Standards & Directives

The CRA regulation, adopted in 2024, standardises cybersecurity requirements for connected objects in Europe.

It aims to standardise cybersecurity requirements for products with digital components, such as connected objects, and imposes obligations on economic operators (manufacturers, importers and distributors) by creating a secure environment for users throughout the product lifecycle.

Businesses must prepare for compliance by December 2027 by assessing their risks, implementing appropriate security measures and seeking expert support.

To prepare for the CRA regulation, businesses need to assess their situation, carry out an in-depth analysis of cyber security risks, put in place the necessary security measures, strengthen their incident and vulnerability management capabilities, and seek expert advice and support.

The NIS 2 directive is a new European regulation that strengthens the security of information systems. It applies to operators of essential services and digital service providers, and imposes stricter requirements on risk management, incident reporting and cooperation with authorities.

In summary, NIS 2 aims to:

• Protect critical infrastructure and personal data.
• Strengthen the security of information systems in the EU.
• Improve cooperation between the competent authorities of the Member States.

The MICA standard is a European regulation that governs crypto-assets. It aims to protect investors, prevent market abuse and fight financial crime.

The main provisions of the MICA standard are as follows:

• Crypto-asset service providers (PSCA) will be subject to a mandatory authorization regime.
• Stablecoin issuers will have to meet strict liquidity, reserve and governance requirements.
• Investors in crypto-assets will be better protected against scams and fraud.
• PSCAs will have to put in place measures to combat money laundering and the financing of terrorism.

Digital Health Companies (ENS) wishing to certify their teleconsultation solution must therefore go through a process of evaluating the conformity of this solution with requirements relating to the security of information systems. In particular, carrying out an intrusion test on the candidate solution is required.

This results in the auditor filling out a form which allows the scope of the test to be set and certifies the results obtained. It constitutes proof required for certification of conformity to the interoperability, security and ethics framework for teleconsultation information systems.

The intrusion test must be carried out by an audit service provider, at the request of the publisher. In order to guarantee the skills of the selected audit service provider and thus the fairness of the process, it is requested to use a qualified information systems security audit service provider, or PASSI.

The General Security Reference (RGS) is a French standard which defines the security requirements for the information systems of administrative authorities.

The RGS aims to protect the personal data of citizens and to guarantee the proper functioning of public services. It applies to all information systems of administrative authorities, whether internal or external, central or decentralized.

The RGS is based on six fundamental principles:

• Integrity: information must be accurate and complete.
• Confidentiality: information must be accessible only to authorized persons.
• Authenticity: information must be accessible when necessary.
• Availability: guarantees that the information is accurate and complete.
• Traceability: actions carried out on information must be traceable.
• Resilience: information systems must be able to withstand security incidents.

DORA is a European regulation that requires financial entities to implement a governance and internal control framework for managing ICT-related risks. It applies to banks, insurance companies, asset managers, payment service providers, and other financial entities designated by supervisory authorities.

DORA aims to strengthen the resilience of financial entities against cyberattacks and other ICT-related incidents. It is intended to help protect customers of financial institutions and reinforce trust in the EU financial system.

Security measures to implement: ICT risk analysis, formal security policy, tested business continuity plan, incident management processes, register of critical ICT service providers, and execution of resilience testing (including regular penetration testing).

The CaRE program supports the funding of healthcare software solutions listed by the Agence du Numérique en Santé (ANS). It is part of the continuity of the Ségur numérique initiative and aims to accelerate the adoption of tools compatible with core national services (DMP, Pro Santé Connect, MSSanté). To obtain this listing and access funding, software vendors must demonstrate a high level of security.

Security requirements to implement: evidence of penetration testing (in line with ANS guidelines), a documented security policy, vulnerability management, logging and remediation procedures, and a supporting evidence package validated by the ANS.