Runs an essential service, in France

Loi n° 2018-133 du 26 février 2018, Titre Ier, Chapitres II et III, art. 5, 6, 10, 11 et 12 · Read the law's page

• This binds a fournisseur de service numérique (digital service provider) operating an online marketplace, an online search engine or a cloud computing service above the fifty-employee, EUR 10 million turnover threshold, and an opérateur de services essentiels (operator of essential services) the Premier ministre designates by sector; the operator-of-essential-services class is reached by declaring that you operate an essential service.
• Identify the risks that threaten the security of the networks and information systems you use to provide your services in the European Union, and take the necessary and proportionate technical and organisational measures to manage those risks, prevent an incident from compromising your networks and systems, and minimise its impact, so as to guarantee the continuity of your services.
• Cover each of: the security of your systems and installations; incident management; business-continuity management; monitoring, audit and control; and compliance with international standards.
• Where you are instead designated as an operator of essential services, apply the security rules the Premier ministre sets under Article 6 at your own expense, covering governance, protection, defence and resilience of your networks and systems.

Loi n° 2018-133 du 26 février 2018, Titre Ier, art. 7 et 13 · Read the law's page

• This binds a fournisseur de service numérique (digital service provider) operating an online marketplace, an online search engine or a cloud computing service above the fifty-employee, EUR 10 million turnover threshold, and an opérateur de services essentiels the Premier ministre designates by sector; the operator-of-essential-services class is reached as on this jurisdiction's companion security-requirements row.
• Declare to ANSSI, without delay after becoming aware of it, an incident affecting the networks and information systems necessary to provide your service, where the incident has or is likely to have a significant impact on the continuity of the service (an operator of essential services) or on the provision of the service in the European Union (a digital service provider).

Article 14, texte adopté n° 78 (2024-2025), Sénat, 12 mars 2025 (mesures de gestion des risques) · Read the law's page

• As drafted, it would reach you where you are an essential or important entity under the bill's own designation articles (Articles 8 to 10), and Article 11 names a provider of an online marketplace, an online search engine or a social-networking-services platform among the digital providers it reaches by establishment, transposing NIS2 Article 21; the wider sector, critical-infrastructure and public-administration classes it also reaches are reached too, by declaring that you are an essential or important entity.
• In the text the Sénat adopted, take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or services: have your management body approve and oversee the security measures and receive cybersecurity training, protect your networks and systems including where you use a subcontractor, put in place tools and procedures to defend your networks and handle incidents, and ensure the resilience of your activities.
• In the text the Assemblée nationale's special committee deposited (n° 1779-A0), the choice of those measures must also take account of their capacity to be audited, the transparency of their operation, their interoperability, their resilience and the control they give over your information systems, so as to minimize technological dependence on third-party providers that give insufficient guarantees of compliance with the cybersecurity and digital sovereignty requirements set by the national strategy, and the fourth objective covers the resilience of your activities, networks and information systems.
• In that committee text, where you are an essential or important entity that provides DNS, domain-name registry, cloud computing, data-centre, content-delivery, managed or managed security services, an online marketplace, an online search engine, a social-networking platform or a trust service, implement the technical and methodological requirements set by Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, and you may rely on qualified service providers during an inspection to show your compliance with some or all of the objectives.

Article 17, texte adopté n° 78 (2024-2025), Sénat, 12 mars 2025 (notification des incidents) · Read the law's page

• As drafted, this would bind the same essential and important entities as this jurisdiction's companion risk-management row, for the reason given there.
• In the text the Sénat adopted, notify ANSSI without undue delay of any incident with an important impact on the provision of your services (one causing or liable to cause a severe operational disruption or financial loss for you, or considerable material, physical or non-material damage to another person), on a graduated clock: an initial notification within 24 hours of becoming aware of it, an intermediate notification within 72 hours of becoming aware of it updating the initial one and giving an initial assessment of severity and impact, a report on ANSSI's request, and a final report within one month of the intermediate notification, or, where the incident is not yet handled by then, a progress report within one month of the intermediate notification and a final report within one month of the incident being handled (Article 17).
• In the text the Assemblée nationale's special committee deposited (n° 1779-A0), the initial notification within 24 hours, the intermediate notification within 72 hours and the final report within one month would be the same, but an incident would count as important only where it caused or is liable to cause a severe operational disruption or significant financial losses for you, or considerable material, physical or non-material damage to another person.
• In the text the Sénat adopted and in the committee text alike (Article 17), where appropriate, notify the recipients of your services without undue delay of an important incident with a direct impact on them, and of any critical vulnerability affecting your services together with the measures or corrections they can apply in response, except for information whose disclosure would harm the interests of defense and national security.
• Where you are a qualified trust-service provider (Article 8(4)) or a trust-service provider (Article 9(3)), send the intermediate notification within 24 hours rather than 72 for an incident affecting your trust services.