NIS2 · French ReCyF · PKI
NIS2 and the French ReCyF: certificates, PKI and machine identities
Certificates authenticate automated services as well as users. Their governance connects identities and owners; their cryptographic security belongs to a key management infrastructure.
This page clarifies that boundary within the NIS2 identity and access use case.
Intended outcome
A structured chain of trust, certificates tracked through their lifecycle and keys protected according to criticality.
How to industrialise it
Connect the machine-identity inventory to governed PKI, with issuance, renewal, revocation, monitoring and recovery.
Structure certificate-based trust
PKI structures the certification-authority hierarchy, protects the root private key, separates roles and documents certification policies. It defines uses, lifetimes, permitted algorithms and revocation procedures.
Renewal can be automated where possible, including through protocols such as ACME. Monitoring should detect expiry and compromise, while audits, secure key transfer and continuity procedures reduce blind spots.
Draw the boundary between IAM and PKI
IAM can show which human or machine identity exists, who owns it, which service it belongs to, when it should be created or retired and which access is associated with it.
PKI remains responsible for the certificate’s cryptographic mechanisms, issuance, renewal and revocation. Coherent governance connects both lifecycles without confusing them.
Evidence to retain
- Inventory of certificates, machine identities, services and owners
- Certification policies, role separation and permitted algorithms
- History of issuance, renewal, expiry and revocation
- Monitoring results, audits and recovery tests
Relevant capabilities and concepts
Identity governance
Connect machine identities, owners and lifecycle events.
Privileged access and secrets
Protect selected secrets and keys under the chosen architecture.
Non-human identity
Explore governance for services, workloads and agents.
Related controls
Identification and lifecycle
Maintain machine-identity ownership and status.
Active Directory and LDAP
Address certificates where they support directory services.
Sources and guidance
ANSSI — ReCyF in practice — Identity management, version 1.0, September 2026 (French source document)
- ANSSI — Cryptographic mechanisms (French)
- ANSSI — Automating certificate management with ACME (French)
- ANSSI — Key management infrastructure essentials (French)
Turn the control into a process
Frame responsibilities, events and evidence before selecting the mechanisms to deploy.