Security & governance
RGS (Referentiel general de securite)
The RGS (Referentiel general de securite) is the French general security framework for electronic exchanges between public authorities and with citizens. Maintained by ANSSI, it sets the security rules that administrative authorities must apply to their information systems, including risk analysis, formal security accreditation and the use of qualified products and trust services.
Where does the RGS come from?
The framework rests on an ordinance of 8 December 2005 on electronic exchanges between users and administrative authorities, and on a decree of 2 February 2010 that implements it. The current version, 2.0, was approved by an order of 13 June 2014. ANSSI publishes the text and its annexes, which cover cryptographic mechanisms, certificates and trust service providers.
Who must comply with the RGS?
The RGS is binding on administrative authorities: state administrations, local authorities, public administrative establishments, bodies that manage social protection schemes, and other bodies in charge of an administrative public service. For everyone else it serves as a guide to good practice, and it often appears in tender documents as a reference even when the buyer is not strictly bound by it.
What does the RGS require?
The framework describes a staged approach that starts with risk analysis and leads to a formal accreditation decision. Its main elements are listed below.
| Element | What it involves |
|---|---|
| Risk analysis | Identifying what the system must protect and against which threats; described as the first and most important obligation |
| Security accreditation | A formal decision by the responsible authority that the system may go into service with its residual risks accepted |
| Security functions | Identification, confidentiality, electronic signature and timestamping at a defined security level |
| Qualified products | Security products assessed by ANSSI against published criteria |
| Qualified trust services | Certificate and timestamp providers assessed by accredited bodies |
| Cryptographic rules | Annexes setting out acceptable algorithms, key sizes and key management |
How does the RGS affect storage and backup?
Accreditation covers the whole system, so where data is stored, how it is backed up and who administers the storage platform are part of the file the authority signs off. The cryptographic annexes inform choices on encryption at rest and key handling. Using a qualified service creates a presumption of conformity for the security level concerned, which is why public buyers ask suppliers which components hold a qualification and which are covered by the buyer's own risk analysis.
Frequently asked questions
Does the RGS apply to private companies?
It is not binding on them. Private organizations use it as a good practice reference, and suppliers to public bodies meet it through their customers' requirements.
What is security accreditation under the RGS?
It is the formal decision, taken by the authority responsible for a system, that the system can be put into service given the risks identified and the measures applied.
Who qualifies products and services under the RGS?
ANSSI qualifies security products. Trust service providers are assessed by bodies that are accredited and authorized for that purpose.
Related terms
- ANSSI: the agency that maintains the framework.
- HDS certification: the sector certification for health data hosts.
- Encryption at rest: protecting stored data with cryptography.
- Key management service (KMS): where encryption keys are held.
- Third-party risk management: assessing suppliers against requirements.