Frame · Information security policy (PSSI) & governance
Your client asks for your security policy. You send it.
A security policy delivered as more than 10 documents, annexes included, written with your IT team, ready to show your customers and suppliers.
A framework information security policy (PSSI) and 5 annexes, with their attachments, written from every obligation that applies to your sector.
- over 10 to 12 weeks
- 7 steps
- of work in total
- 20 to 30 h
- from your IT team
- 2 to 3 people
- excl. VAT, by size
- From €7,500
Who you will show it to
Customers, insurer, authorities: each will ask you for written proof. Here is what you will hand them.
Customers and contractors
- Framework PSSI
- IT acceptable use policy
You answer the organisational part of their security questionnaires and tenders, with a document to back it up.
Insurer
- Framework PSSI
- IT acceptable use policy
- Risk analysis
- Recovery plan after a cyberattack
- Incident management procedure
- Others
You answer their questionnaire with a document behind each answer: rules approved by management, a risk analysis, recovery after a cyberattack with acceptable downtime and data loss, tested backups, an incident response, and the cyber hygiene and training rules for your staff.
NIS2
- Obligations matrix
- Framework PSSI
You know what applies to you, and the matrix sets out your NIS2 path.
CNIL
- GDPR roadmap
- Data breach register
The security measures the GDPR expects (Art. 32), and what remains to be done, by priority. You remain the data controller. DMC DEFENSE does not provide legal advice: for a contract, a dispute or dealings with the CNIL, consult your lawyer.
Security accreditation (public sector)
- Risk analysis
- Action plan
- IT side of the continuity plan
The ANSSI and DINUM guide asks for a risk analysis, an action plan and a resilience plan, and states that this documentation “must not be written specifically for the accreditation process”: your PSSI provides them.
For SMEs and mid-sized companies, local authorities, social housing providers, mixed-economy and local public companies, chambers of commerce, educational institutions and medico-social associations, when the IT team, in-house or outsourced, carries security.
What penetration testing and monitoring add:for SMEsfor local authorities
A matrix maps each domain of the French State's PSSIE (ANSSI) to your PSSI: see it in our documents
Why choose us?
We start from your IT, not from a template.
A security rule is only worth something if it holds on your servers, your accounts and your backups. Writing it takes technical expertise, not just a good grasp of the legal texts.
Automated form or AI-generated template
A generic document produced in a few hours by an automated form, that nobody has checked against your IT. A surface-level risk analysis, with no depth.
Lawyer or generalist consulting firm
A sound reading of the legal texts, but nobody to understand your implementation challenges or check that a rule will hold once deployed.
DMC DEFENSE
Rules written from the legal texts, implemented in your information system, in three stages:
- Our GDPR experts write the rules of your PSSI based on the texts that apply to you (GDPR, NIS2).
- Our cybersecurity consultants design how those rules are put into practice, tailored to your information system.
- With the SOC, our Microsoft-certified SOC analysts apply them in your Microsoft 365, then monitor it 24/7.
Drawing on international experience, we cover the most common attack scenarios and apply recognised good practice (ANSSI, ENISA). Each rule is checked with your IT team before it is written.
The criteria of risk management consulting, and what we do with them.
- Measures that fit the organisation
- Rules your IT team can apply, kept up to date by the yearly review if you order it.
- Security expert consultants
- A team led by Julien Dubois, founder: critical and militarized infrastructure, satellite experience, master's in cybersecurity, Microsoft SC-300 certification (secure identity management). Within the team: Microsoft Cybersecurity Architect certification (SC-100).
- A risk map
- Your risks before and after treatment, rated on scales agreed with you, and the residual risks you accept knowingly.
- A proven method
- EBIOS RM, ANSSI's risk analysis method.
Source: ANSSI PACS framework, version 1.1, June 2025.
Each step feeds your framework PSSI and its annexes
Each step feeds the framework PSSI and the annexes your teams will apply. The order matters: you don't harden a system whose risks you haven't defined, and you don't log a network you haven't segmented. The sequence follows the objectives of ReCyF, ANSSI's NIS2 reference framework (working draft, March 2026).
The detail of the 7 steps, their durations and deliverables fits on a one-page sheet: download the PSSI sheet (PDF, in French)
Step 1 · 2 to 3 h
Legislation and governance
Deliverable: Obligations matrix + roles and responsibilities + security requirements for your suppliers + awareness plan + GDPR roadmap
Establish the obligations that genuinely apply to your organisation, with their deadline and owner, rule out those that do not concern you, and decide who carries security in your organisation.
- GDPR: security of processing (art. 32), data breaches (art. 33)
- NIS2 and the ANSSI ReCyF framework; RGS and sector-specific frameworks depending on your activity
- Roles and responsibilities: who carries security, who decides, liability of the executive and the elected official
- User awareness and security requirements imposed on suppliers
- Likelihood and severity scales, agreed before the risk analysis
Step 2 · 3 to 6 h, in one or two sessions
Main risks and threats
Deliverable: Map of business assets and supporting assets + feared events + five risk scenarios scored likelihood × severity + risk treatment plan
Move from a diffuse worry to five named scenarios, scored and ranked, that your management can understand and arbitrate.
