The ANSSI’s ReCyF framework, published in March 2026, translates the NIS2 requirements into 15 concrete measures for significant entities—several of which directly address the secure configuration of Windows endpoints. With the French Resilience Act expected to be debated in the National Assembly in July 2026, CIOs and CISOs at SMEs and mid-sized companies have a tight deadline to bring their IT infrastructure into compliance.

What is the ReCyF framework, and why are your endpoints at its core?

The ReCyF framework (French Cybersecurity Framework) is the national implementing regulation for the NIS2 Directive (EU 2022/2555). Published by ANSSI in March 2026, it organizes the obligations of critical and important entities into 20 security objectives (15 for important entities). Unlike standard best-practice guides, the ReCyF will become a legally enforceable framework upon the enactment of the Resilience Act.

What sets this document apart from previous guidelines is that it requires evidence of secure configurations, not just statements of intent. For your Windows endpoints—including workstations and member servers—this means you are required to maintain a documented, verifiable, and ongoing configuration management process.

Three of the fifteen ReCyF objectives directly concern endpoints:

  • Objective 4 — Access Management: Restricting privileged accounts, implementing MFA for sensitive access, and removing orphaned accounts.
  • Objective 7 — Workstation Security: Secure baseline configuration based on a recognized standard (CIS Benchmarks, ANSSI baselines), disabling of unnecessary features, and management of removable media.
  • Objective 10 — Vulnerability Management: Continuous inventory, prioritization, and deployment of patches within a defined timeframe, traceability.

Without structured hardening of your Windows endpoints, these three goals are virtually unattainable.

What specific actions are expected on your Windows endpoints?

ReCyF does not list technical controls on a line-by-line basis, but the expected measures align with the CIS Windows Benchmarks and the ANSSI hardening guidelines. The following configurations are directly required:

Account and Privilege Management

The principle of least privilege must be applied to every workstation. This involves disabling the default local administrator account or replacing it with LAPS (Local Administrator Password Solution), removing administrative privileges from standard users, and enabling access audit policies for sensitive objects.

In a Windows environment, these controls correspond to the settings in the Security Options section of Group Policy Objects (GPOs) and to the CIS Windows Benchmark controls at levels L1 and L2.

Secure Reference Configuration

Goal 7 requires a documented baseline. In practice, this means:

  • Disabling SMBv1, LM/NTLMv1, WDigest, and other legacy protocols.
  • Enabling Windows Defender Credential Guard.
  • PowerShell restrictions (Constrained Language mode or script signing).
  • Enable the Windows Defender firewall on all profiles.
  • Encryption of system volumes using BitLocker (AES-256 algorithm).
  • Disabling autorun on removable media.

These checks are included in the CIS Benchmarks for Windows 11/Server 2025, a reference explicitly cited in the accompanying ANSSI documents.

Vulnerability and Patch Management

Objective 10 requires that the timeframe for deploying patches be proportionate to the severity: actively exploited critical CVEs (CISA’s KEV category) must be patched as a priority. During the week of May 11–17, 2026, CERT-FR reported the active exploitation of CVE-2026-42897 on Exchange Server (CVSS 8.1) and CVE-2026-42945 on NGINX (CVSS 8.1). These two vulnerabilities illustrate that an unpatched system on an exposed endpoint constitutes a documented NIS2 risk.

What penalties apply to entities that do not comply with the ReCyF?

The Resilience Act transposes the NIS2 penalties into French law. For significant entities, fines can reach €7 million or 1.4% of global revenue (compared to €10 million or 2% for critical entities). ANSSI has the authority to issue injunctions, conduct audits, and impose financial penalties.

Two key differences set the NIS2/ReCyF scheme apart from the NIS1 scheme:

  1. Management is held accountable: management bodies must approve risk management measures and may be held personally liable in the event of repeated non-compliance.
  2. The burden of proof is reversed: the entity must demonstrate compliance, not ANSSI prove non-compliance.

These two factors make automated traceability of security configurations essential—a simple, one-time annual audit is no longer sufficient.

