French Military Programming Law (cyber provisions)
French military programming laws that imposed cybersecurity obligations on operators of vital importance from 2013, then strengthened in 2023 the national agency's powers against attacks.
French military programming laws set the direction and resources of national defense over several years, and they have served as the vehicle for the main national cybersecurity rules. The 2013 law imposed unprecedented obligations on operators of vital importance: applying state-set security rules to their most critical systems, reporting incidents to the national cybersecurity agency, using qualified providers and undergoing inspections. It made France one of the first countries to regulate critical infrastructure cybersecurity, before the first European directive on the subject. The programming law for 2024 to 2030, enacted in August 2023, strengthened the agency's powers: the ability to ask domain name providers to block or redirect malicious domains, to install detection devices at certain operators, and a requirement for software vendors to notify significant vulnerabilities and incidents affecting their products. These texts place cybersecurity within national defense, and remind the underwriter that the obligations of large insureds are a matter of state security as much as of compliance.
A software vendor whose product is widely used discovers a flaw being exploited against its customers. Since the 2023 law, it must notify the vulnerability and the incident to the national agency, which may inform users; delay or omission exposes it to a public formal notice.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.