Ariovis

Use case · France · NIS2 and ReCyF

NIS2 in France: from the ReCyF to verifiable IAM controls

NIS2 covers considerably more than identity and access management. IAM nevertheless offers a practical scope in which organisations can turn security principles into operational controls: identifying users and service accounts, governing their authentication, limiting their permissions and ensuring that access is removed when it is no longer justified.

As of 19 October 2026, France has not yet completed the national transposition of NIS2. ANSSI has published the Référentiel Cyber France (ReCyF) and practical guidance to help organisations prepare appropriate security controls. The ReCyF is currently presented as a working document rather than a framework that is automatically mandatory for every organisation. Existing legal obligations and requirements directly applicable to certain digital service providers must nevertheless be considered separately.

NIS2 in France: which obligations already apply?

The European NIS2 Directive, adopted in December 2022, had to be transposed by Member States by 17 October 2024 at the latest. This date is a deadline imposed on Member States: it does not mean that all the new national obligations automatically took effect for every French organisation on that date.

As of 18 October 2026, the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, often referred to as the Resilience Bill, is continuing its passage through Parliament. French transposition is therefore not yet complete. The precise conditions for applying the new national obligations, their supervision arrangements and any transitional periods must be assessed on the basis of the legislation finally adopted.

This situation does not mean that French organisations are subject to no cybersecurity obligations. Existing arrangements, particularly those applicable to certain entities already regulated, continue to have effect. In addition, Implementing Regulation (EU) 2024/2690 directly establishes technical and methodological requirements for certain categories of digital actors within its scope, including providers of cloud computing, data centre, managed and managed security services. Its scope must be examined separately from general French transposition.

On 17 March 2026, ANSSI published version 2.5 of the Référentiel Cyber France, or ReCyF, as a working document. It presents it as a recommended framework, not mandatory by default at this stage, which may be adjusted as legislation and regulations evolve. The practical guidance published in September 2026 helps explain some of its objectives and prepare their implementation.

For a potentially affected organisation, the appropriate approach is therefore to determine its regulatory scope, continue monitoring applicable legislation and initiate security measures justified by the risks. Work on identities and access is particularly useful: it secures concrete situations while preparing the evidence needed for future controls.

Key dates

  1. European transposition deadline

    Deadline set for Member States to transpose NIS2. It is not a universal date for individual compliance in France.

  2. Publication of ReCyF version 2.5

    ANSSI makes available a working framework intended to support preparation of risk-management measures.

  3. Publication of ReCyF practical guidance

    ANSSI publishes technical resources, including the guidance dedicated to identity management.

  4. French transposition still in progress

    The Resilience Bill is still under discussion. The next national deadlines must be confirmed from official legislation.

The outcome sought by ANSSI

Published by France’s ANSSI in September 2026, the French “ReCyF in practice — Identity management” guidance structures this scope around ReCyF security objective 10: managing user identities and access to information systems. An IAM programme can industrialise many of these mechanisms when it works with Access Management, directories, secrets management, PAM and, for machine identities, PKI.

The guidance aims to prevent illegitimate users from accessing information-system resources and to make every action unambiguously attributable to a user or automated process. It expresses this goal through three security functions, complemented by traceability.

Lifecycle management cuts across all four: when an account no longer has a reason to exist, access must be neutralised quickly and rights removed. The guidance states that it does not replace the ReCyF, is neither prescriptive nor exhaustive, and explains intended outcomes through implementation examples.

  1. 01

    Identify

  2. 02

    Authenticate

  3. 03

    Authorise

  4. 04

    Trace

Lifecycle management connects all four functions, from creation to deactivation.

From the French ReCyF to an IAM workstream

This matrix connects ReCyF objective 10 measures to mechanisms and possible evidence. It is neither an exhaustive interpretation of NIS2 nor an architecture prescription.

  • Identification — 10.A.1-EI/EE to 10.A.6-EI/EE

    Intended outcome

    Tie every access path to a clearly identified human identity or automated process.

    IAM mechanism

    Identity repository, unique identifiers, owned technical accounts, identity/account reconciliation and lifecycle.

    Complementary capabilities

    Directory, logging and PAM where relevant.

    Possible operational evidence

    Identity and account inventory, technical-account owners, creation and deactivation history.

