NIST CSF 2.0, IdentifyID.IM-01

Submit your networks or information systems to a mandatory security audit and severity-impact assessment by the Agence Nationale de la Cybersécurité at least once a year, or more often where circumstances require it.

Set a plan for cybersecurity audits and audit whether the measures the Act and this decree require are in place and comply with law, internal rules, contracts and best practice (Section 16).

Undergo a further mandatory periodic security audit eighteen months after your certificate is issued.

Give the cybersecurity authority confidential access, on request, to the arrangements you have made to secure your network, and submit your network to a security and integrity inspection the authority conducts or commissions.

Submit your information systems, at your own cost, to a control the cybersecurity authority conducts to verify their security level and your compliance with security rules.

Conduct regular cybersecurity risk assessments and impact analyses, participate in the Administration's annual National Cybersecurity Risk Survey and supply the information it requests, and obtain and renew a cyber audit certificate and a cybersecurity inspection-and-evaluation certificate from the Administration, taking appropriate corrective action within the time the Administration sets on any gap the audit or inspection finds.

After the competent authority notifies findings, identify the root cause or causes, define a corrective action plan and demonstrate the correction to the authority's satisfaction within the period agreed with it (point IS.D.OR.225).

If you are a critical-impact entity, be able to demonstrate compliance with the cybersecurity management system and the controls at your competent authority's request, no later than 24 months after the controls are adopted and the management system is established, by independent third-party security audits or a national verification scheme, and repeat the verification at the latest 36 months after the first and every 3 years thereafter (Article 31).

After the competent authority notifies findings, identify the root cause or causes, define a corrective action plan and demonstrate the correction to the authority's satisfaction within the period agreed with it (point IS.I.OR.225).

Document, periodically test, evaluate and audit the implementation of the security measures, through auditors with expertise in IT security and payments who are operationally independent, and make the entire audit report available to competent authorities on request. If you use the transaction risk analysis exemption of Article 18, have the methodology, the model and the reported fraud rates audited at least yearly, by an independent and qualified external auditor in the first year and at least every 3 years after that (Article 3).

Demonstrate conformity of a product that meets a description in Annex I through the procedures of Article 32(2) and (3) of Regulation (EU) 2024/2847, and of a product that meets a description in Annex II through Article 32(4) of that Regulation.

Perform a conformity assessment against those essential requirements and, once they are fulfilled, issue an EU declaration of conformity, by which you become responsible for compliance with them (Article 36(2) and (3)).

For a Class A system or application, certify it before production use: give the statement that it meets its functionality requirements, pass the approved interoperability test, and obtain the information-security assessment certificate from an information-security assessment body (sections 85, 86 and 87).

Evaluate and revise your security systems as technology evolves, and make the changes your security practices, measures, and techniques need.

Periodically evaluate and revise your security systems, and introduce necessary changes as technology evolves, under the Agence Nationale de la Cybersécurité's oversight.

At the medium or high tier, conduct an internal or external audit of compliance with these Regulations at least once every 24 months.

By April 15 of each year, submit to the Superintendent electronically either a written certification that you materially complied with this Part for the prior calendar year or a written acknowledgment identifying the sections you did not materially comply with and a remediation timeline, each signed by your highest-ranking executive and your Chief Information Security Officer.