- Ransomware: the real attack chain, from email to encryption
- Mailbox compromise, payment fraud, data leaks, lateral entry via a supplier
- EBIOS RM method: business assets and supporting assets, feared events, risk sources, strategic and operational scenarios
- Rating of each scenario on the scales agreed in step 1
- Treatment plan: the measure chosen for each risk, taken up in steps 3 to 7
Step 3 · about 3 h
Maintaining security condition
Deliverable: MCS procedure + three tracked indicators (patch application rate, average age of missing patches, date of the last restore test) + IT side of the business continuity plan (recovery plan) and restore test report
Define who updates what, how often, and how you prove it to an auditor twelve months later.
- Asset inventory: what you don't know, you don't protect
- End-of-support systems: inventory and exit plan
- Maintenance windows and emergency patches
- Backups: the 3-2-1 rule, offline copy, restore testing
- IT side of your business continuity plan: with your business managers, acceptable downtime and data loss for each application, then the restart order
- Evidence: what to keep to demonstrate the MCS
Step 4 · 3 to 4 h
Authentication and access control
Deliverable: Access policy + onboarding/offboarding/transfer procedure + access review schedule + IT acceptable use policy
Close access that should no longer exist, and harden what remains, starting with privileged accounts.
- Multi-factor authentication: scope, exceptions, methods to avoid
- Privileged, service and shared accounts: inventory, separation, vaulting
- Onboarding, offboarding, transfer: the procedure that is almost always missing
- Periodic access review: who does it, how often, on what evidence
- IT acceptable use policy: the usage rules every user accepts
Step 5 · 3 to 5 h
Fine-tuning and system hardening
Deliverable: Reference configurations per system type + gaps identified, prioritised
A penetration test verifies that the reference configuration holds against a real attacker. Discover Offensive Security
Fix a reference configuration for each type of system, and measure the gap with your fleet, based on the baseline taken before step 1.
- Workstations: lockdown, encryption, local rights
- Servers and directory: unnecessary services, obsolete protocols
- Email: SPF, DKIM, DMARC, attachment filtering
- Network equipment and exposed administration interfaces
- The principle of least privilege applied in practice
Step 6 · 3 to 4 h
Network segmentation
Deliverable: Map of your IT system and suppliers + target architecture diagram + authorised flow matrix
Ensure that the compromise of one workstation does not hand over the entire information system.
- Segmentation: by use, by sensitivity, by population
- Inter-zone filtering and authorised flow matrix
- Remote access and administration workstations
- Guest networks, wifi and connected devices
- Interconnections with suppliers and, where applicable, building technical systems
Step 7 · 2 to 3 h, then 1 h of approval
Logging and incident management
Deliverable: Logging policy + incident management procedure + quick-reaction sheets and crisis directory + personal data breach register + residual risks accepted by management + prioritised action plan
A 24/7 SOC reads the logs the policy has just defined, and acts on alerts. Discover the 24/7 SOC
Be able to answer "what happened?" and know who acts when an incident occurs. Then close the programme: risks re-rated, action plan handed over, PSSI approved by management.
- What to log, for how long (the CNIL position), with what timestamping
- What should trigger an alert, who reads it, and what happens at night
- Incident and crisis management: who decides, who to notify, quick-reaction sheets, a crisis directory kept outside the IT system, notifying the CNIL within 72 h and NIS2 reporting
- Risks re-rated after treatment: the residual risks you accept
- Prioritised action plan and approval of the PSSI by management
- Deliverables
- The framework PSSI (7 chapters) and 5 annexes, with their attachments. The annexes are arranged by recipient: A IT acceptable use policy, B Technical directives, C Incidents and crises, D Continuity and recovery (IT side of the business continuity plan), E Oversight and compliance, including the GDPR roadmap. Each carries its dated attachments (asset inventory, network diagram, restore test report, registers, maps)
- Format
- 7 steps over 10 to 12 weeks, 20 to 30 h of work in total: video-call sessions with you, work by our consultants between sessions. Indicative durations, at no extra cost if a step takes longer
- Your team
- 2 to 3 people throughout, who approve each step; management and HR optional in session, management approves the PSSI
One engagement, and a yearly review if you want one
The price depends on the organisation's size and scope.
7,500 – 20,000€ excl. VAT per engagement
- By size
- €7,500 excl. VAT up to 50 users, €15,000 up to 150, €20,000 above (quoted if the scope is complex: several sites or entities).
- With the SOC
- With a 12-month SOC commitment: 25% off with Basic, 50% with Standard, 75% with Premium, i.e. from €1,875 excl. VAT.
- Yearly review
- Optional, ordered each year, never renewed automatically: €1,125, €2,250 or €3,000 excl. VAT depending on size; €375, €750 or €1,000 excl. VAT for SOC subscribers on a 12-month commitment. A session of about three hours and an update of the affected chapters: a record of the regular assessment the GDPR asks for (art. 32.1 d).
- Public buyers
- Below the €60,000 excl. VAT threshold: the engagement can be awarded without prior advertising or competition (art. R. 2122-8 of the French public procurement code).
It all starts with a scoping conversation.
A free conversation to map your organisation, your obligations and the scope of the programme. No commitment.
After you send it
Reply within 24 business hours
An expert reads your request and gets back to you to qualify your need.
Free audit
On Microsoft 365: a one-hour audit of your tenant's posture (Secure Score, identities, Defender) and your priority flaws. Otherwise: we scope your need (pentest, security policy) and set the price. No commitment.
Dedicated contact
The same DMC expert follows you end-to-end, with no call-center in between.