Guideline for a healthy information system v.2.0 (EN)

Each organization develops within a complex computing environment specific to itself. As such, any position taken or action plan involving the information system security must be considered in light of the risks foreseen by the management. Whether it is organisational or technical measures, their implementation represents a cost for the organization, which needs to ensure that they are able to reduce an identified risk to an acceptable level.
 
In the most sensitive cases, the risk analysis may call into question certain previous choices. This may be the case if the probability of an event appearing and its potential consequences prove critical for the organization and there is no preventive action to control it. 

The recommended approach consists, in broad terms, of defining the context, assessing the risks and dealing with them. The risk assessment generally works by considering two areas: the likelihood and the impacts. This is then followed by the creation of a risk treatment plan to be validated by a designated authority at a higher level. 

Three kinds of approach can be considered to control the risks associated with the information system:

In this last case, the EBIOS method referenced by ANSSI is recommended. It is able to write down security needs, identify the security objectives and determine the security demands 

/STANDARD
The qualification delivered by ANSSI offers security and trust guarantees to purchasers of solutions listed in the product catalogues and qualified service providers that the agency publishes. 

Beyond organizations subject to regulation, more generally ANSSI encourages all companies and French administrations to use products that it qualifies; the only proof of a serious and in depth study of the technical functioning of the solution and its ecosystem. 

In terms of qualified service providers, this certification is able to respond to the cybersecurity stakes and projects for the entirety of the French companies that ANSSI could not address on its own. Assessed on technical and organisational criteria, the qualified service providers cover the vast majority of the information system security jobs. Therefore, depending on its needs and the geographical position an organization will be able to call on an Information System Security Audit Service Provider (PASSI), a Security Incident Response Service Provider (PRIS), a Security Incident Detection Service Provider (PDIS) or a Cloud Computing Service Provider (SecNumCloud)