On 7 September 2026, ANSSI published the first ReCyF v2.5 practical sheets on MesServicesCyber. These documents translate the framework's 20 objectives into lists of concrete actions and supporting evidence to produce. For teams engaged in a NIS2 programme, reading them is not optional: they define what an inspector will consider real compliance, as opposed to paper compliance.
What ReCyF v2.5 changed
Published in March 2026, the Référentiel Cyber France (ReCyF) translates NIS2's cybersecurity obligations into 20 security objectives and 152 implementation means. Version 2.5 strengthened 23 existing controls, mainly around three themes: software supply chain management, strong authentication, and incident notification processes.
These revisions did not change the overall structure of the framework. They clarified requirements that version 1.0 left open to organisational interpretation. An entity that began its compliance programme on the basis of the initial objectives must therefore check its position on these 23 strengthened controls.
The structure of the practical sheets
The practical sheets are organised into five categories: Defence, Protection, Governance, Resilience and NIS2 Obligations. The first four cover the risk management pillars. The fifth covers the procedural obligations specific to the directive: notification deadlines, incident qualification, and updating the inventory of essential systems.
Each sheet details the expected measures, the evaluation criteria and the documents to produce. The level of precision is significantly higher than that of the base framework. Where ReCyF stated "implement formalised management of privileged access", the corresponding practical sheet requires an up-to-date inventory of privileged accounts, a documented revocation procedure and a quarterly review with a written trace.
This difference in granularity is not trivial. An organisation may believe it has met objective 8 (identity and access management) because it has an IAM tool and an internal policy. The practical sheet may reveal that the audit trail does not exist in the expected format, or that the rights review is not recorded in a way that can be produced during an inspection.
A concrete example: the software supply chain
Software supply chain management is one of the three themes strengthened in ReCyF v2.5. The associated practical sheet requires that every software component present in essential systems be inventoried, that its origin be traceable, and that security updates be applied within a period defined by the organisation's internal policy.
The practical question is this: today, do you know which software components run your essential systems? If a component in your infrastructure is affected by an actively exploited vulnerability, can you confirm its deployment within 24 hours and respond to an ANSSI request within the NIS2 notification deadline? These capabilities presuppose a formalised SBOM practice. The ReCyF practical sheet provides the framework to structure it if it does not yet exist. For a deeper reading of the parallel obligations, the article on software inventory under NIS2 and DORA details the cross-cutting requirements.
What it changes for programmes already under way
Most organisations that started their NIS2 compliance in 2025 or in the first half of 2026 worked on the basis of the 20 ReCyF objectives. These programmes often documented policies and processes, but less systematically the operational evidence that these processes are actually carried out.
It is precisely on this point that the practical sheets introduce a new constraint. They do not create additional obligations: they clarify what "compliant" means in practice for each objective. For your programme, the first step is to revisit each objective for which you have a "compliant" or "in progress" status and check it against the corresponding practical sheet.
The experience of the first assessments conducted in the second quarter of 2026 shows that the most frequent gaps lie in the Governance category (risk management policy not updated since the programme was launched) and in the NIS2 Obligations category (no formalised procedure to determine whether an event constitutes a significant incident within the meaning of the directive). These two categories deserve priority treatment.
The risk of postponing this internal audit
The first sanctions imposed by European authorities under NIS2 have shown that the failures most easily established concern documentation and governance, rather than technical failures (see the analysis of the first sanctioned cases in Europe). A NIS2 programme without a compliance review updated on the basis of the ReCyF practical sheets exposes the organisation to this type of finding during an inspection.
The publication of the practical sheets on MesServicesCyber on 7 September 2026 does not create a regulatory deadline. It clarifies requirements that are already enforceable. Organisations that become aware of these sheets now have time to close the gaps identified. Those that wait for an inspection will not have this window.
Where to start
The most effective approach is to map your 20 ReCyF objectives into three columns: "documented practice with evidence available", "practice in place without formalised evidence", and "practice to be developed". The second column is generally the largest for organisations already under way. It represents most of the effort required before an inspection, without requiring new technical implementation.
Start with the NIS2 Obligations category of the practical sheets. It covers the three requirements most directly verifiable during an inspection: the incident qualification procedure, compliance with the 24-hour notification deadline, and updating the inventory of essential systems. If your team cannot produce these documents today, that is where your most immediate exposure lies.