France has regulated the cyber security of its most critical operators since the 2013 Military Programming Law (LPM), years before NIS, and that regime still applies in full while the NIS2 bill works its way through Parliament. Operators of vital importance (opérateurs d'importance vitale, OIV) must declare their vital information systems (systèmes d'information d'importance vitale, SIIV) to ANSSI, apply the security rules in their sector arrêté, use qualified detection, report incidents and accept ANSSI controls. This guide explains how the OIV regime works in practice: the SAIV framework it sits in, the SIIV declaration cycle, the rule themes, qualified providers, controls, sanctions and what the pending Loi Résilience means for it. It is for CISOs, security architects and compliance leads at OIVs and at the suppliers who run or audit their systems. For the NIS2 layer, see the France NIS2 Implementation Guide.
Status checked 9 November 2026. The OIV cyber duties sit in the Code de la défense (articles L. 1332-6-1 and following, R. 1332-41-1 and following), Decree 2015-351 of 27 March 2015 and sector arrêtés that came into force between 2016 and 2020, as listed by ANSSI. Légifrance could not be read for this update, so obligations are taken from ANSSI's own pages and FAQ, the SGDSN SAIV brochure and, for fine amounts, law firm summaries from Jones Day and Squire Patton Boggs that agree with ANSSI. The projet de loi Résilience (bill no. 1112) would reform the regime; the Assemblée nationale committee report of September 2025 shows it at first reading there, so check its current stage. Confirm against the official text before relying on it. This page is not legal advice.
Key takeaways
- Designation comes from the state: ministries identify OIVs and designate them by arrêté; the operator does not self-assess in or out, and the lists are protected by national defence secrecy.
- SIIV are the regulated perimeter: the duties apply to the information systems whose compromise would seriously harm the nation, which the OIV declares to ANSSI and updates each year between 1 and 30 November.
- Rules set by sector: the security rules and their deadlines sit in each sector arrêté; ANSSI's FAQ covers themes such as the security policy, homologation, detection, incident handling and controls, and refers to rule 20 for annual indicators.
- Qualified providers carry weight: detection uses qualified probes and providers (PDIS), homologation audits and controls can be run by qualified auditors (PASSI), and incident response by PRIS.
- Sanctions are personal too: after a formal notice, article L. 1332-7 of the Code de la défense allows fines of up to EUR 150,000 for individuals and EUR 750,000 for legal entities, according to ANSSI and law firm summaries.
The SAIV framework and where cyber fits
The OIV regime is part of the dispositif de Sécurité des activités d'importance vitale (SAIV), created in 2006 to protect operators essential to the nation against malicious acts such as terrorism, sabotage and cyber attack, and against natural, technological and health risks. Article 22 of the 2013 LPM added the information system obligations that ANSSI now enforces. The SGDSN coordinates the framework; ANSSI, part of the SGDSN, both supports operators and checks their compliance.
| Element | What it is | Who owns it |
|---|---|---|
| Sector of vital importance | Twelve sectors in the SGDSN's framework, such as energy, water, health, finance, transport and electronic communications | Coordinating ministry per sector |
| Directive nationale de sécurité (DNS) | Sets the sector's stakes, vulnerabilities, threats and security objectives | Coordinating ministry, SGDSN |
| Plan de sécurité d'opérateur (PSO) | Operator's security organisation and policy | OIV |
| Point d'importance vitale (PIV) | Sites such as production plants, control centres, network nodes or data centres | Proposed by OIV |
| Plan particulier de protection (PPP) | Protection plan for each PIV | OIV, approved by the préfet |
| SIIV and the sector arrêté | Vital information systems and the cyber rules that apply to them | OIV, controlled by ANSSI |
The physical plans and the cyber rules overlap: a control centre that is a PIV usually hosts or reaches SIIV. Treat the PSO, PPP and SIIV documentation as one set with shared asset lists. See the Critical Infrastructure Regulation Map for how this compares with other regimes.
Declaring and maintaining SIIV
- First declaration: each OIV declares its SIIV to ANSSI once its sector arrêté is in force, by the deadline in that arrêté. Each SIIV needs its own form, unless interconnected systems are declared as one SIIV.
