What is a PRIS-qualified incident response provider?

A PRIS (prestataire de réponse aux incidents de sécurité) is an incident response provider qualified by ANSSI, France’s national cybersecurity agency. To earn it, the provider is assessed against a public requirements framework covering its methods, its people and how engagements are run. Version 3.2 of the framework, published in October 2025, covers five activities, from hunting for indicators of compromise to cyber crisis management.

This article is part of our incident response series. For the full picture, see What is incident response?.

What “qualified” means in France

In France, qualification is a security approval issued by ANSSI. It confirms that a product or service meets a requirements framework, following an assessment by an approved evaluation body. For services, ANSSI has defined several provider families:

Qualification	Field
PASSI	Information security audits
PDIS	Security incident detection
PRIS	Security incident response

The PRIS framework sets requirements on three levels: the provider itself (organisation, confidentiality, protection of client data), its staff (skills, experience) and how the engagement is carried out (agreement with the client, evidence collection and retention, reporting).

The five activities covered

According to ANSSI, version 3.2 of the framework covers:

Activity	In practice
Searching for indicators of compromise	Looking for traces of a known or suspected attack across the estate
Digital investigation (forensics)	Analysing affected systems to reconstruct what the attacker did
Malware analysis	Working out how a recovered piece of malware behaves
Steering and coordinating investigations	Organising teams, setting priorities, pulling findings together
Cyber crisis management	Supporting senior management in running the crisis

Crisis management is new in version 3.2, published on 28 October 2025: it becomes an activity in its own right, and ANSSI states that requirements for the other four activities are unchanged. A provider can be qualified for only some of these activities. For the difference between technical response and crisis management, see Incident response vs crisis management.

Two qualification levels

Since version 3.0 of the framework, announced by ANSSI on 29 November 2024, there are two qualification levels: substantial and high. The change aims, among other things, at consistency with European work under the Cybersecurity Act, and at better reflecting the operational realities of incident response. The level to look for depends on how sensitive the affected systems are.

Do you have to use a PRIS?

Generally, no. Qualification is a voluntary step taken by the provider, and no general rule requires a business to choose a PRIS. NIS2 lists incident handling among the Article 21 measures and provides for reporting of significant incidents in Article 23, but the text does not say who must carry out the response. As of 15 September 2026, France had not yet adopted its NIS2 transposition law.

Some organisations, particularly public bodies or highly sensitive operators, may be encouraged or required by their own rules to use qualified providers; this depends on the texts that apply to each organisation. For the overall picture, see Is incident response mandatory?.

When to ask for a PRIS

Qualification is a strong criterion when:

• the systems involved are critical or hold sensitive data;
• the incident may end up in court, where the quality of evidence collection will matter;
• you need to show an authority or insurer that you used a recognised third party;
• a customer or main contractor requires it in the contract.

For a small business, what matters most is having identified, before any attack, a responder you can reach at any hour, under a clear contract. See What is an incident response retainer?.

Questions to ask any provider, qualified or not

• Which activities are you qualified for, at what level, and until when?
• How quickly can you respond, remotely and on site?
• How do you collect and preserve evidence?
• Who writes the report, and what does it contain?
• How do you work with the client’s MSP?

The PRIS framework is a good checklist even when comparing providers that are not qualified. For what an engagement actually includes, see What does incident response cover?.

Talk to an expert

Want to know what level of assurance to require for yourself or your clients? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch. Cyna’s certifications and security documents are available on its Trust Center.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

How can I check that a provider really is PRIS-qualified?

ANSSI publishes its catalogue of qualified products and services on cyber.gouv.fr. Check that the provider is listed, for which activities and at what level, and that the qualification is still valid.

Is a non-qualified provider necessarily less capable?

No. Qualification is long and costly, and some highly capable teams do not hold it. Without it, though, you need to check for yourself what the assessment covers: methods, confidentiality, skills and evidence handling. See Assessing a SOC provider's incident response capability.

What is the difference between PRIS and PDIS?

PDIS covers incident detection (continuous, SOC-style monitoring); PRIS covers the response once an incident has happened. They complement each other. See Should you require a PDIS-qualified detection provider?.

Does PRIS matter outside France?

It is a French scheme, so it carries most weight with French organisations and authorities. Elsewhere, the framework is still a useful checklist for comparing any incident response provider.