Contents (4 sections)
There is a free, concrete security framework, written in French, and yet underused: the ANSSI IT hygiene guide and its 42 measures. Not a 400-page theoretical framework, but a list of measures you can check one by one: mapping, segmenting, backing up, logging, managing privileged accounts… We ran the full exercise on our own infrastructure, scoring ourselves as we would score a client. Here is the method, and what the exercise really taught us.
First, be clear about what the exercise is (and is not) #
A clarification that avoids many commercial misunderstandings: neither ANSSI nor the CNIL “certifies” a company’s IT hygiene. Anyone selling you an “ANSSI certification” of this kind is selling thin air. The guide is a framework for self-assessment and improvement; schemes such as MonAideCyber or the ExpertCyber label (run by AFNOR) exist to go further with an outside view. The self-audit has a virtue of its own: it is immediate, free and honest, provided you play the game.
The method: a grid, evidence, no leniency #
- Turn the 42 measures into a table: one row per measure, four possible statuses (compliant, partial, non-compliant, not applicable) and an evidence column. Without tangible evidence (a config, a screenshot, a document), a “compliant” is not one.
- Score what is real, not what is intended: “we should have a procedure” = non-compliant. “It is in someone’s head” = non-compliant. The golden rule of the exercise: the aim is to find holes, not to reassure yourself. An audit that ends at 42 out of 42 the first time is a failed audit.
- Half a day to two days depending on size: the guide is designed to be practical. Block out the time, do it in one go, date the result.
- Prioritise in three batches: what can be fixed in an hour (often a surprising amount), what requires a project, what calls for an organisational decision.
- Repeat every year: the value lies in the trajectory. The difference between two audits says more than each snapshot on its own.
What our own audit showed #
The most instructive result is not a score: it is where the gaps were. On the technical measures (network segmentation, backups, encryption, access hardening, updates), the infrastructure held up well against the grid: it is our job, and the articles on this blog document its components. The items to address were almost all on the side of formality and governance: what exists in practice but is not written down, procedures that live in people’s heads, roles that are performed but never named. And that is, in our experience, the typical pattern of small technical organisations, the exact opposite of large organisations, where the paperwork is impeccable and the technology lags behind.
A security measure that is not written down survives neither a departure, nor a night of incident, nor a customer questionnaire. Writing it down is not bureaucracy: it is what makes it transferable.
What it brings in practice #
- Prioritisation you can defend: invest where the grid shows a gap, not where the latest press article caused alarm.
- Ready answers: security questionnaires from large accounts, cyber insurers’ requirements, tenders: the same questions keep coming back, and the audit answers them with evidence.
- A common language with clients: when we audit an infrastructure, the grid is the same one we apply to ourselves, and we can show our own exercise.
Security driven by a framework rather than by intuition follows the same logic as our CVE monitoring or our 3-2-1 backups: verifiable lists, evidence, a rhythm. If you want to run the 42 measures on your information system (with the grid, the evidence and an outside view), it is an exercise we provide the tools for.