- Classification: ANSSI states that the SIIV list is covered by national defence secrecy (article R. 1332-41-2 of the Code de la défense), at least at Confidentiel Défense. The form is completed on means that meet the IGI 1300 rules and sent by post or secure electronic means.
- Annual update: between 1 and 30 November each year, OIVs send the updated SIIV declaration and the rule 20 indicators. If nothing has changed, a short statement that previous declarations remain valid is enough. November 2026 is a live window.
- Scoping decisions: declaring too wide a SIIV spreads strict rules over systems that do not need them; declaring too narrow leaves connected systems as paths in. Document the boundary, the interconnections and the reasoning.
The security rules in practice
The sector arrêtés carry the exact wording and deadlines, which are notified to each sector's OIVs. The themes ANSSI names in its FAQ give a practical frame:
| Rule theme (ANSSI FAQ) | What OIVs typically need in place | Evidence a controller will ask for |
|---|---|---|
| Information system security policy (PSSI) | A SIIV-specific security policy approved at the right level | Signed PSSI, review dates |
| Homologation | A formal security accreditation decision for each SIIV, informed by an audit | Homologation file, audit report, residual risk acceptance |
| Detection | Qualified detection probes and a qualified detection provider | Probe placement, PDIS contract, coverage of SIIV |
| Alert and incident processing | Procedures to triage alerts, handle incidents and notify ANSSI | Runbooks, incident records, notification copies |
| Identity and access management | Controlled accounts and administration of SIIV | Account inventory, admin access records, reviews |
| Logging | Event logs generated and kept for analysis | Log sources, retention settings, analysis records |
| Indicators (rule 20) | Indicators reported to ANSSI with the annual update | Indicator values and how they were calculated |
For logging design see the CIS Control 8 Audit Log Management Guide.
Qualified products and service providers
Decree 2015-350 of 27 March 2015 covers the qualification of security products and trust service providers. ANSSI's FAQ explains how qualification is used in the OIV regime:
| Qualification | Role for OIVs | Notes from ANSSI |
|---|---|---|
| PASSI (audit providers) | Homologation audits, unless done by an internal team; LPM controls | A control auditor cannot be the firm that ran the homologation audit and must have no legal link to the OIV |
| PDIS (detection providers) | Incident detection and log analysis | Detection uses qualified probes unless ANSSI or another state service provides them; SIIV and non-SIIV detection can be pooled under one PDIS |
| PRIS (incident response providers) | Incident processing | Recommended so that work meets ANSSI standards during inspection |
| Qualified detection systems | Probes on SIIV networks | Qualified at elementary level; a qualified TAP is required |
An OIV can let its detection provider file the technical part of an incident report, but it stays legally responsible for the declaration.
Incident notification
- What: security incidents affecting SIIV, of the types set in the sector arrêté.
- To whom: directly to ANSSI.
- How: on ANSSI's form, by post or secure electronic means in line with IGI 1300. ANSSI states the form is confidential under article 226-13 of the Penal Code.
- Content: a detailed explanation of the incident, its consequences and the measures taken, plus technical data that lets ANSSI classify it.
- What ANSSI does with it: incident information stays within the state; ANSSI may share anonymised analyses with OIVs.
Once the Loi Résilience is in force, an OIV that is also an essential entity will have NIS2 reporting duties too. Build one triage step that checks both regimes. The EU Incident Reporting Clocks guide lines up the EU clocks.
Controls, crisis powers and sanctions
- Who controls: ANSSI, another state service, or an ANSSI-qualified provider. Third-party providers running SIIV are also subject to controls, so contracts must include an auditability clause.
- Due process: the OIV can submit observations on a control report before it goes to ANSSI, and ANSSI may hear the parties within two months.
- Formal notice first: a breached rule leads first to a formal notice to comply.
- Fines: as a last resort, article L. 1332-7 provides for fines of up to EUR 150,000 for individuals and EUR 750,000 for legal entities, and ANSSI notes they can apply to both the manager and the operator.