  • Authentication — 10.B.1-EI/EE to 10.B.6-EI/EE and 10.B.7-EE

    Intended outcome

    Adapt authentication assurance to risk and control secrets.

    IAM mechanism

    Connect identity context to access policy.

    Complementary capabilities

    IdP / Access Management, MFA, federation, secrets vault and PAM.

    Possible operational evidence

    MFA coverage, authentication policies, population-specific rules, administration and change logs.

  • Access rights — 10.C.1-EI/EE to 10.C.4-EI/EE

    Intended outcome

    Limit access to actual need and keep it coherent over time.

    IAM mechanism

    Roles, entitlement rules, requests, approvals, provisioning, recertification, revocation and deprovisioning.

    Complementary capabilities

    Applications, directories and fine-grained authorisation when context must inform the decision.

    Possible operational evidence

    Entitlement catalogue, owners, review campaigns, certification decisions and revocation history.

SSO simplifies authentication; it does not replace authorisation governance. An authenticated person should not automatically gain access to every federated resource.

Compare ReCyF IAM controls with other frameworks

French identity and access management measures pursue objectives also found in CyberFundamentals and ISO 27001. Operational mechanisms can be reused, but requirements and assessment arrangements must be examined separately. This comparison identifies useful mappings without presenting them as regulatory equivalences.

Editorial reference: 19 October 2026 · Thematic mappings and operational contributions

Identities and lifecycleReCyF v2.510.A.1, 10.A.2, 10.A.5, 10.A.6

Identify users, services and their accounts

Problem addressed
A person leaves the organisation, changes role or is no longer responsible for a service, yet their associated accounts and rights remain active. Conversely, some technical accounts exist without a clearly identified owner or purpose.
Intended outcome
Link each account to an identity or authorised process, then manage its lifecycle through to deactivation.

ReCyF — working version 2.5

  • 10.A.1-EI/EE

    Individual accounts for users and automated processes.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.A.2-EI/EE

    Use of individual accounts restricted to their holders.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.A.5-EI/EE

    Deactivation of accounts no longer required within the timescales defined by the account management policy.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.A.6-EI/EE

    Account reviews at least annually, with correction of anomalies.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

  • PR.AA-01.1 — Basic

    Management of identities and authentication information for authorised users, services and devices.

    Thematic mapping · Documentary verification to be confirmed

    CyFun 2025 — Basic, 1er octobre 2025

ISO/IEC 27001:2022

  • A.5.16

    Identity management.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.5.18

    Access rights, including their management and review.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

Governance starts with the ability to distinguish a person, an identity, an account and an entitlement. An IAM system can correlate these objects using authoritative sources and orchestrate joiner, mover and leaver events. It must also address technical accounts, whose legitimacy depends on a purpose and an owner, even when no person uses them directly.

Automation only adds value if events are reliable and target systems actually execute decisions. An incorrect HR source or an unmatched account can otherwise create a false sense of control.

IAM mechanisms

  • Identity repository.
  • Identity / account correlation.
  • HR or other authoritative sources.
  • Joiner / Mover / Leaver processes.
  • Provisioning.
  • Deprovisioning.
  • Reconciliation and discrepancy checks.

Possible evidence

  • Active account inventory.
  • Link to an identity or process.
  • Technical account owner.
  • Creation and deactivation history.
  • Leaver event records.
  • List of unresolved discrepancies.
  • Account review results.
Typical responsibilities
HR repository, IAM lead, account or application owners, operations.
Possible indicator
Proportion of active accounts with an identified owner or linked identity.

Nature and limitations of the mappings

A similar identity management objective, but no demonstrated equivalence of lifecycle arrangements or review frequency.

Thematic mapping, subject to the applicability defined within the ISMS.

Automation only adds value if events are reliable and target systems actually execute decisions. An incorrect HR source or an unmatched account can otherwise create a false sense of control.

Explore further: Identities and lifecycle

Technical detail in the context of France’s ReCyF.

Authentication and secretsReCyF v2.510.B.1 to 10.B.6; 10.B.7-EE for the exception

Authenticate using risk-appropriate mechanisms

Problem addressed
An organisation has an authentication policy but does not know precisely which access routes are protected, how exceptions are managed or when secrets must be replaced.
Intended outcome
Manage authentication mechanisms, their coverage, secrets management and documented exceptions.

