ReCyF explained for SMEs: the ANSSI cyber framework, who must apply it, and where to start

For six months, an acronym has been circulating in board meetings, insurers’ questionnaires and tenders: ReCyF, for Référentiel Cyber France. Some see it as a new constraint, others as one more standard, and most do not know whether they are concerned. This article answers in order: what it is, who must apply it (and who need not, including us), what its 20 objectives contain, and where to start when you are an SME that nothing obliges to do so.

What it is, in two paragraphs #

ReCyF was unveiled by ANSSI on 17 March 2026 at the Campus Cyber, as a “working document”. Its purpose: to translate the obligations of the European NIS2 directive (Articles 20 and 21) into concrete, verifiable security objectives for the entities that will be subject to it in France. As the transposition law has still not been enacted, the framework has no legal force yet: it will be annexed to the implementing decrees. But the agency is explicit: “there is no need to wait before acting”, and the text already serves as a de facto reference, including for insurers and clients placing contracts.

Structure: 20 objectives spread across four pillars (governance, protection, defence, resilience). Objectives 1 to 15 apply to all regulated entities; objectives 16 to 20 are reserved for essential entities, with a higher level of requirement. ANSSI has written in a principle of proportionality: “the level of effort expected is adapted to the maturity of entities and the resources available to them”. Alongside it, the agency provides a tool for comparison with other frameworks (ISO 27001, RGS, EBIOS RM), the MonEspaceNIS2 platform for pre-registration and self-assessment, and has announced a baseline set of measures, called Cyber Départ, for the least mature entities.

Am I concerned? Three questions #

⟷ scroll sideways

1. Is my sector listed? The directive covers 18 sectors: energy, transport, banking, health, water, digital infrastructure, managed IT services, public administration, space, then postal services, waste, chemicals, food, manufacturing (medical devices, electronics, machinery, vehicles), digital providers and research. Many companies discover that they appear in it indirectly.
2. Am I a medium-sized company or larger? The entry threshold is that of the European recommendation: 50 employees or €10 million in turnover or balance sheet total. Below that, you are not regulated, except for a few activities covered whatever the size (DNS providers, domain name registries, trust services, electronic communications operators).
3. Am I highly critical and large? In the Annex I sectors, a large company (250 employees or €50 million) is an essential entity: 20 objectives, ex ante supervision, fines of up to €10 million or 2% of worldwide turnover. The other regulated entities are important: objectives 1 to 15, ex post supervision, fines of up to €7 million or 1.4%. The State can also designate entities regardless of these criteria.

The 20 objectives, without jargon #

Governance (1 to 5): knowing what you have, and who decides #

• 1 · Inventory of information systems. An up-to-date inventory of your machines, applications, accounts and data flows. Without it, nothing else can be verified.
• 2 · Governance framework. A written security policy, a named person in charge, trained and committed executives: this is Article 20 of the directive, which makes management accountable.
• 3 · Control of the ecosystem. Your providers, subcontractors and cloud suppliers are part of your attack surface: know them, assess them, put security into the contracts.
• 4 · Security and human resources. Arrivals, departures, access rights, regular awareness training.
• 5 · Control of systems. Known versions, patches tracked, obsolescence managed: patch management is at its heart.

Protection (6 to 11): closing the doors #

• 6 · Physical access to premises and technical rooms.
• 7 · Secure architecture. Segmentation, firewalls that are really active, no flat network.
• 8 · Remote access. VPN, second factor, managed devices.
• 9 · Protection against malicious code. Antivirus, filtering, scanned images, fail2ban and equivalents.
• 10 · Identities and access. Named accounts, least privilege, multi-factor authentication wherever it is sensitive.
• 11 · Controlled administration. Separate administration accounts, traced, ideally through a bastion.

Defence (12) and resilience (13 to 15): see, react, survive #

• 12 · Incident identification and response. Logging, detection, a written procedure, and reporting to ANSSI within 24 hours, 72 hours and one month. Without detection, no reporting is possible: that is the role of a SIEM.
• 13 · Continuity and recovery. Backups out of reach, a recovery plan, tested restores.
• 14 · Crisis response. A crisis team, contacts, communication, decisions under pressure.
• 15 · Exercises, tests and training. Because a plan that has never been played out is not a plan.

Essential entities only (16 to 20) #

16 a formal risk-based approach, 17 regular security audits, 18 hardened configuration of resources, 19 administration from dedicated resources (separate administration workstations and network), 20 continuous security monitoring. These are the most expensive objectives, and the ones that distinguish an organisation that has security from an organisation that steers it.

Where to start when nothing obliges you #

A twenty-person SME will not implement twenty objectives in a quarter, and ANSSI does not ask it to. The 2025 Cybermalveillance.gouv.fr barometer shows where the real gaps are: 26% of small businesses and SMEs have a second factor on remote access, 16% have detection, 31% have an incident procedure. Here is the order we recommend, based on effort versus risk.

1. Objective 1, the inventory. One day, one spreadsheet: machines, applications, administrator accounts, providers, where the data is. Everything else follows from it, and it is the first document a client, an insurer or ANSSI will ask for.
2. Objective 10, the second factor. On e-mail, remote access, administration consoles. It is the measure that stops the most attacks for the least money.
3. Objective 13, a backup that ransomware cannot reach. Offline or immutable, and a restore tested once a quarter, timed.
4. Objective 5, patches. Know which versions are running, and apply security patches within days, not quarters. The exploitation window is now counted in hours.
5. Objective 12, a one-page incident procedure. Whom to call, what to unplug, what not to erase, who informs customers and the CNIL. Pinned up, not filed away.

The realistic timetable #

The transposition text is expected in plenary session at the National Assembly in September 2026, after the referral to the Court of Justice of the European Union against France on 8 July. The decrees will follow, with ReCyF in an annex. ANSSI has announced a compliance period of around three years from the publication of the requirements, and a support phase before the first penalties. In other words: the horizon is 2029, but pre-registration is open, self-assessment is available, and the five objectives above can be dealt with in a few months. Those who have done them in 2026 will approach the rest calmly; the others will do it under pressure from a client or an inspection.

Inventory, second factor, backups out of reach, patches tracked, incident procedure: these are the first five building blocks of our managed services, and we applied them to ourselves before offering them. If you want to know where you stand against ReCyF, whether or not you are obliged to, let us talk.

Sources #

• ANSSI, NIS 2 : l'ANSSI poursuit et renforce sa dynamique d'accompagnement (NIS 2: ANSSI continues and steps up its support, 17 March 2026) and NIS 2 directive page
• ANSSI, MonEspaceNIS2 and MesServicesCyber
• Le Monde Informatique, L'Anssi publie un référentiel accompagnant la conformité NIS2 (ANSSI publishes a framework to support NIS2 compliance, March 2026)
• Directive (EU) 2022/2555 of 14 December 2022, text on EUR-Lex
• Solutions Numériques, NIS2 : Bruxelles traîne la France devant la justice européenne (NIS2: Brussels takes France to the European Court, July 2026)
• Cybermalveillance.gouv.fr, Baromètre de la maturité cyber des TPE-PME 2025 (2025 barometer of cyber maturity in small businesses and SMEs)