The transposition of the NIS2 directive into French law is taking shape. ANSSI (the French National Cybersecurity Agency) has published the ReCyF (Référentiel Cyber France) in its working version 2.5, dated March 17, 2026. Linked to Article 14 of the bill on the resilience of critical infrastructure and the strengthening of cybersecurity, this document defines 20 security objectives with acceptable means of compliance for regulated entities.
Two levels of requirements depending on the entity's status
The ReCyF applies a principle of proportionality. Important entities (IE) and essential entities (EE) are all subject to objectives 1 to 15, covering the governance, protection, defense and resilience of information systems. Essential entities are additionally subject to objectives 16 to 20, which notably require a risk-based approach, regular security audits, configuration hardening and continuous monitoring.
Each security objective constitutes a regulatory obligation. To achieve them, ANSSI proposes acceptable means of compliance: these are not the only possible means, but entities that apply them can use them to demonstrate their compliance during an inspection.
To find out whether your organization is affected by the measure, ANSSI provides an online simulator: NIS2 Simulator
Objectives directly related to mobile and application security
Among the 20 objectives of the ReCyF, several directly concern mobile device security and application security, two areas in which the French solutions Pradeo and Yagaan, powered by Pradeo, provide concrete answers.
Objective 3 – Control of the ecosystem
Objective 3 requires entities to map their ecosystem of IT service providers and suppliers, and to periodically verify that their services comply with security obligations. This requirement to control the software supply chain is at the heart of the NIS 2 directive.
The Yagaan Mobile Application Security Testing (MAST) solution meets this requirement by auditing the security and compliance of mobile applications supplied by service providers, publishers or subcontractors, directly from their binary, without access to the source code.
Pradeo Mobile Threat Intelligence complements this control by continuously monitoring the security level of the public applications used within the organization.
Objective 5 – Control of information systems
Objective 5 requires a process for maintaining operational and security condition, including updating the knowledge bases of protection tools and monitoring vulnerabilities. For essential entities, it also requires a formalized procedure for maintaining the security condition of software resources.
Pradeo covers this requirement for mobile: the mobile fleet protection solution automatically updates its detection rules, and the Pradeo Mobile Threat Intelligence platform, with its millions of continuously updated application reports, provides monitoring of mobile application vulnerabilities.
On the application side, Yagaan's Static Application Security Testing (SAST) integrates into CI/CD pipelines to detect and fix code vulnerabilities before going into production.
Objective 8 – Securing remote access to information systems
Objective 8 governs access to information systems from third-party information systems (remote work, mobile working, access from a mobile device). It requires the encryption of communications (VPN, TLS, SSH…) for all entities, and adds for essential entities the obligation of multi-factor authentication as well as disk encryption on mobile equipment used for remote access.
Pradeo Mobile Threat Defense contributes to this requirement on the mobile vector by detecting network attacks targeting devices: unsecured Wi-Fi connections, man-in-the-middle attacks, data interception, rogue access points. The solution also verifies device integrity (rooting, jailbreak, risky configurations) before and during access to the information system.
The Yagaan Runtime Application Self-Protection (RASP) module complements this setup by protecting business applications directly on the device, neutralizing attacks in real time, including offline.
Objective 9 – Protection of information systems against malicious code
Objective 9 requires the implementation of protection mechanisms against malicious code on information system resources, and explicitly mentions mobile equipment. It requires devices to have protection against the execution of malicious code and data from external sources to be analyzed upon receipt.
Important entities may allow BYOD provided they define the authorized devices and prevent others from connecting. Essential entities must prohibit BYOD: only devices managed by the entity or its mandated service provider may connect to the information system.
Pradeo Mobile Threat Defense directly meets this objective by detecting malware, phishing attempts, intrusive applications and network attacks in real time on Android and iOS devices. The solution makes it easy to enroll and remove authorized devices.
For important entities that maintain a BYOD policy, the Secure Private Store goes further: only devices with the application can access company resources.
Objective 12 – Identification of and response to security incidents
Objective 12 requires the implementation of mechanisms to analyze and qualify reported security events, in order to identify potential or confirmed incidents. It also requires the retention of technical records, including alerts raised by malicious code protection tools, which may serve as evidence.
Pradeo Mobile Threat Defense directly feeds this capability by generating and centralizing security events from the mobile perimeter: malware detection, phishing attempts, suspicious connections, risky applications. This data contributes to incident qualification and can be forwarded to existing monitoring tools through UEM or SIEM integrations.
Objective 17 – Information system security audit
Applicable only to essential entities, objective 17 requires security audits to be carried out at regular intervals. The ReCyF explicitly mentions code auditing as one of the possible activities, alongside penetration testing, configuration and architecture audits, and organizational audits.
Yagaan's solutions directly meet this objective. The Static Application Security Testing (SAST) solution enables source code auditing of web and mobile applications, with vulnerability prioritization, reduced false positives and contextual remediation guidance.
Yagaan Mobile Application Security Testing (MAST) complements this setup by auditing mobile applications from their binary code (Android and iOS), without access to the source code, covering both in-house applications and those from third-party suppliers.
Time to prepare
ReCyF v2.5 is still a working version, and adjustments remain possible. But the main guidelines are set, and organizations have every interest in preparing their compliance now.
The framework requires a global approach built around four pillars: Governance, Protection, Defense, Resilience. Mobile security and application security are essential components of it. Pradeo, the only European player recognized as a global leader, for mobile device protection, and Yagaan, powered by Pradeo, an expert in application security. Two complementary building blocks within the global strategy that the ReCyF requires.