ReCyF — working version 2.5

  • 10.B.1-EI/EE

    Authentication mechanism using at least one secret element.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.2-EI/EE

    Changing default secrets before bringing systems into service.

    Thematic mapping · Identifier and applicability verified in the official document

    The text also requires checking with the supplier that the means and rights needed to make the change are available.

    Version de travail 2.5 du 17 mars 2026

  • 10.B.3-EI/EE

    Renewal of a shared account's secret element when a user of that account is removed.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.4-EI/EE

    Knowledge of secret elements restricted to authorised users.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.5-EI/EE

    Compliance with applicable recommendations on authentication factors and their management.

    Thematic mapping · Identifier and applicability verified in the official document

    The text addresses complexity and renewal frequency according to ANSSI recommendations, taking account of the maximum technically possible.

    Version de travail 2.5 du 17 mars 2026

  • 10.B.6-EI/EE

    Risk reduction measures where a secret element cannot be changed for technical or operational reasons.

    Thematic mapping · Identifier and applicability verified in the official document

    This exception requires appropriate access control and reduction of the risk associated with the fixed secret; additional traceability falls under 10.B.7-EE.

    Version de travail 2.5 du 17 mars 2026

  • 10.B.7-EE

    Additional traceability under the exception provided for in the preceding control, for essential entities.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

  • PR.AA-03.2 — Basic

    MFA required for remote access to the organisation's networks.

    Thematic mapping · Documentary verification to be confirmed

    The scope stated in the brief remains to be confirmed in the Basic booklet: the indexed Key Measures annex uses different wording for 2025. The detailed booklet could not be read (HTTP 403).

    CyFun 2025 — Basic, 1er octobre 2025

ISO/IEC 27001:2022

  • A.5.17

    Authentication information.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.5

    Secure authentication.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

An authentication policy is not measured solely by the presence of MFA. It must make clear which journeys are protected, which mechanisms are used, how exceptions are authorised and how authentication information is administered. Technical secrets and shared access also require treatment appropriate to their actual use.

IGA governs identities and their associated rights, while Access Management enforces authentication policies. Secrets management and PAM solutions intervene where the accounts and operations concerned require additional controls.

IAM mechanisms

  • IdP and Access Management.
  • MFA.
  • Federation.
  • Authentication policies.
  • Exception management.
  • Secrets vaults.
  • Secrets rotation according to applicable needs and rules.
  • Logging of sensitive changes.

Possible evidence

  • Authentication journey inventory.
  • Enforced MFA policies.
  • Coverage of the remote access concerned.
  • Authorised and justified exceptions.
  • Policy change history.
  • Rotation records for the secrets concerned.
Typical responsibilities
Access Management lead, security, application owners and secrets operations.
Possible indicator
Proportion of identified remote access journeys effectively covered by the intended MFA.

Nature and limitations of the mappings

This measure must not be presented as explicitly requiring MFA for every application, every connection and irrespective of context.

Explore further: Authentication and secrets

Technical detail in the context of France’s ReCyF.

Access rights and recertificationReCyF v2.510.C.1 to 10.C.4

Grant, review and remove legitimate access rights

Problem addressed
Access rights accumulate as staff change roles. Application owners do not always have a clear view of assigned permissions, and review campaigns may conclude without effective correction.
Intended outcome
Keep entitlements aligned with actual need, document decisions and check their implementation.

ReCyF — working version 2.5

  • 10.C.1-EI/EE

    Rights assigned to authenticated users and automated processes.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.C.2-EI/EE

    Limitation of rights to the resources required.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.C.3-EI/EE

    Rights granted only to users and processes with a justified need for the resource.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.C.4-EI/EE

    Access rights reviews at least annually, with correction of anomalies.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

ISO/IEC 27001:2022

  • A.5.15

    Access control.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.5.18

    Access rights.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.3

    Information access restriction.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.5.3

    Segregation of duties, where relevant to the control being examined.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

Entitlement governance requires a business decision to be linked to a right actually present in the system. An approved request, role rule or recertification campaign is not sufficient if technical permissions do not align with the expected outcome. The control must cover the legitimacy of the right, its assignment, any exceptions and its removal.

Role models allow some decisions to be standardised at scale. They must nevertheless remain appropriate to the organisation and can be supplemented by fine-grained authorisation mechanisms where decisions depend on the resource, action or context.

