The French National Agency for Information System Security (ANSSI) is focusing on the implementation of the NIS 2 directive, a European Union regulation aimed at improving cybersecurity across member states. During the introduction of the Security Assises, a major cybersecurity event, discussions centered on the challenges of applying NIS 2. Vincent Strubel, ANSSI's director general, spoke to the National Assembly's special committee about the directive, which was originally set for public debate on October 7 but was later postponed indefinitely due to a crowded parliamentary schedule. Strubel emphasized that the NIS 2 bill is designed to be "technologically neutral," meaning it does not favor any specific technology or method. He noted that it would be effective against most recent data thefts in France. The deadlines for implementing the directive affect how organizations prepare, including budget planning, a point highlighted by French cybersecurity firms. Strubel mentioned that affected entities have a three-year deadline to fully comply, with the end of 2028 as the target date. This period will include test runs to help with future challenges and to evaluate ANSSI's oversight capabilities. The NIS 2 directive is part of a larger national cybersecurity strategy introduced in January and a roadmap for state security issued in April. By December 31, 2026, various ministries are expected to carry out actions such as auditing IT systems, approving critical IT systems, and deploying EDR or XDR technologies on all workstations and servers. ANSSI has noticed that some projects, which were expected to take three years, have been completed in just three months. However, implementing strong authentication methods, like multifactor authentication, is proving difficult, especially with the many digital services that are outsourced. ANSSI has also been working on improving transparency, as shown in a report on the DGFiP, the French tax administration, which revealed basic security flaws. This initiative is part of the REACTIV program, which aims to address such issues and encourage open discussions about cybersecurity practices. Strubel acknowledged the need to move beyond misplaced modesty and to focus on fundamental security practices rather than just using buzzwords. The Cyber Resilience Act (CRA), another important regulation, will come into effect on December 11, 2027. Unlike NIS 2, it is not tied to the parliamentary schedule. While the National Assembly's special committee considered combining the CRA with NIS 2, ANSSI opposes this, arguing it would only apply to publishers based in France. Regarding subcontractors, ANSSI believes the current approach is sufficient, with requirements being applied indirectly through contracts. ANSSI claims it is ready to handle its new NIS 2 responsibilities, having adapted its operations through collaboration with state services, the private sector, and local authorities. Despite having 670 ETP (equivalent full-time positions), ANSSI's director general notes that the agency's structure is more streamlined compared to the German BSI, which has between 1800 and 2000 ETP for similar tasks.