PASSI qualification (French certified security auditors)

The information systems security audit provider qualification is granted by the French national cybersecurity agency to audit firms meeting a set of requirements covering their skills, methods, confidentiality of their work and independence of their auditors. It covers several activities: architecture, configuration and source code audits, penetration tests, organizational and physical audits. Operators of vital importance and other regulated entities must use qualified providers for certain audits, and public bodies prefer them. The qualification does not guarantee that an audited system is secure, but that the audit was conducted according to a recognized method by people whose skills were verified. For insurance, it provides a criterion for reading the documents an applicant produces: a penetration test report from a qualified provider, recent and accompanied by a tracked remediation plan, carries more weight in the underwriting file than a self-assessment. The same applies to post-loss expert work, where the auditor's method and independence determine the evidential value of its findings.