LPM, OIV, OSE: who is covered and what the obligations are

In cybersecurity, the LPM refers to France's military programming law of 18 December 2013, whose Article 22 required operators of vital importance (OIV) to protect their most critical systems. In 2018, the transposition of the NIS directive added a second regime, for operators of essential services (OSE). The NIS 2 directive is about to extend this framework to thousands of entities. Here is who each regime covers, which obligations apply today, and what is about to change.

A military programming law sets France's defence resources and priorities for several years. Since 2013, each has included a cyber component.

• LPM 2014-2019 (law of 18 December 2013): its Article 22 created the cybersecurity obligations of OIVs in the Defence Code. This is what people usually mean by “the LPM”.
• LPM 2019-2025 (law of 13 July 2018): its Article 34 allows electronic communications operators to deploy detection devices based on technical markers, and ANSSI to install its own when facing a threat, as the Conseil d'État notes.
• LPM 2024-2030 (law of 1 August 2023): it gives ANSSI the power to require blocking or redirection of malicious domain names, and requires software vendors to report significant vulnerabilities and incidents affecting their products to ANSSI and then inform their users, according to ANSSI's FAQ.

These texts came on top of those derived from EU law. The timeline below shows how the two tracks overlapped.

The vital activities security scheme (SAIV), created in 2006, protects operators deemed essential to the nation's survival against malicious acts and natural, technological or health risks. OIVs are identified by their supervising ministry and designated by order. They belong to 12 sectors of vital importance:

• food;
• water management;
• health;
• civil State activities;
• judicial activities;
• military State activities;
• energy;
• finance;
• transport;
• electronic communications, broadcasting and information;
• industry;
• space and research.

The list of OIVs is protected and not published. The Senate report on the resilience bill puts their number at around 300, operating some 1,500 points of vital importance. Beyond cyber, an OIV must draw up an operator security plan, specific protection plans for each of its sites, and appoint a defence and security officer.

Article 22 of the 2013 LPM introduced a section on information systems into the Defence Code. Detailed rules are set by sector orders: the first came into force on 1 July 2016 for health products, water management and food, and the others followed. According to ANSSI, an OIV must:

• identify and declare its SIIV, the vital information systems whose compromise would have serious consequences for the nation;
• apply the security rules set by ANSSI: around twenty technical and organisational rules covering governance, risk management, control of systems, protection and incident management;
• notify incidents affecting its SIIV directly to ANSSI without delay;
• undergo inspections, carried out by ANSSI, another State service or a qualified audit provider;
• apply, in a major crisis, the measures the Prime Minister may impose.

The Prime Minister may also require the use of attack detection systems. Breaches carry criminal penalties: up to €150,000 for directors and €750,000 for the legal entity, according to the analysis by law firm Squire Patton Boggs.

The EU NIS directive, adopted on 6 July 2016, was transposed in France by the law of 26 February 2018, the decree of 23 May 2018 and several orders. It created two categories:

• operators of essential services (OSE), designated by order of the Prime Minister because they provide a service essential to society or the economy. The first list was adopted in November 2018, according to CMS Francis Lefebvre;
• digital service providers: online marketplaces, search engines and cloud services with at least 50 employees or €10m in turnover, which are not designated but apply the rules directly.

An OSE must appoint a representative to ANSSI, declare its essential information systems, notify incidents and undergo inspections. Above all, it applies the 23 security rules of the order of 14 September 2018, within three months to three years of its designation:

• governance: risk analysis, security policy, security accreditation, indicators, audits;
• protection: mapping, configuration, segmentation, remote access, filtering, administration accounts and systems, identification, authentication, access rights, security maintenance, physical security;
• defence: detection, logging, log correlation and analysis, incident response, alert handling;
• resilience: crisis management.

The logic mirrors the RGS for public bodies: a risk analysis, then accreditation. Under Article 9 of the law of 26 February 2018, breaches expose OSE directors to criminal fines of €75,000 to €125,000.

The two statuses are independent: an OIV can be designated an OSE for other activities, and most OSEs are not OIVs. Answer the four questions to see which regime applies today and which awaits you under NIS 2.