IAM mechanisms

  • Entitlement catalogue.
  • Resource owners.
  • Business and technical roles.
  • Assignment rules.
  • Requests and approvals.
  • Recertification campaigns.
  • Exception management.
  • Revocation.
  • Checks for discrepancies between intended and effective rights.

Possible evidence

  • Access rights matrix.
  • Owner approvals.
  • Request history.
  • Recertification decisions.
  • Exception list.
  • Completed corrections.
  • Revocation log.
Typical responsibilities
Business owners, application owners, IAM leads and access rights operations.
Possible indicator
Proportion of revocation decisions actually executed and verified in target systems.

Nature and limitations of the mappings

Entitlement governance requires a business decision to be linked to a right actually present in the system. An approved request, role rule or recertification campaign is not sufficient if technical permissions do not align with the expected outcome. The control must cover the legitimacy of the right, its assignment, any exceptions and its removal.

Explore further: Access rights and recertification

Technical detail in the context of France’s ReCyF.

Shared accountsReCyF v2.510.A.2, 10.A.3, 10.B.3, 10.B.4, 10.B.6, 10.B.7-EE

Control shared accounts and preserve accountability

Problem addressed
Some legacy systems or operational constraints lead to the use of shared accounts. Without appropriate controls, it becomes difficult to determine who used an account, when and for which operation.
Intended outcome
Limit shared use, justify exceptions and retain usable attribution of the access concerned.

ReCyF — working version 2.5

  • 10.A.2-EI/EE

    Use of individual accounts restricted to their holders.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.A.3-EI/EE

    Compensating measures and traceability where constraints prevent the use of individual accounts.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.3-EI/EE

    Renewal of a shared account's secret element after removal of a user of that account.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.4-EI/EE

    Protection of knowledge of secrets.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.6-EI/EE

    Exception for secrets that cannot be changed, with an additional traceability requirement for EE in the specified case.

    Thematic mapping · Identifier and applicability verified in the official document

    This exception requires appropriate access control and reduction of the risk associated with the fixed secret; additional traceability falls under 10.B.7-EE.

    Version de travail 2.5 du 17 mars 2026

  • 10.B.7-EE

    Exception for secrets that cannot be changed, with an additional traceability requirement for EE in the specified case.

    Thematic mapping · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

ISO/IEC 27001:2022

  • A.5.16

    Identity management.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.5.17

    Authentication information.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.15

    Logging.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

Shared account traceability is not simply a matter of retaining technical logs. It requires an understanding of the conditions in which the account was used and the ability to link its use to a person or authorised operation. Where individual accounts are not possible, the exception must therefore be documented, compensating measures defined and their continued operation verified.

Secrets management, session control and operational procedures can contribute to this control. None of these mechanisms should be presented as blanket permission to share accounts without justification.

IAM mechanisms

  • Shared account inventory.
  • Justification of exceptions.
  • Designation of responsible owners.
  • Secrets management.
  • Rotation when a relevant user's access is revoked.
  • Access control.
  • Usage traceability.
  • Exception review.

Possible evidence

  • Shared account register.
  • Technical or operational justification.
  • List of authorised users.
  • Rotation records.
  • Relevant logs.
  • Periodic check results.
  • Decisions to retain or remove exceptions.
Typical responsibilities
System owner, security lead, PAM or secrets lead, operations.
Possible indicator
Proportion of identified shared accounts with a justified exception and documented traceability arrangements.

Nature and limitations of the mappings

These measures provide thematic points of reference. They must not be presented as a verbatim transposition of the shared account exceptions provided for by ReCyF.

Thematic mappings, to be assessed according to the scope and selected controls.

Explore further: Shared accounts

Technical detail in the context of France’s ReCyF.

Directories and privilegesReCyF v2.511.A.1, 11.A.3, 11.A.4-EE, 11.B.1, 11.B.2-EE, 11.B.6-EE

Secure directories and administration paths

Problem addressed
An organisation has IAM governance, but some groups, delegations, administrative accounts and legacy mechanisms in its directories still enable excessive access or privilege escalation.
Intended outcome
Connect IAM governance with technical directory security and control of administrative rights.

ReCyF — working version 2.5

  • 11.A.1-EI/EE

    Separation of administrative accounts and their use.

    Thematic mapping · Identifier and applicability verified in the official document

    Administration is performed exclusively through administrative accounts, which are themselves reserved exclusively for these actions.

