ANSSI (French National Cybersecurity Agency)
France's national cybersecurity authority, responsible for protecting government information systems and critical private-sector operators.
ANSSI, the Agence nationale de la sécurité des systèmes d'information, is France's national cybersecurity agency and authority. It was created by Decree No. 2009-834 of July 7, 2009 as a national service attached to the General Secretariat for Defense and National Security, under the Prime Minister, and replaced the DCSSI. Its role is twofold. It is defensive: it protects government information systems and provides expertise to operators of vital importance and public bodies. CERT-FR, its watch and incident response center, issues the security alerts and advisories that CISOs follow, and it is what people mean by "CERT ANSSI". It is also regulatory: it oversees the transposition and enforcement of cybersecurity obligations derived from European law, notably the NIS2 Directive, while DORA is supervised in the financial sector by the ACPR and the AMF. The Loi Résilience bill, still before Parliament in September 2026, designates ANSSI as the national competent authority for NIS2. It will then be able to supervise essential and important entities, order audits and, ultimately, impose sanctions. The agency also grants security approvals, product certifications (CSPN, Common Criteria) and provider qualifications (PASSI for audit, SecNumCloud for cloud hosting), and publishes the EBIOS Risk Manager method. It is sometimes confused with the CNIL, which protects personal data and enforces the GDPR, or with Cybermalveillance.gouv.fr, the assistance service for individuals and small businesses that ANSSI co-founded. The agency has built tools and frameworks to help entities comply, including the MonEspaceNIS2 tool and the Référentiel Cyber France (ReCyF), published in March 2026, which sets out the measures ANSSI recommends to meet NIS2 security objectives. For insurers, its role is indirect, but it matters: its audits, frameworks and incident notifications shed light on the actual security posture of regulated entities, and could eventually feed cyber pricing models. A PASSI-qualified auditor or SecNumCloud hosting already shows up in underwriting questionnaires.
Once NIS2 is transposed by the Loi Résilience, still before Parliament in September 2026, a mid-sized French food-industry company is designated an important entity by ANSSI. The agency notifies it of its obligations under Article 21, requires it to produce a compliance plan and informs it that it will be audited within two years. The company's cyber insurer incorporates NIS2 status into its renewal questionnaire and may grant a premium reduction if the compliance plan is validated, since the ANSSI process takes over part of the risk verification.
ANSSI, French National Cybersecurity Agency, French cyber agency, ANSSI France, France ANSSI, CERT ANSSI, French National Agency for the Security of Information Systems
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.