Anssi adopts a stronger stance

Vincent Strubel, director general of the Anssi, the French National Cybersecurity Agency, stated that the agency is taking a more assertive approach in dealing with the government due to rising cybersecurity threats. This shift follows criticism after a data breach at the DGFiP, France’s tax administration, in August 2026, which the agency was accused of failing to detect in time.

New emergency powers granted

Prime Minister Sébastien Lecornu authorized Strubel to initiate Operation REACTIV, an interministerial action against data breaches. This allows the Anssi to impose urgent measures on government ministries in case of leaks. However, this power lacks a formal legal basis and is granted directly by the prime minister, with the expectation that ministers will comply with the agency's cybersecurity directives.

Need for legal reinforcement

Strubel emphasized the need to formalize the REACTIV measures in legislation and extend them to local authorities and private companies through the NIS 2 directive. He noted that government agencies often face conflicting mandates, and REACTIV aims to prioritize cybersecurity among these. However, some digital transformation projects may be delayed as a result.

New authority under NIS 2

The NIS 2 directive, which France is implementing, grants the Anssi authority over state administrations and potentially private entities. This includes the power to impose fines on non-compliant companies and require administrations to disclose their cybersecurity shortcomings. Strubel stated that the Anssi will act as both judge and party in these cases, but this dual role is not seen as a conflict.

Building internal structure

To prepare for NIS 2, the Anssi is developing a dedicated control function within the agency, with clear procedures for its operations. Strubel stressed the importance of separating roles within the agency to prevent confusion and ensure effective governance.

Crisis communication role

REACTIV also assigns the Anssi the responsibility of managing crisis communication in the event of a cyberattack for all government agencies. Strubel noted that the main challenge is ensuring transparency, referencing the public report on the DGFiP breach in September 2026. He stated that the prime minister has called for greater openness in such situations, and the Anssi is adapting its approach accordingly, though this responsibility does not extend to private companies.

Limited resources and focus

Strubel acknowledged that the Anssi operates with limited resources, with only one-third the staff of its German counterpart. He noted that the agency must constantly balance priorities, and with REACTIV, efforts must be concentrated on fewer aspects of cyber threats. However, he emphasized that new regulatory powers will allow the Anssi to amplify the impact of its actions despite these constraints.