France · Compliance
NIS2 compliance in France
Achieve NIS2 compliance in France with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Enschede office team
- Effivity software included
- Academy training included
Who asks for NIS2 in France
Clients include
NIS2 compliance in France at a glance
Directive (EU) 2022/2555 (NIS 2) is the instrument itself, and its transposition into French law is still pending; buyers and partners in France already ask for evidence that you meet its measures.
France is still waiting for its NIS 2 law. ANSSI, which pilots the transposition and will implement it, says the work is under way; the bill on the resilience of critical infrastructure and the strengthening of cybersecurity has passed the Sénat but has yet to complete its route through the Assemblée nationale. Entities are not left idle. ANSSI's ReCyF, a working document published in March 2026, lists the measures it recommends against the NIS 2 objectives, and pre-registration is open on MesServicesCyber. Operators designated under the NIS 1 regime stay under ANSSI control. There is no NIS 2 certificate, and an accredited ISO/IEC 27001 certificate can only support the evidence. Sterling's Enschede office runs the applicability check, gap analysis and documentation for clients in France, with Effivity and Sterling Academy included with the engagement.
Who needs NIS2 in France, and what happens without it
These are the organisations in France that most often need to show NIS2.
- Medium and large companies in the sectors ANSSI listsANSSI says most future entities will be medium and large companies, local authorities and administrations across sectors such as energy, transport, banking, health, digital infrastructure and manufacturing.
- Operators already designated under the NIS 1 regimeThey remain under ANSSI control and are the group closest to the new rules.
- Cloud, managed-service and IT providers to regulated entitiesSupply chain security is one of the measures the Directive lists.
- Entities preparing now against the ReCyF working documentApplying it lets a future regulated entity rely on it in an ANSSI inspection.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkNIS2 requirements in France
Strip away the vocabulary and NIS2 asks essential and important entities to comply in six areas of cyber risk management.
In France these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: NIS2 explained →
How to achieve NIS2 compliance in France
One team from the Enschede office carries the work from scoping to sign-off. Clients in France are served from Sterling's Enschede office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against NIS2 and the French requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does NIS2 compliance take in France?
There is no standard duration: it depends on your scope and on how much of the system already runs. In France these are the factors that set the timeline.
- Whether the entity falls in a listed sector and size class
- Existing ISMS or ANSSI guidance already applied
- How far the final law differs from the working documents
- Scope covering the whole regulated entity and its suppliers
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does NIS2 compliance cost in France?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In France these factors move both.
- Size and number of entities in scope
- Control remediation across the entity
- Supplier assurance work
- External audit where ANSSI requires it
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
NIS2 consultants and assessors in France
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers NIS2 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in France are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive NIS2 in France (5)
| Instrument | How it treats the standard |
|---|---|
| Directive (EU) 2022/2555 (NIS 2) — risk-management measures | The instrument itself Essential and important entities take appropriate and proportionate technical, operational and organisational measures, taking into account relevant European and international standards where applicable. |
| ANSSI — NIS 2 transposition in France | Regulator statement Transposition is under way; ANSSI pilots it and will implement it; pre-registration of entities is open. |
| Résilience des infrastructures critiques et renforcement de la cybersécurité (projet de loi, Texte n° 33 (2024-2025)) | The bill Adopted by the Sénat on 12 March 2025; the Assemblée nationale special committee text is dated 10 September 2025. |
| Référentiel Cyber France (ReCyF) | Regulator guidance Working document listing the measures ANSSI recommends for the NIS 2 objectives; non-mandatory by default. |
| NIS 1 regime and décret n° 2018-384 du 23 mai 2018 | The instrument itself In force for designated operators of essential services, with ANSSI as controlling authority. |
Accreditation, audit language and remote audits in France
Compliance, not certification: there is no NIS 2 certificate. French entities will document measures, register with ANSSI and follow the rules the final law sets. An accredited ISO/IEC 27001 certificate can serve as supporting evidence of a managed security system, but what counts is for the final law and ANSSI to decide. Edition and transition details: NIS2 hub →
Audit language
ANSSI works in French; registration and correspondence will be in French. Internal documentation can be in French or English.
Remote and on-site
Applicability checks, gap assessments and documentation can be remote or on-site; any official inspection follows ANSSI's procedure.
NIS2 in France: questions clients ask
Do we need to register with ANSSI for NIS 2 now?
Pre-registration is open: ANSSI's MesServicesCyber service lets future entities pre-register, and ANSSI invites them to start strengthening their security now. Formal obligations depend on the final law, which is still being passed. Use pre-registration as preparation, and ask ANSSI or your counsel what applies to your entity once the text is final.
Which sectors will NIS 2 cover in France?
ANSSI lists highly critical sectors such as public administration, drinking and waste water, energy, space, ICT service management, financial market infrastructure, digital infrastructure, health, banking and transport, plus other critical sectors including chemicals, manufacturing, food, research and postal services. It expects mainly medium and large companies, local authorities and administrations. Test your own entity with ANSSI's simulator.
Is there a NIS 2 certificate?
No. Nothing called a NIS 2 certificate exists. Entities document their measures, register and follow whatever the final French law sets. A certificate from an accredited body for ISO/IEC 27001 can support the evidence of a managed security system, though it is for the final law and ANSSI to say what is sufficient. Treat it as a foundation, not proof.
Does ISO 27001 satisfy NIS 2 in France?
Not automatically. The Directive asks for appropriate and proportionate measures that take relevant European and international standards into account, without naming one. ANSSI offers a tool to compare its ReCyF with frameworks and standards you already use, which helps you map what ISO/IEC 27001 covers and what remains. Confirm the final French requirements with ANSSI or counsel.
More on NIS2 for French organisations
Other standards French businesses ask Sterling for
Organisations in France often combine NIS2 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Enschede office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Directive (EU) 2022/2555 (NIS 2) — risk-management measures — eur-lex.europa.eu (accessed 7 Oct 2026)
- ANSSI — NIS 2 transposition in France — messervices.cyber.gouv.fr (accessed 7 Oct 2026)
- Résilience des infrastructures critiques et renforcement de la cybersécurité (projet de loi, Texte n° 33 (2024-2025)) — senat.fr (accessed 7 Oct 2026)
- Référentiel Cyber France (ReCyF) — cyber.gouv.fr (accessed 7 Oct 2026)
- NIS 1 regime and décret n° 2018-384 du 23 mai 2018 — cyber.gouv.fr (accessed 7 Oct 2026)
- ANSSI — cyber.gouv.fr (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice