Compliance FrameworksEurope
France ANSSI RGS
Referentiel General de Securite - French government security baseline, crypto, IAM, audit.
Referentiel General de Securite - French government security baseline, crypto, IAM, audit.
| Short name | ANSSI RGS |
| Region | Europe |
| Country or scope | France |
| Sector | Government |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ANSSI RGS
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for ANSSI RGS.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for ANSSI RGS and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
FR-RGS-B1 Cryptographic Integrity Mechanisms | Systems must employ ANSSI-approved cryptographic mechanisms to guarantee integrity and authenticity; cryptographic hashes over the deployed software components are the SBOM-level expression of this control (RGS v2.0 Annex B1) | Scan |
FR-RGS-RISK Risk Analysis Asset Identification | Security accreditation rests on a risk analysis (EBIOS-style) that must identify the assets composing the system; an enumerated software component inventory is the entry condition for that analysis (RGS v2.0, risk-analysis requirement) | Scan |
FR-RGS-HOMOLOG Homologation Dossier | Information systems must undergo formal security accreditation supported by a documented dossier describing the system; an identified, timestamped SBOM is a core artifact of such a dossier (RGS v2.0, homologation requirement) | Scan |
FR-RGS-QUALIF Qualified Products and Providers | The RGS establishes qualification of security products and trust service providers, presupposing that the origin and creator of deployed software artifacts is recorded and verifiable (RGS v2.0, qualification scheme) | Scan |
FR-RGS-MCS Maintaining Security Over Time | Accredited systems must be kept in a secure condition throughout their life, including applying security updates; that maintenance is only auditable when component versions are recorded (RGS v2.0, maintien en condition de sécurité) | Scan |
FR-RGS-AUDIT Auditability of Components | Periodic security audits of accredited systems require that the audited components be unambiguously identifiable via standard identifiers (RGS v2.0, audit requirement) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
RGS-A1-1 | Cryptographic Algorithm Approval (Annex A1) |
RGS-A1-2 | Cryptographic Key Management |
RGS-A2-1 | Authentication Mechanism Qualification (Annex A2) |
RGS-A2-2 | Electronic Signature Qualification (Annex A2) |
RGS-A3-1 | Audit Log Integrity (Annex A3) |
RGS-A3-2 | Timestamping and Non-Repudiation (Annex A3) |
RGS-A4-1 | Software Integrity Verification (Annex A4) |
RGS-A4-2 | Secure Software Distribution |
RGS-PSSI-1 | Information System Security Policy (PSSI) |
RGS-HOMO-1 | ANSSI Security Product Homologation |
Policy templates
Written for ANSSI RGS:
- ANSSI RGS: Privacy Notice (French Public Services)
- ANSSI RGS: Data Subject Rights Procedure
- ANSSI RGS: Information Security Policy (PSSI)
And 22 from the standard set, adapted to ANSSI RGS.