What the Loi Résilience changes
The projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité transposes NIS2 and the CER Directive. According to the Assemblée nationale committee report, it also transposes DORA, and it replaces the current OIV criminal sanctions regime. Until the law is promulgated and its decrees published, keep complying with the current Code de la défense rules and arrêtés, and track amendments as the bill progresses. See the EU Critical Entities Resilience Directive Guide for the EU side.
Where identity fits
- Administration of SIIV: identity and access management is a named rule theme. Keep a dedicated, inventoried set of admin accounts for SIIV and review them on a fixed cycle. See the Critical Infrastructure Identity Security Guide.
- Machine identities inside the perimeter: detection probes, log collectors, backup agents and OT gateways authenticate with service accounts, certificates and keys. Include them in the SIIV asset list and the homologation file.
- Supplier access: providers that operate or audit SIIV need named, time-limited access that a controller can trace.
Framework mapping
| OIV duty | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| SIIV declaration and scoping | ID.AM-05 | PL-2 |
| PSSI and governance | GV.PO-01 | PL-2 |
| Homologation and audits | ID.RA-03 | CA-2, CA-6 |
| Detection and logging | DE.CM-01, DE.AE-02, PR.PS-04 | SI-4, AU-2 |
| Identity and access management | PR.AA-05 | AC-2 |
| Incident notification | RS.CO-02 | IR-6 |
| Supplier auditability clauses | GV.SC-05 | SA-9 |
Compliance steps
- Confirm the perimeter: reconcile your OIV designation, PIV list and SIIV list, and record interconnections at each boundary.
- Prepare the November update: refresh SIIV declarations and rule 20 indicators for the 1 to 30 November window, using classified handling.
- Map rules to evidence: for each rule in your sector arrêté, name an owner and the document a controller will ask for.
- Check homologation currency: every SIIV should have a valid homologation decision backed by an audit.
- Review detection coverage: confirm qualified probes and the PDIS contract cover every SIIV segment.
- Rehearse notification: run an exercise that ends with a completed ANSSI form sent through the approved channel.
- Fix supplier contracts: add auditability clauses and access logging for every provider touching SIIV.
- Track the Loi Résilience: assign someone to follow the parliamentary stages and the decrees, and plan the gap analysis against NIS2.
Common failure patterns
- SIIV boundary drift: new interconnections, cloud links or remote access paths added after the declaration and never declared.
- Classified handling shortcuts: SIIV lists or indicators sent by ordinary email or kept on unaccredited systems.
- Homologation as a one-off: a decision taken at go-live and never revisited after major change.
- Detection gaps: qualified probes on the main site but not on secondary or recovery sites.
- Same auditor twice: using the homologation auditor for the control, which ANSSI does not allow.
- Waiting for NIS2: pausing OIV work because the new law is coming, while the current rules remain enforceable.
Practitioner checklist
- OIV designation, PIV list and SIIV list reconciled and held under the right classification.
- Annual SIIV update and rule 20 indicators sent between 1 and 30 November.
- Each sector rule has an owner and evidence.
- Every SIIV has a current homologation decision and audit.
- Qualified detection covers all SIIV segments, including recovery sites.
- Incident notification to ANSSI rehearsed through the approved channel.
- Admin and service accounts on SIIV inventoried and reviewed.
- Supplier contracts include auditability clauses.
- Loi Résilience progress tracked with a planned NIS2 gap analysis.
Standards and references
- ANSSI: Le dispositif SAIV
- ANSSI: FAQ, systèmes d'information d'importance vitale
- ANSSI: LPM, foire aux questions
- ANSSI: Press release on Decree 2015-351 for OIV information systems
- SGDSN: La sécurité des activités d'importance vitale (brochure)
- Assemblée nationale: committee report no. 1779 on the projet de loi Résilience (September 2025)
- Jones Day: France moves forward on implementation of cybersecurity framework for operators of critical infrastructures (secondary)
- Squire Patton Boggs: Cybersécurité, ce que prévoit la Loi de Programmation militaire (secondary)
Related NHI Mgmt Group resources: France NIS2 Implementation Guide · EU Critical Entities Resilience Directive Guide · Critical Infrastructure Regulation Map · France SecNumCloud Guide. This guide summarises the French OIV regime under the Code de la défense and is not legal advice.