ANSSI (French National Cybersecurity Agency)

The Agence nationale de la sécurité des systèmes d'information, created in 2009 and placed under the authority of the Prime Minister via the General Secretariat for Defence and National Security, is France's principal competent authority on cybersecurity. It fulfils a dual role: defensive, by protecting government information systems and providing expertise to operators of vital importance and public bodies, and regulatory, by overseeing the transposition and enforcement of cybersecurity obligations derived from European law, notably the NIS2 Directive and the DORA Regulation. Under the Loi Résilience, ANSSI is designated the national competent authority for the implementation of NIS2, conferring on it the power to supervise essential and important entities, conduct audits and, ultimately, impose sanctions. The agency has developed several tools and frameworks to help entities achieve compliance, including the MonEspaceNIS2 tool and the ReCyF cybersecurity recommendations framework for digital service providers. For insurers, ANSSI plays an indirect but structuring role, as its audits, frameworks and incident notifications constitute a source of information on the effective security level of regulated entities that could ultimately feed cyber pricing models.

Following the transposition of NIS2 by the Loi Résilience, a mid-sized French food-industry company is designated an important entity by ANSSI. The agency notifies it of its obligations under Article 21, requires it to produce a compliance plan and informs it that it will be audited within two years. The company's cyber insurer incorporates NIS2 status into its renewal questionnaire and may grant a premium reduction if the compliance plan is validated, since the ANSSI process outsources part of the risk verification.

Agence nationale de la sécurité des systèmes d'information, Agence nationale cybersécurité