FranceLoi n° 2022-309 du 3 mars 2022 (loi Cyberscore), Cybersecurity Audit and Disclosure Duty
Loi n° 2022-309 du 3 mars 2022, art. 1 (Code de la consommation, art. L. 111-7-3)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045294275In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Disclosure
What it requires
- This binds an online platform operator under Code de la consommation Article L. 111-7 above the activity threshold a decree sets. A number-independent interpersonal communications service above that threshold is separately bound and is not expressed by any activity in this vocabulary.
- Where a threshold decree brings you into scope, have a cybersecurity audit carried out by a provider ANSSI has qualified, covering the security and location of the data you host (directly or through a third party) and your own security.NIST CSF 2.0ID.IM-01
- Present the audit result to the consumer in a legible, clear and comprehensible form, with a colour-coded presentation, in the conditions a joint ministerial order fixes.no control in the NIST CSF 2.0
These lines are LexLint's reading of the law's text. Also read by: Agence nationale de la sécurité des systèmes d'information (ANSSI) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- ID.IM-01Improvements are identified from evaluations
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Code de la consommation Article L131-4 makes a breach of the Article L. 111-7-3 duty subject to an amende administrative (administrative fine), not a criminal offence.
Penalty structure
Code de la consommation Article L131-4, as amended by this law's Article 1(2°), makes a breach of Article L. 111-7-3 subject to an administrative fine of up to EUR 75,000 for a natural person and EUR 375,000 for a legal person.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 375,000
Who enforces it
Enforcement body
The Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF), under the Code de la consommation Book V investigation and sanction powers Article L131-4 invokes.
Settledness
- As of
- Guidance link
- https://cyber.gouv.fr/
- Guidance body
- Agence nationale de la sécurité des systèmes d'information (ANSSI)
- Open questions
- Have the decree fixing the applicability thresholds and the joint order fixing the audit criteria been published, and at what threshold?
What this law does
Article 1 inserts Article L. 111-7-3 into the Code de la consommation, requiring an online platform operator (opérateur de plateforme en ligne, Article L. 111-7) and a provider of a number-independent interpersonal communications service, above one or more activity thresholds a decree sets, to undergo a cybersecurity audit by a provider qualified by ANSSI, covering the security and location of the data it hosts (directly or through a third party) and its own security, and to present the result to the consumer in a legible, clear and comprehensible form accompanied by a colour-coded presentation.
A joint order of the ministers responsible for digital affairs and consumer protection, issued after the CNIL's opinion, fixes the audit criteria and the conditions of validity and presentation. The law entered into force on (Article 2).
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .