Jurisdictions / France
France: ANSSI RGS and OIV Scope
France's cryptographic baseline is ANSSI's RGS Annexe B1; the France overlay adds 4 jurisdiction rules scoped to critical infrastructure (OIV, operateurs d'importance vitale) on top of the 9-rule ANSSI authority channel. Together they are the recommended activation for French enterprises and public-sector suppliers.
The French stack
- ANSSI RGS Annexe B1 v2.0: approved mechanisms, key sizes and validity horizons - the authority channel
- OIV scope: stricter expectations for operators of vital importance, carried by the France overlay
- NIS2: ANSSI-channel findings carry the NIS2 tag, serving the EU directive from the same scan
Recommended configuration
French enterprises activate the ANSSI channel plus the France overlay. Findings carry the ANSSI-RGS-B framework tag with file and line evidence, and the CBOM gives assessment teams the mechanism inventory RGS-aligned audits start from.
Frequently asked questions
Do I need the overlay if I already run the ANSSI channel?
For general RGS alignment the authority channel is enough. The overlay matters for OIV-classified infrastructure and suppliers who must meet the stricter critical-infrastructure posture.
Does this help with NIS2 in France?
Yes. The ANSSI channel co-carries the NIS2 framework tag, so the same findings serve both the national baseline and the EU directive.
Are RGS references preserved in reports?
Yes. Findings carry the rule's framework tags and references; reports are in English with the French requirement identifiers preserved.