Does NIS2 replace France's LPM cyber rules?

No. NIS2 does not replace the cybersecurity rules introduced by France’s 2013 military programming law (LPM), which apply to operators of vital importance (OIV). The two regimes coexist, and many OIVs are expected to fall under NIS2 as essential entities too. France’s “resilience” bill does, however, plan to overhaul the OIV framework.

This article is mainly relevant to organisations operating in France. For the general scope method, see Who does NIS2 apply to?.

The LPM and OIVs in brief

Article 22 of Law No. 2013-1168 of 18 December 2013 on military programming for 2014 to 2019 created cybersecurity obligations for operators of vital importance. The state designates these operators, confidentially, under France’s framework for the security of activities of vital importance.

Their obligations apply to their information systems of vital importance (SIIV): security rules set by sector-specific orders, declaring SIIVs to ANSSI, incident reporting and inspections. They are written into France’s Defence Code.

Why NIS2 does not replace the LPM

The two texts have different purposes and sources:

	LPM (OIV)	NIS2
Origin	French law, national defence and security logic	EU directive, internal market and resilience logic
Who	A small number of designated operators, often confidential	All entities in 18 sectors above the thresholds, plus designated entities
What	The most critical systems (SIIV)	The entity’s entire network and information systems
Level of requirement	Very high, on a narrow perimeter	A baseline of 10 measures, on a broad perimeter

NIS2 therefore widens the base without removing the stricter requirements on the most sensitive systems.

What changes for an OIV

OIVs are mostly large organisations in sectors listed in NIS2 Annex I (energy, transport, health, water, digital…). Article 3 of the directive classifies large entities in those sectors as essential, along with critical entities identified under Directive (EU) 2022/2557, the CER Directive (Article 3(1)(f)). Many OIVs are therefore expected to fall under NIS2 as essential entities. How each organisation is classified will depend on the French transposition law and calls for its own legal analysis.

The measures in Article 21 of NIS2 cover the entity’s entire network and information systems, not just its most critical ones. For an OIV in scope, that “rest of the estate” is often where most of the effort lies.

What the French resilience bill plans

The bill on the resilience of critical infrastructure and cybersecurity transposes three EU texts at once:

• the CER Directive on the resilience of critical entities, which leads to an overhaul of the OIV framework;
• the NIS2 Directive;
• the directive accompanying the DORA Regulation for the financial sector.

Adopted by the Senate on 12 March 2025 and by the National Assembly’s special committee on 10 September 2025, it had still not been debated in plenary as of 15 August 2026. The final fit between OIV cyber rules and NIS2 depends on the text adopted. This article reflects the state of the legislative file as of 15 August 2026.

In the meantime: one security programme

Without waiting for the final text, many organisations choose to build a single security programme rather than two parallel ones. It generally covers three topics:

1. a baseline of measures drawn from Article 21 of NIS2, applied across the whole information system;
2. the stricter measures set by sector-specific orders for SIIVs;
3. a coordinated incident reporting process, ANSSI being the authority OIVs deal with today.

How obligations will be split between the two regimes depends on the law adopted: ANSSI and the organisation’s legal counsel are the right people to apply it to a specific case.

To compare with the former NIS1 regime and operators of essential services, see NIS1 vs NIS2: what changed?.

Talk to an expert

Continuous detection across the whole information system, not just SIIVs, is one of the most concrete NIS2 workstreams for an OIV. If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Must an OIV register under NIS2?

Registration rules will be set by the French transposition law. ANSSI already knows OIVs, but NIS2 provides for its own procedure: the guidance ANSSI publishes alongside the law will be the reference.

Is a supplier to an OIV affected?

Not automatically. It may be in scope in its own right if it meets NIS2 criteria. It may also be approached by the OIV under supply chain security, which Article 21 of NIS2 lists among risk management measures.

Does this only concern France?

Yes. The LPM is French law. Other Member States have their own national regimes for critical operators, and the CER Directive is harmonising how critical entities are identified across the EU. If you operate in several countries, check each national framework alongside NIS2.

Will OIV rules become lighter with NIS2?

Nothing in the published texts suggests so at this stage. NIS2 adds a broad baseline and does not provide for lowering the stricter requirements on the most sensitive systems. The French bill reorganises the framework; the final text will say how.

Where do I start if I am an OIV with limited resources outside the SIIV?

Map the systems outside the SIIV perimeter, identify those that could serve as an entry point to the SIIVs, and extend monitoring and access controls to them first. That is often where the gap between today's practice and NIS2 is widest.