French resilience bill will set. Meeting it is mandatory.

The acceptable means of compliance answers the question “how?”. It is a measure that ANSSI proposes to meet the objective. It is not mandatory, except in the specific cases provided for in article 16 of the bill. An entity that applies it can rely on it to demonstrate that it meets the objective. An entity that departs from it can no longer rely on it, and has to show by other means that the objective is met.

The framework contains 152 acceptable means of compliance, and each one states whether it concerns essential entities, important entities or both. ReCyF defines no maturity scale.

The 20 ReCyF security objectives

The titles follow the framework, in its order, translated from the French. The PDF assigns them to four pillars: governance (objectives 1 to 5, 16 and 17), protection (6 to 11, 18 and 19), defence (12 and 20) and resilience (13 to 15).

No.	Security objective	Entities in scope
1	Inventory of information systems	EI and EE
2	Implementing a digital security governance framework	EI and EE
3	Control of the ecosystem	EI and EE
4	Integrating digital security into human resources management	EI and EE
5	Control of information systems	EI and EE
6	Control of physical access to premises	EI and EE
7	Securing the architecture of information systems	EI and EE
8	Securing remote access to information systems	EI and EE
9	Protecting information systems against malicious code	EI and EE
10	Identity and access management for users of information systems	EI and EE
11	Control of information system administration	EI and EE
12	Identifying and responding to security incidents	EI and EE
13	Business continuity and recovery	EI and EE
14	Responding to cyber crises	EI and EE
15	Exercises, tests and drills	EI and EE
16	Implementing a risk-based approach	EE
17	Auditing the security of information systems	EE
18	Securing the configuration of information system assets	EE
19	Administering information systems from dedicated resources	EE
20	Security monitoring of information systems	EE

An important entity must therefore meet the first fifteen objectives, an essential entity all twenty. Within a given objective, some acceptable means of compliance remain reserved for essential entities.

Who ReCyF applies to

By default, the objectives apply to important entities, essential entities and operators of vital importance, for the latter’s information systems other than their vital information systems (SIIV). The proportionality principle reserves objectives 16 to 20 for essential entities.

The objectives apply to all of the entity’s information systems, and objective 1 first requires an inventory of them, along with the activities and services they support. A system can only be set aside if the entity justifies, on the basis of a risk analysis, that it is exposed to none of the three risks covered: degradation or interruption of activities, disclosure of sensitive information to unauthorised persons, alteration of the information the activities depend on. This choice and its justification appear in the inventory, and having secured a system is never enough to set it aside.

Certifications and qualified services

The framework states when a certification or a service qualified by ANSSI can demonstrate all or part of an objective during an inspection:

• ISO/IEC 27001:2022: a certified ISMS counts for objective 2 and, for an essential entity, for objective 16, on the systems covered by the certification.
• PACS (security support and advisory): objectives 12, 14 and 15 for all entities, objective 16 for essential ones, with follow-up of the resulting action or treatment plan.
• PASSI (information systems security audit): objective 17, if the service covers the application of the corrective measures.
• PAMS (secure administration and maintenance): nine of the twelve measures of objective 19.
• PDIS (security incident detection): part of the measures of objective 20.

Where the NIS 2 transposition stands

ReCyF is the framework referred to in article 14 of the French bill on the resilience of critical infrastructure and the strengthening of cybersecurity, which transposes NIS 2 into French law. As of 16 October 2026, the bill has still not been passed. The Senate voted it on 12 March 2025, and the National Assembly’s special committee on 10 September 2025. Scheduled for plenary sittings on 7 and 9 October 2026, it was withdrawn from the agenda on 6 October, with no new date (Leto, 6 October 2026, in French). In the meantime, on 8 July 2026, the European Commission referred France to the Court of Justice of the European Union for failing to transpose the directive.

Until the law and its decrees are published, ReCyF remains a working document: ANSSI states that no final version will be issued before the transposition is complete and a consultation has taken place. Its objectives nonetheless take up the directive’s risk-management measures: entities that start on them now are preparing for inspection, whatever the final version. Running the programme is covered in a separate guide: Running your NIS2 compliance programme, step by step.

Assessing your compliance with ReCyF

The ReCyF checklist turns the 20 objectives into 156 checkpoints, with a marker on the points reserved for essential entities. It is a way to measure the gap before starting the work.

ReCyF has also been available in Make IT Safe since March 2026. The assessment is done objective by objective, according to the entity’s category, and the gaps are read against the coverage already achieved on ISO 27001, DORA or the GDPR. Each gap feeds the action plan, tracked by its indicators. Customers activate the framework through their CSM. To see how the framework is assessed in the tool, request a demo.

FAQ