Public sector · NIS2
Around 1,500 French local authorities, groupings and bodies under their oversight will enter the scope of NIS2. Your security policy, from €7,500 to €20,000 excl. VAT, stays below the €60,000 excl. VAT threshold: it can be ordered directly.
Status as of 13 October 2026
Next step
Date to be set
Plenary debate at the National Assembly, scheduled for 7 October 2026, then postponed
The French text is late, but its content will surprise no one: it transposes a European directive published in December 2022. The obligations are written. Only the exact scope and the application timetable remain to be set.
Dec. 2022
Directive (EU) 2022/2555, known as NIS2, published
Step completed17 Oct. 2024
Transposition deadline, missed by France
Step completed12 Mar. 2025
Bill passed by the Senate at first reading
Step completedSept. 2025
Text adopted by the National Assembly's special committee
Step completedDate to be set
Plenary debate at the National Assembly, scheduled for 7 October 2026, then postponed
Next step
Waiting for the Official Journal means discovering the obligations on the day they apply. A security policy takes 10 to 12 weeks to build: now is the time to write it.
NIS2 covers around 15,000 entities in France, across 18 sectors: companies, public administrations and local authorities. This page focuses on local authorities. The directive left Member States free to include them. France did, in two categories. Essential entities face the strictest supervision.
Scope of the text passed by the Senate and reworked in committee at the National Assembly. It may still change in plenary; we will update it after the final vote.
Articles 20, 21 and 23 of the directive, which the French text carries over.
Article 20
The management body approves the security measures, oversees their implementation and can be held liable. Its members must follow training in cyber-risk management. Security becomes an executive decision, no longer just an IT matter.
Article 21
“Appropriate and proportionate” measures, based on a risk-based approach:
Article 23
Any significant incident is reported to the authority (ANSSI in France) in three stages.
T0
Incident detected
The clock starts once you become aware of it
24 h
Early warning to ANSSI
72 h
Incident notification, with an initial assessment
1 month
Final report
Not to scale
Without detection, the clock never starts on time.
The National Assembly's special committee retained the principle of no financial penalty for local authorities, whereas an essential company faces up to €10M or 2% of its worldwide turnover. The obligations remain: supervisory checks, compliance orders, executive accountability. And the real cost is still that of the incident.
11%
of ransomware victims in France are local authorities
Your residents’ data falls under the GDPR, and the CNIL, the French data protection authority, can fine a municipality. The data controller is the mayor or the president: they answer for its security. The facts, with their sources:
EUR 5M
Fine imposed on 22 January 2026 on France Travail, a public body. Among the grounds: logging too weak to detect abnormal behaviour.
EUR 10,000
Fine imposed on a municipality on 11 September 2025, notably for failing to secure personal data. Other municipalities were fined in 2023 and 2024.
50%
of CNIL inspections and sanctions will target cybersecurity in 2026. Local authority cybersecurity is one of its inspection priorities.
72 h
to notify the CNIL of a personal data breach. The ceiling of €20M or 4% of turnover also applies to local authorities, their public bodies and their local public companies.
CNIL and Cybermalveillance.gouv.fr guide for local authorities (in French)
EUR 1.5M
Direct cost of the cyberattack on the town of Bondy in 2020. For the Aix-Marseille-Provence metropolis: €900,000.
The GDPR asks you to protect data, detect an intrusion and report it in time. The PSSI sets the measures, the penetration test puts them to the test, the SOC detects.
No provider makes a local authority “NIS2 compliant” on its own. Here is what we take on, and what you will need to entrust to others.
NIS2 coverage statement
Governance, risk analysis, security policy
Art. 20, 21 a
PSSI, steps 1, 2 and 7: obligations matrix, roles and responsibilities, scored risk scenarios, a document approved by the executive
Access control, multi-factor authentication, hardening
Art. 21 i, j
PSSI, steps 4 and 5: access policy, privileged accounts, baseline configurations
Assessing the effectiveness of measures
Art. 21 f
Offensive Security
Penetration test: we check the measures hold against a real attacker
Incident detection and handling, 24 h deadline
Art. 21 b, 23
24/7 SOC: detection in under 15 minutes, triage by an analyst. Prerequisite: a Microsoft 365 environment
Business continuity, backups
Art. 21 c
PSSI, steps 3 and 7: the IT side of your business continuity plan (acceptable downtime per application, recovery plan, restore test, cyber crisis). The business side of the plan stays with you, backup operations with your managed service provider
Supply chain
Art. 21 d
PSSI, steps 1 and 6: security requirements imposed on suppliers, interconnections with providers. Contract clauses remain with your legal department
Cyber hygiene and staff training
Art. 21 g
Outside our offer
We do not provide training. The PSSI steps are consulting, not a training course
Cryptography
Art. 21 h
Outside our offer
No dedicated service: the topic is covered within the access and hardening policy
You don't monitor a system whose risks you haven't defined. Order matters.
01
No commitment
Place your authority: in scope or not, in which category, with which gaps to close first.
02
7 steps, 10 to 12 weeks
Write your PSSI with your teams: governance, risks, access, segmentation, logging, following the objectives of ReCyF, the ANSSI NIS2 reference framework. A document the executive approves.
03
Depending on your environment
A penetration test to put the measures to the test, then a 24/7 SOC if your systems run on Microsoft 365.
The PSSI is billed €7,500 to €20,000 excl. VAT depending on the authority’s size.
Several municipalities in the same area? A purchasing group, or your digital administration syndicate, can make the purchase on behalf of all.
Your data stays in your environment, in your region, with no copy on our side. See our data sovereignty policy
Not directly, as the text stands. But if your intermunicipal body is in scope and your systems are interconnected, it will ask you for guarantees. And the risk does not depend on population.
No. The Article 21 measures will not change: they are in the directive. Only the exact scope and deadlines may move. A PSSI written today will still hold tomorrow. ANSSI published ReCyF, its NIS2 reference framework, in March 2026: our PSSI programme follows its objectives, and applying it can be put forward during an inspection.
The National Assembly's special committee retained no financial penalty for local authorities. The text is not final. And the authority keeps its powers of supervision and injunction.
No. If a qualified audit is required of you, by a framework, an accreditation or your own specifications, we will tell you during the free audit and will not bid on that part.
The PSSI and the penetration test are vendor-neutral: they apply to any information system. Our SOC, however, only runs on a Microsoft 365 environment; we do not offer it elsewhere.
The free audit to place your authority against NIS2: scope, category, priority gaps. Reply within 24 business hours.
Reply within 24 business hours
An expert reads your request and gets back to you to qualify your need.
Free audit
On Microsoft 365: a one-hour audit of your tenant's posture (Secure Score, identities, Defender) and your priority flaws. Otherwise: we scope your need (pentest, security policy) and set the price. No commitment.
Dedicated contact
The same DMC expert follows you end-to-end, with no call-center in between.