    Version de travail 2.5 du 17 mars 2026

  • 11.A.3-EI/EE

    Application of identity management rules to administrative accounts.

    Thematic mapping · Identifier and applicability verified in the official document

    The rules concern identities and access for administrative accounts.

    Version de travail 2.5 du 17 mars 2026

  • 11.A.4-EE

    Use of administrative accounts limited to the intended resources and administrative operations.

    Thematic mapping · Identifier and applicability verified in the official document

    Connection to managed resources to administer them, or to an administration resource.

    Version de travail 2.5 du 17 mars 2026

  • 11.B.1-EI/EE

    Application of security patches to the directories concerned.

    Thematic mapping · Identifier and applicability verified in the official document

    Patches must be applied without undue delay.

    Version de travail 2.5 du 17 mars 2026

  • 11.B.2-EE

    Identification of the resources forming each directory's trust core.

    Thematic mapping · Identifier and applicability verified in the official document

    The trust core comprises the directory and the resources that can host it or take control of it.

    Version de travail 2.5 du 17 mars 2026

  • 11.B.6-EE

    Annual directory configuration review.

    Thematic mapping · Identifier and applicability verified in the official document

    The review targets unnecessary or anomalous elements; an automated tool is recommended, not mandated by this line.

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

ISO/IEC 27001:2022

  • A.8.2

    Privileged access rights.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.9

    Configuration management.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.15

    Logging.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

Directory security does not automatically follow from entitlement governance. IGA can control the assignment of groups and rights, but protecting Active Directory or LDAP also requires analysis of delegations, sensitive accounts, configurations and paths leading to critical resources. Corrections must be prioritised according to risk rather than limited to an inventory of administrative accounts.

PAM addresses certain privileged uses, but reducing standing privileges and securing the trust core also require architectural, configuration and operational decisions. A bastion host alone does not eliminate attack paths within the directory.

IAM mechanisms

  • Administrative account review.
  • Sensitive group analysis.
  • Separation of administrative activities.
  • Delegation analysis.
  • Privilege reduction.
  • Attack path checks.
  • Directory configuration review.
  • Patch management.
  • Logging of critical changes.

Possible evidence

  • Privileged account and group inventory.
  • Justification of sensitive rights.
  • Attack path mapping.
  • Remediation history.
  • Configuration review reports.
  • Patch tracking.
  • Privileged change logs.
Typical responsibilities
Directory team, IAM architect, identity security, PAM lead and operations.
Possible indicator
Number of critical attack paths identified and subsequently eliminated or controlled within a documented scope.

Nature and limitations of the mappings

These references are neither an exhaustive description of Active Directory hardening nor equivalent to the French requirements for the trust core.

Explore further: Directories and privileges

Technical detail in the context of France’s ReCyF.

Machine identities and certificatesReCyF v2.510.A.1, 10.A.5, 10.B.1, 10.B.2

Govern machine identities and their trust mechanisms

Problem addressed
An organisation knows its staff accounts but has insufficient control over the identities of applications, devices and automated processes. Some certificates, secrets or technical accounts persist without an identified owner or documented lifecycle.
Intended outcome
Link technical identities to their uses and control associated cryptographic mechanisms where these are used.

ReCyF — working version 2.5

  • 10.A.1-EI/EE

    Individual identification of users and automated processes accessing resources.

    Operational contribution · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.A.5-EI/EE

    Deactivation of accounts no longer required.

    Operational contribution · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.1-EI/EE

    Authentication mechanisms for users and automated processes.

    Operational contribution · Identifier and applicability verified in the official document

    Version de travail 2.5 du 17 mars 2026

  • 10.B.2-EI/EE

    Changing default secret elements.

    Operational contribution · Identifier and applicability verified in the official document

    The text also requires checking with the supplier that the means and rights needed to make the change are available.

    Version de travail 2.5 du 17 mars 2026

CyFun 2025 — Basic

  • PR.AA-01.1 — Basic

    Management of identities and authentication information for users, services and devices.

    Operational contribution · Documentary verification to be confirmed

    CyFun 2025 — Basic, 1er octobre 2025

ISO/IEC 27001:2022

  • A.5.16

    Identity management.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

  • A.8.24

    Use of cryptography.

