Should you require a PDIS-qualified detection provider?

In most cases, no. PDIS, the qualification issued by ANSSI (the French national cybersecurity agency), is expected for the vital information systems of French operators of vital importance. For SMEs and mid-sized firms, including those in scope of NIS2, the texts discussed below do not mention it; your legal adviser can confirm how they apply to your case. Its framework remains an excellent grid for assessing any detection provider.

This article expands on one of the criteria in our guide How to choose a SOC provider, which covers the evidence you can ask a SOC to provide.

What is the PDIS qualification?

PDIS stands for “prestataire de détection des incidents de sécurité”, or security incident detection service provider. ANSSI grants the qualification under French Decree No. 2015-350 of 27 March 2015. It certifies that a provider meets a requirements framework which, according to ANSSI, covers three areas: the provider itself, its staff and the way detection services are delivered. The qualification covers the whole security incident detection activity.

Which version of the framework applies?

The framework in force is version 2.0, dated 21 December 2017. An ANSSI note of 27 January 2025 added an addendum: work on an update, started in 2022, is still under way, and the addendum amends certain requirements on a transitional basis until the new version is published. ANSSI publishes the framework, its English version, the addendum and the assessment template on its qualification frameworks page.

Who has to use a qualified provider?

Operators of vital importance, for their vital systems

The security rules of France’s SAIV scheme (security of activities of vital importance) require, for each vital information system, a log correlation and analysis system operated in line with the PDIS framework, as well as qualified detection systems run by ANSSI, other government services or qualified providers. This is the main case where PDIS is expected.

Other organisations: no general requirement

The NIS2 directive does not mention PDIS. Its Article 24 allows Member States to require ICT services certified under European certification schemes, which is not the same as a national qualification. As of 13 October 2026, France had not yet adopted its NIS2 law, so no one can say what it will require. See Does a managed SOC help with NIS2?.

A buyer can also require PDIS in a tender or contract. In that case the requirement stems from the contract rather than from regulation.

When to require it, and when to use it as a grid

Situation	What the texts and documents say
Vital information system of a French operator of vital importance	SAIV security rules refer to the PDIS framework and qualified providers
Public tender or contract that requires it	Qualified provider, for the scope set by the tender or contract
NIS2 entity, SME or mid-sized firm	NIS2 does not mention PDIS: the framework can serve as a grid
MSP client with no regulatory constraint	Evaluation grid, alongside other evidence (ISO 27001, reports, references)

If you do require PDIS, check the exact scope of the qualification: which service, which activities, which conditions. A qualification does not automatically cover every offer from the same provider.

Framework-inspired questions to ask any SOC

Even without a qualification, you can borrow the framework’s logic:

1. The provider: who runs the service, from where, and with what subcontracting? See Why choose a European SOC provider?.
2. The staff: are analysts employees, trained and available around the clock?
3. The service: how is the detection strategy defined with you, how are logs protected, how are analyses traced?
4. The commitments: which timings, which reports? See What SLA should you expect from a managed SOC?.

For a fuller list, see Questions to ask a SOC provider before signing.

How Cyna approaches it

Cyna is ISO 27001 certified. Its managed SOC runs 24/7 from France with in-house teams, and its CERT is a member of InterCERT France. Cyna’s certifications and security documents are available on its Trust Center, so partner MSPs and their clients can review them when assessing the service.

Talk to an expert

Need to meet a qualification requirement or assess a SOC for a client? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

How many providers are PDIS-qualified?

ANSSI publishes the current list on cyber.gouv.fr, including qualified providers and those in the process of qualification that have agreed to be listed. Check it directly rather than relying on a figure quoted elsewhere, as it changes.

Is there an equivalent outside France?

PDIS is a French national scheme, so check what your own national authority recommends. Separately, NIS2 Article 24 lets Member States require ICT services certified under European certification schemes, which is a different mechanism. See Why choose a European SOC provider?.

Does PDIS cover incident response?

No. Incident response falls under another ANSSI qualification, PRIS. See What is a PRIS-qualified incident response provider?.

Does ISO 27001 certification replace PDIS?

No, they measure different things. ISO 27001 certifies an information security management system; PDIS specifically assesses the detection service. Both are useful evidence within their own scope.