What penalties does NIS 2 provide for?

The directive provides for proportionate financial penalties of up to 2% of worldwide turnover for essential entities and 1.4% for important entities.

Does the pre-assessment certify my compliance?

No. It separates what is observed from the outside, without any contact with your systems, from what you declare. It gives you a dated, verifiable starting point, not a certificate.

The Référentiel Cyber France, published by ANSSI as a working version on March 17, 2026, lists the security objectives and recommended measures for meeting NIS 2. Objectives 1 to 15 apply to important and essential entities, objectives 16 to 20 to essential entities only.

NIS 2 law: review in the French National Assembly postponed, new date expected

NIS 2 pre-assessment · free · 10 minutes

NIS 2 is coming. Find out today what ANSSI will see tomorrow.

A pre-assessment aligned with ANSSI’s framework (ReCyF). What can be seen from the Internet, we check ourselves, without touching your systems. The rest, you declare. You leave with a dated, sealed file that your insurer, your board or an auditor can verify.

Start my pre-assessment Does it apply to me? (ANSSI simulator)

Free, no credit card. Passive analysis: no requests are sent to your machines.

What ANSSI says

Three obligations, 18 sectors, proportionate penalties

sectors of activity covered, mainly medium-sized and large companies, local authorities and public administrations.

obligations: register with ANSSI, manage cyber risks, report significant incidents.

2 %

of worldwide turnover: maximum penalty for an essential entity (1.4% for an important entity).

ReCyF security objectives apply to an important entity; 20 to an essential entity.

Sources: ANSSI — MesServicesCyber, NIS 2 page; ReCyF v2.5, working version of March 17, 2026; legislative file, French National Assembly.

How it works

Two parts, never mixed

A. Observed by us

What can be seen from the Internet, matched against the relevant ReCyF requirements: exposed inventory (1.1, 5.A.1), visible service providers (3.A.1), patches on exposed equipment and actively exploited flaws (5.B.4, 5.B.7), reachable internal services (7.A.7, 7.B.4), encrypted access (8.1), remote access (8.2), directories (11.B.1).

B. Declared by you

12 yes / no / I don’t know questions on governance, backups, accounts and crisis management. They are presented as declarations, never as findings.

Sealed and dated

The file receives a SHA-256 fingerprint, a position in an append-only register and a timestamp issued by a third-party authority (RFC 3161). Your insurer can verify it online, without having to take your word for it.

What this file is not: a certificate of compliance. From the outside, only some of the requirements can be seen; the ReCyF is still a working version. We say so in the file itself.

Your pre-assessment

10 minutes, a file you can show

1. Your company
2. 12 questions
3. Your contact details

Your company Your company’s domain name Your company name Your NIS 2 status

Not sure? ANSSI’s official simulator will tell you in a few minutes.

This domain belongs to my company, or I hold a mandate to have it analyzed (terms of use).

Frequently asked questions

What business leaders ask us

Does it apply to my company?

According to ANSSI, several thousand entities across 18 sectors are covered, mainly medium-sized and large companies, local authorities and public administrations. An entity is “essential” from 250 employees, or €50M in turnover and €43M on the balance sheet; “important” from 50 employees or €10M. ANSSI’s simulator gives a first indication.

When does the law apply?

The bill on the resilience of critical infrastructure and the strengthening of cybersecurity was adopted by the French Senate on March 12, 2025 and by the special committee of the National Assembly on September 10, 2025. Its debate in plenary session, scheduled for October 7, 2026, was postponed by the Assembly on October 6; the new date has not yet been set. ANSSI encourages future covered entities to get started now.

Why a “sealed” file?

Because an insurer, a client or an inspector won’t ask you what you think you’ve done, but what you can prove, and as of what date. The SHA-256 fingerprint guarantees the file hasn’t been altered; timestamping by a third-party authority proves its date independently of us.

Do you touch my systems?

No. Part A reads only public sources: certificate registers, public DNS, a public exposure database, and CISA’s catalog of actively exploited flaws. No requests are sent to your machines.

And after the pre-assessment?

The file gives you your priorities. To address them, you can use the platform on your own or with support from Najib Bredaa, who validates each action with you and keeps an enforceable record of it. See the plans.