FranceLoi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident Notification
Loi n° 2018-133 du 26 février 2018, Titre Ier, art. 7 et 13
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000036644772In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds a fournisseur de service numérique (digital service provider) operating an online marketplace, an online search engine or a cloud computing service above the fifty-employee, EUR 10 million turnover threshold, and an opérateur de services essentiels the Premier ministre designates by sector; the operator-of-essential-services class is reached as on this jurisdiction's companion security-requirements row.
- Declare to ANSSI, without delay after becoming aware of it, an incident affecting the networks and information systems necessary to provide your service, where the incident has or is likely to have a significant impact on the continuity of the service (an operator of essential services) or on the provision of the service in the European Union (a digital service provider).
These lines are LexLint's reading of the law's text. Also read by: Agence nationale de la sécurité des systèmes d'information (ANSSI) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 9 (operator of essential services) and Article 15 (digital service provider) each punish a director's own failure to satisfy the incident-declaration duty as a criminal fine («est puni de ... d'amende») rather than an administrative penalty on the entity; unlike the security-measures offence, no prior formal notice (mise en demeure) is a precondition for this one.
Penalty structure
Article 9 punishes a director of a designated operator of essential services who fails to satisfy the Article 7(I) incident-declaration duty by a fine of EUR 75,000. Article 15 punishes the equivalent failure by a director of a digital service provider, under Article 13, by a fine of EUR 50,000. These are personal criminal fines on a director, not a turnover-based penalty on the entity.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 75,000
Who enforces it
Enforcement body
The Premier ministre (Prime Minister), acting through the Agence nationale de la sécurité des systèmes d'information (ANSSI), the national network and information system security authority under Code de la défense Article L. 2321-1, which the implementing décret names as the authority conducting or commissioning the compliance controls.
Settledness
- As of
- Guidance link
- https://cyber.gouv.fr/
- Guidance body
- Agence nationale de la sécurité des systèmes d'information (ANSSI)
What this law does
Article 7 requires an opérateur de services essentiels to declare, without delay after becoming aware of it, to ANSSI (the national network and information system security authority under Code de la défense Article L. 2321-1) an incident affecting the networks and information systems necessary to provide its essential services, where the incident has or is likely to have a significant impact on the continuity of those services; the administrative authority may inform the public of the incident after consulting the operator.
Article 13 imposes the equivalent duty on a digital service provider for an incident with a significant impact on the provision of its services in the European Union, and lets the authority require the provider to inform the public itself. Neither article states a fixed reporting clock in hours; the duty runs «sans délai» (without delay) from the operator's or provider's own knowledge of the incident.
When LexLint raises it
When your app profile says your app operates a social platform or runs an essential service.
Back to the example · Lint your app
Page updated .