Network security - the NIS directive was transposed in French law
The directive concerning
measures for a high common level of security of network and information
systems across the Union ("NIS Directive") was transposed in French law
on 26 February 2018. (1)
The new law provides additional obligations regarding digital security. (2)
Two new types of companies are identified
- Operators of essential services (OES) (which are globally equivalent to the French definition of operators of vital importance (opérateurs d’importance vitale - OIV). These include companies operating in essential areas such as: energy, transportation, banking, financial markets infrastructures, health, production and distribution of potable water and the providers of digital infrastructures, and
- Operators of essential services (OES) (which are globally equivalent to the French definition of operators of vital importance (opérateurs d’importance vitale - OIV). These include companies operating in essential areas such as: energy, transportation, banking, financial markets infrastructures, health, production and distribution of potable water and the providers of digital infrastructures, and
- Digital services providers (DSPs) which include companies providing
cloud computing services, market places, search engines services, etc.
These
companies will have to implement the cybersecurity measures set up by
the National Agency for Information Systems Security (Agence
nationale de la sécurité des
systèmes d’information - ANSSI). They will have to notify the ANSSI in
case of security incidents which may have a significant impact on the
continuity of the services provided.
Any
failure to secure the networks, to declare a security incident or in
case of blocking a control procedure, will be subject to fines between
€75,000 and €125,000 for the OES, the amount of the fine depending on
the type of violation, and fines between €50,000 and €100,000 for DSPs.
A decree specifying the list of OES and FSEs operating in the French territory should be published before 9 November 2018.
* * * * * * * * * * *
(1) Directive (EU) 2016/1148 of the Europen Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union ("NIS Directive")
(2) Law
#2018-133 of 26 February 2018 including several provisions adapting
French law to European Union law in the area of security (Loi n°2018-133 du 26 février 2018 portant diverses dispositions
d'adaptation au droit de l'Union européenne dans le domaine de la
sécurité)
Bénédicte DELEPORTE
Avocat
Deleporte Wentz Avocat
Mars 2018