Security & governance
ANSSI
ANSSI (Agence nationale de la securite des systemes d'information) is the national cybersecurity agency of France. Created in 2009 as a service of the Prime Minister and placed under the Secretary General for Defence and National Security, it defends state information systems, publishes security guidance, and qualifies security products and services.
What does ANSSI do?
The agency describes its work through five missions: defend, know, share, support and regulate. In practice that covers incident response for the state and for critical operators, published guides on topics from administration to backup, and qualification schemes that assess products and service providers against written reference frameworks. Two of those frameworks matter most to storage teams: the RGS, which binds administrative authorities, and SecNumCloud, the qualification for cloud services intended to hold sensitive data.
What does ANSSI recommend for backups?
The reference document is the guide on the fundamentals of information system backup (ANSSI-BP-100), first published in October 2023 and revised to version 1.1 in November 2025. It contains 32 numbered recommendations across architecture, operations and data protection. The ones with the most direct storage consequences are summarized below.
| Topic | ANSSI recommendation | Storage consequence |
|---|---|---|
| Number of copies | Three distinct copies on different media, at least one offline | A second site or medium, plus a copy that is not reachable online |
| Directory isolation | Backup servers kept out of the production directory domain | Local or dedicated accounts on backup and storage systems |
| Datastore access | Datastores reachable only from backup servers | Network filtering in front of the storage endpoints |
| Administration | Named, dedicated administrator accounts with separate roles | Role separation on the storage platform itself |
| Restore testing | Backups tested regularly against a written restore procedure | Capacity and time reserved for test restores |
| Data in transit | Backup flows encrypted and mutually authenticated | TLS between backup software and storage |
Is ANSSI guidance mandatory?
The backup guide states that its recommendations are not normative unless a regulation provides otherwise. That makes it advisory in itself, but it is widely used as the benchmark in French audits and tender documents, and other texts can make parts of it binding. The RGS is mandatory for the administrative authorities it lists, and sector rules such as HDS certification apply to hosts of health data.
How does ANSSI view immutable and offline copies?
The guide treats an offline copy as indispensable, even if it is taken less often than online backups. It accepts write-once storage as a protection but asks organizations to check how robust the immutability really is, and it considers offline media more robust than online write-once storage. The compromise it describes is frequent online write-once copies combined with less frequent offline ones. For outsourced backups it recommends keeping data in the European Union and encrypting it with the organization's own means before it reaches a provider, which connects to the debate on extraterritorial data access.
Frequently asked questions
What is SecNumCloud?
SecNumCloud is an ANSSI qualification for cloud services intended for sensitive data. It covers infrastructure, platform and software services, and one of its stated aims is protection against the application of extraterritorial laws.
When was ANSSI created?
ANSSI was created in 2009. It is a service of the Prime Minister, under the authority of the Secretary General for Defence and National Security.
Does following an ANSSI guide amount to certification?
No. Guides are recommendations. Qualification is a separate, formal assessment of a product or service against a published reference framework.
Related terms
- RGS: the French security framework for administrative authorities.
- HDS certification: the French certification for hosts of health data.
- Extraterritorial data access: why the location and control of data matter.
- Encryption in transit: protecting backup flows on the network.
- Data localization: keeping data within a jurisdiction.