ReCyF, the Référentiel Cyber France, is ANSSI’s reference for the security objectives that essential and important entities will have to meet under France’s NIS2 transposition. Secrato keeps each objective, its acceptable means of compliance and your evidence connected, so you can show ANSSI where you stand.
In short: Secrato helps French organisations prepare for NIS2 with ReCyF. Check whether you will be an essential or important entity, pre-register through MonEspaceNIS2, work through the 15 security objectives that apply to every entity and the 5 additional objectives for essential entities, and get ready to report significant incidents to ANSSI within 24 hours, 72 hours and one month.
Translate the ReCyF security objectives into owned controls, from governance and the inventory of information systems to access management, incident response and continuity. See which acceptable means of compliance are in place and where action is still needed.
Record incidents, assess whether they are significant and keep the reporting clock in view. Prepare the initial alert, the incident notification and the final report with facts, impact and measures in one place.
Record incidents, assess whether they are significant and keep the reporting clock in view. Prepare the initial alert, the incident notification and the final report with facts, impact and measures in one place.
ReCyF asks every entity for a security governance framework, and essential entities also need a risk-based approach and regular audits of their information systems. Keep risks, decisions and audit findings tied to the objectives they affect, so management can follow how security is steered.
Beyond the core outcomes above, these capabilities support the wider ReCyF programme.
Connect controls and requirements across frameworks to identify shared coverage and reduce duplicated assessment work.
Keep risks connected to the controls and evidence behind their treatment, with visibility into ownership and residual exposure.
Bring evidence together, review control readiness and manage findings, with structured assessor access where appropriate.
Manage requirements, controls, evidence, policies and status together, giving teams a current view of where implementation stands.
Connect internal and external systems through APIs and integrations to support evidence collection and reduce manual chasing.
Share relevant security and compliance information with stakeholders through controlled public or gated access.
ReCyF builds on existing ANSSI guidance, such as the Guide d’hygiène informatique, and shares much of its ground with ISO/IEC 27001, creating significant opportunities to reuse existing cybersecurity controls. The Unified Control Library maps shared controls across frameworks so teams can see where existing work already contributes to ReCyF, while keeping clear that mapping shows correspondence, not equivalence.
+ More & growing
ReCyF, the Référentiel Cyber France, is the cybersecurity reference published by ANSSI for France’s NIS2 transposition. It sets out 20 security objectives and, for each, acceptable means of compliance that entities can use to show they meet them. ANSSI published version 2.5 as a working document on 17 March 2026; a final version will follow the legislative process and a public consultation.
The French NIS2 bill covers essential and important entities in 18 sectors, generally medium-sized and large organisations, and some organisations regardless of size. Fifteen objectives apply to every entity; essential entities also have to meet five more, covering a risk-based approach, audits, secure configuration, administration from dedicated resources and security monitoring.
Secrato maps the ReCyF objectives and acceptable means of compliance to controls, owners and evidence, keeps risks and incidents connected to the objectives that address them, and tracks the reporting deadlines for significant incidents. Work you already did for ISO/IEC 27001 or the ANSSI hygiene guide counts where controls correspond.
Not yet. The bill on the resilience of critical infrastructure and the strengthening of cybersecurity (projet de loi Résilience) was adopted by the Senate in March 2025 but, as of October 2026, still awaits a vote in the National Assembly. ANSSI encourages future essential and important entities to start preparing now, and ReCyF is the reference to prepare with.
ReCyF is not a one-off project: objectives, risks, incidents and governance keep moving. See how Secrato keeps that work connected and gives your team a clear view of readiness before ANSSI asks.
Data-driven realtime compliance for continuous readiness
Continuous readiness through structured assessments
Centralize, automate, and stay ahead of risks
Connect policies, procedures and evidence to controls
Choose what you allow per category. You can change this anytime via the cookie button at the bottom left. More in our cookie policy and privacy statement.
Required for the site and portal to work. Always on.
Remembers choices such as language and region.
Anonymised analytics to improve the site (Google Analytics).
Advertising and campaign measurement.
