ReCyF : What ANSSI’s cybersecurity framework requires of your Information System and your Privileged Accesses

The French Resilience Bill, which is intended to transpose the European NIS 2 Directive into French law, is now on the National Assembly’s agenda : its consideration in a public session is scheduled for October 7, 2026. This sends a strong signal, even if its final transposition will still take some time.

In the meantime, ANSSI has already established the technical framework with ReCyF (Référentiel Cyber France), the framework that translates NIS 2 into concrete requirements. It consists of security objectives and, for each one, acceptable means of compliance. Objectives 1 through 15 apply to significant entities (EI) and essential entities (EE), while objectives 16 through 20 apply only to essential entities. Although still in the working document stage, it already outlines what ANSSI will be monitoring.

What is ReCyF ?

ReCyF is the cybersecurity framework that specifies how French organizations subject to NIS 2 must secure their information systems. It was unveiled by ANSSI on March 17, 2026, at Campus Cyber, as working version 2.5.

Its legal basis is clear. The ReCyF constitutes the cybersecurity framework referred to in the sixth paragraph of Article 14 of the draft law on the resilience of critical infrastructure and the strengthening of cybersecurity. In other words, it will become the technical annex to the French law transposing NIS 2.

Is the ReCyF mandatory?

No, not yet from a legal standpoint. The ReCyF remains a working document until the Resilience Act is enacted and its implementing regulations are published. Vincent Strubel, Director General of ANSSI, has made it clear, however, that we should by no means wait for the law to be implemented before putting it into practice.

The Timeline for the Resilience Act :

• March 2025 : The bill is passed on first reading in the Senate.
• September 2025 : Unanimous vote in a special committee of the National Assembly.
• On July 8, 2026, the European Commission refers France to the Court of Justice of the European Union for failure to transpose the legislation.
• October 2026 : The bill is now on the National Assembly’s agenda, with a public hearing scheduled for October 7, 2026.

Although this is not the final step, the bill is once again being debated in the National Assembly. For the organizations concerned, waiting is therefore not a viable strategy : the deadline for compliance after the decrees are published will be short, while certain initiatives, such as the overhaul of the administration, take months.

Who is covered by ReCyF?

By default, the ReCyF objectives apply to significant entities (EI), essential entities (EE), and operators of vital importance, with respect to their information systems other than their information systems of vital importance (SIIV).

The scope is broad. NIS 2 will apply in France to several thousand entities across 18 sectors, as well as to approximately 1,000 intermunicipal associations and 300 municipalities with more than 30,000 residents.

One point that is often misunderstood concerns the scope of the information systems covered. The requirements apply to all of the entity’s information systems, except those for which the entity can demonstrate, through a risk analysis, that they are not exposed to a disruption of its operations, a disclosure of sensitive information, or a compromise of necessary information. The exclusion must be documented ; it cannot be assumed.

Security objectives and acceptable means of compliance : How to read the ReCyF

ReCyF distinguishes between two levels of requirements :

The security objective is a performance-based requirement. It answers the question “what?” and must be met.
Acceptable means of compliance (MAC) are a recognized path to achieving this objective. They answer the question “how?” and are not mandatory. However, applying them allows an entity to use them to demonstrate that the objectives have been met.

An entity may therefore choose an alternative measure. It must then justify this choice in its compliance analysis, and ANSSI may assess its relevance during an audit.

Objective 10 : Individual Accounts and Controlled Secrets (EI and EE)

• Users and automated processes have individual accounts.
• If shared accounts are unavoidable, the entity must mitigate the risk and ensure traceability of their use.
• The password for an account is known only to authorized users. The reference document cites the storage of shared passwords in a safe as an example.
• Accounts and access rights are reviewed at least once a year.

Objective 11 : Strictly Dedicated Administrative Accounts (EI and EE)

• Administrative actions are performed exclusively from administrative accounts, and these accounts are used solely for that purpose.
• If this is not technically possible, the entity must ensure that administrative actions are properly controlled.
• For EE : Maintain an up-to-date list of administrative accounts. Identify the “core of trust” (directory, hypervisors, administrative machines—for example, the Tier 0 of an Active Directory), administered from exclusively dedicated accounts and resources.

Objective 19 : Administer from Dedicated Resources (EE)

• A dedicated administration network and a physical workstation used exclusively for administration.
• Administration traffic protected by state-of-the-art encryption and authentication.
• Failing that, implement measures to strengthen control and traceability of administrative actions.

Traceability of Shared Accounts (10.A.2-EI/EE, 10.A.3-EI/EE)

What a PAM solution provides : Each session is linked to a named identity and recorded

Its limitations : Reducing the number of shared accounts remains an organizational initiative to be carried out internally. The bastion cannot trigger this automatically

Secret known only to authorized users (10.B.4-EI/EE)

What a PAM solution provides: A secure repository for credentials and the injection of the secret without revealing it to the user

Its limitations: The password renewal policy must be defined separately. The bastion enforces the policy but does not create it.

Control of administrative actions (11.A.5-EI/EE, 19.12-EE)

What a PAM solution provides: Video recording of each session, audit logs, real-time monitoring, and session termination

Its limitations : In-depth log analysis is the responsibility of a dedicated detection system (SIEM/SOC). The bastion facilitates this step by exporting logs to these tools.

List of administrative accounts (11.A.6, EE)

What a PAM solution provides: A centralized view of declared accounts and targets

Its limitations : A comprehensive inventory of all privileged accounts—including those outside the bastion—must still be conducted internally. The bastion facilitates this mapping by exporting the configurations of existing access policies.

Service Provider Access (3.B.2-EI/EE, 8)

What a PAM solution provides: Single point of entry, rights limited by target, evidence of actions taken, multi-factor authentication (MFA)

Its limitations: Contractual terms with service providers must still be negotiated and formalized outside the bastion. The bastion facilitates compliance by displaying a warning message reminding users of these clauses before each access attempt

Technical Logs and Retention (12, 20.5-EE)

What a PAM solution provides : Logs and records that can be used as evidence; configurable data retention periods.

Dedicated Administration Workstation and Network (19)

The PAM solution does not replace a dedicated administration workstation.

Compliance with ANSSI’s recommendations on administration architecture remains a separate project. Your integrator, who deployed the bastion, can assist you with this. The bastion, for its part, facilitates this process through protocol isolation.

One final point regarding critical entities : the bastion host itself becomes a critical administrative resource. It must be hardened, kept up to date, and incorporated into the planning for the trust anchor.

Where to start : 5 steps to prepare for ReCyF

1. Determine your status (EE, EI, or outside the scope) using the ANSSI eligibility test. It determines whether 15 or 20 objectives apply to you.
2. Identify your activities and information systems (Objective 1), documenting any exclusions.
3. Assess the gap objective by objective, using the MesServicesCyber comparator if you already have an ISO 27001 framework in place.
4. Prioritize privileged access: shared accounts, service providers, and administrative accounts. These are well-defined measures that are quick to demonstrate and highly vulnerable in the event of an attack. For this part, the PROVE IT bastion is a powerful compliance tool.
5. Compile a file of evidence : for each objective, list the measure in place, the evidence, and its date. The corrective action plan must specify, for each action, a reasonable deadline and a person responsible.