NIS2 · French ReCyF · Authentication
NIS2 and the French ReCyF: authentication, MFA and secrets management
Authentication checks that a presented identity may access a resource with assurance suited to the risk. It does not decide, by itself, which actions that identity is authorised to perform.
This page expands the authentication workstream of the NIS2 identity and access use case.
Intended outcome
Documented mechanisms proportionate to risk, with secrets protected and renewed under the selected rules.
How to industrialise it
Define policies by profile, enforce them in the IdP and connect them to identity context governed by IGA.
Select factors according to risk
Factors fall into three families: knowledge, possession and inherence. Their combination and strength must be assessed against context, threats and resource sensitivity.
The French guidance distinguishes strong multi-factor authentication, strong single-factor authentication, MFA without a strong factor and simple authentication. This is a security typology, not a marketing ranking.
Divide responsibilities
IGA knows who the person is and which access they should hold. Access Management and the IdP verify authentication, enforce profile policies and provide federation. PAM or a secrets manager protects selected sensitive secrets where the case warrants it.
Default secrets must be changed. For a shared account, a change in the authorised group should trigger secret rotation. Vaults can reduce password exposure and automate selected operations without replacing risk analysis or authentication policy.
Evidence to retain
- Authentication policies by population and risk level
- MFA coverage and documented exceptions
- Policy and administration change history
- Rotation of shared secrets when authorised membership changes
Relevant capabilities and concepts
Access Management and CIAM
Enforce authentication and federation policies.
Privileged access and secrets
Protect selected sensitive secrets and access paths.
Multi-factor authentication
Explore factor families and combinations.
Related controls
Access rights and recertification
Separate proof of identity from authorisation decisions.
Shared accounts and traceability
Handle secrets known by several people.
Sources and guidance
ANSSI — ReCyF in practice — Identity management, version 1.0, September 2026 (French source document)
- ANSSI — Multi-factor authentication and passwords (French)
Turn the control into a process
Frame responsibilities, events and evidence before selecting the mechanisms to deploy.