    Thematic mapping · Documentary verification to be confirmed

    ISO/IEC 27001:2022

Annex A controls must be examined in light of the risk assessment, the ISMS scope and the Statement of Applicability (SoA).

European references — Article 21(2)

NIS2 Directive

  • Article 21(2)(h)

    cryptography and, where appropriate, encryption.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(i)

    human resources security, access control and asset management.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

  • Article 21(2)(j)

    MFA or continuous authentication where appropriate.

    Operational contribution · Documentary verification to be confirmed

    Directive (UE) 2022/2555

Ariovis analysis

A machine identity is not simply a service account. It may be represented by a certificate, key, token, application account or a combination of mechanisms. The organisation must distinguish the legitimacy of this identity, the resources it can reach and the technical means used to authenticate it.

IAM can govern the owners, uses and entitlements of these identities. PKI manages certificates and the corresponding cryptographic mechanisms. Controlling risk requires coordination between these responsibilities, particularly when an application is retired, a certificate expires or a secret must be revoked.

IAM mechanisms

  • Machine identity inventory.
  • Identification of owners.
  • Service account management.
  • Technical identity lifecycle.
  • Inventory of relevant certificates.
  • Granting and removal of access rights.
  • Certificate issuance, renewal and revocation through appropriate systems.
  • Control of associated secrets and keys.

Possible evidence

  • Non-human identity inventory.
  • Documented owner and purpose.
  • References to associated accounts or certificates.
  • Validity and renewal dates.
  • Revocation history.
  • Access rights review results.
  • Handling of identities no longer required.
Typical responsibilities
Application owners, IAM team, PKI team, operations and security.
Possible indicator
Proportion of critical technical identities with an owner and a documented renewal or revocation mechanism.

Nature and limitations of the mappings

None of the cited references should be presented as systematically requiring all organisations to deploy a complete PKI.

Certificates are one possible technical mechanism for certain uses. Their management depends on the authentication, trust and cryptographic needs concerned.

Explore further: Machine identities and certificates

Technical detail in the context of France’s ReCyF.

What IAM can automate

An HR source or another authoritative repository can trigger Joiner / Mover / Leaver events. On arrival, IAM creates the identity, applies entitlement rules and provisions the required accounts. On a move, it recalculates rights from the new situation and removes entitlements that are no longer needed.

On departure, or during an absence requiring suspension, the process can trigger account deactivation and entitlement removal under defined rules. Recertification campaigns then periodically compare actual rights with an up-to-date theoretical need.

Automation is reliable only when sources, owners, rules and responsibilities are defined. Automating ambiguous data or an ownerless rule mainly accelerates the spread of errors.

What IAM cannot do alone

An IGA platform does not replace an identity provider or MFA. An IdP does not govern entitlements by itself. PAM does not cover the entire identity lifecycle. IAM alone does not harden Active Directory and does not replace PKI for issuing, renewing or revoking certificates.

None of these capabilities, alone or simply stacked together, establishes NIS2 compliance. Their value comes from a coherent chain of responsibilities and controls that can produce evidence on the identity and access scope.

  • IGA

    Govern identities, entitlements and their lifecycle.

  • Access Management

    Authenticate and enforce policies along access journeys.

  • PAM

    Control selected sensitive secrets, accounts and privileges.

  • Directories

    Hold and execute part of the accounts, groups and policies.

  • PKI

    Establish and maintain certificate-based trust.

  • Logging and monitoring

    Retain, correlate and use traces.

Explore the controls

Each page isolates a technical and organisational workstream while retaining its link to objective 10 of the French ReCyF.

Capabilities to combine

The right combination depends on existing systems and risk; these capabilities intervene at different points in the control chain.

Sources and frameworks

The “ReCyF in practice — Identity management” guidance provides the technical foundation for this IAM analysis. The ReCyF and ANSSI publications place these mechanisms in the context of French preparations for NIS2. Parliamentary and European documents are used separately to determine the legal status of the obligations.

Turn ReCyF IAM controls into verifiable processes

The ReCyF provides a framework for examining control over identities and access. Its operational implementation nevertheless depends on the data sources, applications, responsibilities and mechanisms already present in the organisation. Ariovis can help you identify gaps, prioritise useful work and build an IAM roadmap that improves security now while preparing the evidence associated with the controls.

Plan my IAM controls against the French ReCyF
Explore our IAM strategy approach