NIS2: what the directive says, where France stands, and why we do all this without being required to

An attentive reader of this blog might wonder: why does a company of a few people, in Strasbourg, run a bastion that records every session, a SIEM across 38 machines, immutable backups, deliberate rather than automatic patching and a self-audit against the 42 ANSSI measures? No law requires it of us. The answer fits in three letters and a number: NIS2. This article explains what the directive requires, where France stands in autumn 2026, and why a provider that is not subject to it has every interest in behaving as if it were.

NIS2 on one page #

Directive (EU) 2022/2555, known as NIS2, was adopted on 14 December 2022 and had to be transposed by each Member State by 17 October 2024. It replaces the first NIS directive of 2016, which in France only concerned a few hundred operators of essential services. NIS2 changes the scale: 18 sectors (11 “highly critical” ones such as energy, health, transport, banking, water, digital infrastructure and business-to-business IT service management; 7 “other critical sectors” such as manufacturing, food, postal services, research and digital providers), and two categories of entities: essential entities and important entities, distinguished mainly by size and the criticality of the sector. The entry criterion is that of a medium-sized company: from 50 employees or €10 million in turnover or balance sheet total, in a listed sector, you are covered, with exceptions that apply whatever the size (DNS providers, domain name registries, trust services, telecoms operators). In France, ANSSI estimates the number of entities concerned at around 15,000, compared with a few hundred under NIS1.

The obligations fit in three articles. Article 20 makes management bodies accountable: they approve the measures, oversee their implementation, and must undergo training. Article 21 imposes ten families of risk management measures: risk analysis and security policies, incident handling, business continuity and backup management, supply chain security, security in the acquisition and maintenance of systems (including vulnerability management), assessment of the effectiveness of measures, IT hygiene and training, cryptography, human resources security and access control, multi-factor authentication and secure communications. Article 23 requires significant incidents to be reported: an early warning within 24 hours, a notification within 72 hours, a final report within one month. Administrative fines go up to €10 million or 2% of worldwide turnover for an essential entity, €7 million or 1.4% for an important entity.

Where France stands in autumn 2026 #

Nowhere, legally speaking, and that is a problem. The bill “on the resilience of critical infrastructure and the strengthening of cybersecurity”, which transposes NIS2, the critical entities resilience directive and the DORA regulation in one go, was presented to the Council of Ministers on 15 October 2024 and passed by the Senate at first reading on 12 March 2025. The National Assembly completed its examination in a special committee in September 2025, after which the text stayed off the agenda, caught between government instability and substantive disagreement, notably over intelligence provisions that MPs refused to see grafted onto the text. The result: on 8 July 2026, the European Commission referred France to the Court of Justice of the European Union (along with Ireland, Spain and the Netherlands), after a letter of formal notice in November 2024 and a reasoned opinion in May 2025. It is seeking a lump sum and a daily penalty payment until the law is enacted. The debate in plenary session is announced for September 2026. As we write, no French entity is therefore bound by NIS2 in the strict sense.

Sanfytech is not subject to it. So why? #

Let us say it clearly to avoid any marketing misunderstanding: we are well below the thresholds. A company of our size is neither an essential nor an important entity, even in the digital infrastructure or managed IT services sectors where we operate. Yet three reasons lead us to build our infrastructure as if we were.

1. The supply chain reaches down to us. Article 21 requires each entity concerned to manage the security of its direct suppliers, and the third ReCyF objective, “control of the ecosystem”, turns this into a verifiable obligation. A 60-person food company, a local authority, a healthcare facility, a manufacturer: the day one of them entrusts us with its website, its business application or its hosting, it will have to answer for us. It will ask us precise questions, and “trust us” will not be an acceptable answer. We prefer to have the answers, with the evidence, before anyone asks.
2. Attackers have not read the directive. Ransomware does not check your headcount. The Article 21 measures are not an arbitrary regulatory list; they are the distilled essence of what defeats common attacks: controlled administrator access, patches applied, backups out of reach, detection. Our post-mortem of a hardware failure and our form turned into a spam relay had nothing to do with NIS2; it was exactly the same building blocks that allowed us to understand and fix them.
3. Formal requirements always end up arriving. Labels such as ExpertCyber, cyber insurers’ questionnaires, security clauses in contracts, GDPR Article 32: they all converge on the same objectives as ReCyF. Building once, properly, and documenting as you go costs less than reconstructing everything under the pressure of a tender or an incident.

Our building blocks against the 20 objectives #

⟷ scroll sideways

The table above says the essentials, but a few correspondences deserve to be spelled out, because they shed light on choices that might have seemed excessive in isolation.

• Remote access and administration (objectives 8, 11, 19). The framework calls for named, traced administrator access, from dedicated resources, with strong authentication. That is word for word what our Warpgate bastion does: a single door, outside the fleet it administers, SSO and a second factor, every session recorded and replayable, a single key on the fleet instead of three. Objective 19 is reserved for essential entities; we addressed it anyway because it costs one VM.
• Detection, response, monitoring (objectives 12 and 20). Reporting an incident within 24 hours assumes you have detected it. Without centralised logging, an entity learns of the intrusion from the ransom note. Our Wazuh SIEM keeps twelve months of alerts away from the machines that produce them, monitors SSH keys in real time, and can tell when a banned address has ended up getting in. The response part (written procedure, who calls whom, preservation of evidence) is in progress: it is the most important orange dot in our table.
• Keeping systems secure (objectives 5 and 9). Vulnerability and patch management: PatchMon to see the state of the fleet and decide, Trivy for container images, fail2ban and CrowdSec for edge defence, and pinned versions everywhere.
• Continuity and backups (objective 13). Article 21 explicitly names backup management and recovery. Our 3-2-1 rule with an immutable copy, the disaster recovery plan and Proxmox high availability are how we put it into practice. Restores are tested; a full crisis exercise, on the other hand, has not yet been run, hence the orange on objectives 14 and 15.
• Control of the ecosystem (objective 3). We can say where the data is hosted (France, on dedicated servers we administer), who our sub-processors are and under which law they operate. Our article on the Cloud Act explains why this question is not theoretical for an entity that will itself have to answer for it.

If you are concerned: the questions to ask your provider #

If your organisation exceeds the thresholds in a listed sector, your hosting provider, your managed services provider and your business application developer become links in your compliance. Here is what we advise you to ask them, and what we would answer.

• Who can log in to my servers, and can you prove it to me? An acceptable answer includes named accounts, strong authentication, and the ability to replay an administration session. A key shared in a password manager is not an answer.
• How will you know that an incident concerns me, and how quickly will you tell me? Your 24 hours start when you become aware of it; they therefore depend on your provider’s detection and its contractual commitment to notify you.
• Where are my backups, who can delete them, when did you last test a restore? The immutable copy and the date of the last test are worth more than any advertised availability rate.
• How long do you take to apply a critical patch, and how do you track it? A live inventory of versions is worth more than a promise of automatic updates.
• Where is the data hosted and under which law? Country, provider, sub-processors. The answer should fit on one page and be attachable to your register.

What we take away from it #

NIS2 is often presented as one more constraint. We read it differently: it is the first time a European text has described, sector by sector, what a seriously administered infrastructure is, and given buyers the right to demand evidence. For a provider, that is an opportunity: the day the question “and you, how do you do it?” comes, the difference between those who built and those who promised becomes visible. This blog is, article after article, our way of answering before we are asked. The orange column of our table will be dealt with in the coming months, and documented here in the same way.

If your organisation falls within the scope of NIS2, or if one of your clients has passed its requirements on to you, our managed services and our sovereign hosting are built to meet them with evidence rather than with promises. Let us talk.