How does the ReCyF framework relate to CIS Benchmarks and ISO 27001?

ReCyF does not create a new technical framework; rather, it explicitly builds on existing standards. The correspondence is as follows:

CIS Windows Benchmarks cover approximately 80% of the technical controls required by Objectives 4, 7, and 10 of the ReCyF. Levels L1 (basic configuration) and L2 (high security) correspond to critical and essential entities, respectively.

ISO 27001 (A.8.9 — Configuration Management) shares the same philosophy but remains a management framework. ReCyF adds a dimension of legal enforceability that ISO 27001 alone does not provide.

The MITRE ATT&CK framework allows you to verify that hardening controls effectively block the listed attack techniques. For example, disabling NTLM v1 blocks attack vectors T1187 (Forced Authentication) and T1550 (Pass-the-Hash).

For an organization that is already ISO 27001 certified, achieving ReCyF compliance involves an incremental effort focused on the automation and traceability of endpoint configurations.

What is the exact timeline for France?

The regulatory situation as of May 27, 2026, is as follows:

  • October 2024: Deadline for the transposition of NIS2 in the EU (missed by France).
  • March 2026: Publication of the ReCyF framework by ANSSI.
  • July 2026: Consideration of the Resilience Act in a public session of the National Assembly (scheduled).
  • Summer 2026: The Resilience Act is expected to be enacted.
  • Three years after enactment: compliance deadline for affected entities.

A three-year timeline may seem long. But it masks an immediate operational risk: organizations that wait for the regulation to take effect before beginning their compliance efforts will have only two years to complete a project that actually requires 18 to 24 months (inventory, baseline, deployment, audit, remediation).

The pragmatic approach is to start right away with the most impactful controls—endpoint hardening, MFA, and privileged access management—which reduce operational risk regardless of the regulatory timeline.

FAQ — The Resilience Act, ReCyF, and Endpoint Hardening

Does NIS2 and ReCyF apply to my company?

Yes, if your organization has more than 50 employees or generates more than €10 million in revenue in one of the 18 sectors covered by NIS2 (manufacturing, healthcare, transportation, digital services, etc.). ANSSI offers a tool for estimating compliance on MonEspaceNIS2. Suppliers to critical entities may also be affected, regardless of their size.

What are the specific risks my company faces if its endpoints are not hardened during an ANSSI audit?

ANSSI may issue a compliance order, conduct an audit, and, in the event of persistent non-compliance, impose fines of up to €7 million or 1.4% of global revenue for large entities. Company executives may also be held personally liable.

Does the ReCyF framework specifically require CIS Benchmarks or ANSSI baselines?

No, ReCyF does not mandate a specific technical standard. It requires a “secure baseline configuration based on a recognized standard.” CIS Benchmarks and the ANSSI hardening guides are the two references most frequently cited in the official supporting documents.

Does a recent ISO 27001 audit replace NIS2/ReCyF compliance?

No. ISO 27001 is a voluntary certification that does not constitute legal compliance with NIS2. It can help accelerate ReCyF compliance, but it does not cover the obligation to report incidents to ANSSI or the requirements for continuous configuration traceability.

How long does it take to secure a Windows environment with 200 workstations in preparation for ReCyF?

Starting from scratch, expect a timeline of 12 to 18 months: initial inventory and audit (1 to 2 months), definition of the baseline (1 month), deployment (3 to 6 months), validation and remediation of discrepancies (3 to 6 months), and implementation of continuous monitoring (3 months). An automated hardening platform can cut these timelines in half or by two-thirds.

What is the difference between an EDR and a hardening tool in terms of meeting ReCyF requirements?

EDR monitors suspicious behavior in real time. Hardening reduces the attack surface by securing configurations before an incident occurs. Both address distinct ReCyF objectives and are complementary.

Sources

Cyberlib is an agentless SaaS platform for hardening Windows endpoints. It automates the measurement, management, and remediation of security configurations based on CIS and ANSSI baselines and ReCyF requirements. Request a demo