ReCyF and NIS2: a control framework meets a looped governance

France still has not transposed the NIS2 directive: the so-called "resilience" bill, adopted by the Senate on 12 March 2025, was pulled from the National Assembly's agenda again on 6 October 2026. The European transposition deadline was 17 October 2024.

That delay produces an interesting situation for anyone working on governance: the framework exists before the law. Since 17 March 2026, France's cyber agency ANSSI has published the Référentiel Cyber France (ReCyF), listing the measures it recommends for meeting NIS2's security objectives. It is organised into four pillars — Governance, Protection, Defence, Resilience — broken down into twenty-two domains, and corresponds to the framework mentioned in Article 14 of the bill. Issued as a working document, it is not mandatory by default, but an entity that applies it will be able to rely on it during an inspection.

What a control framework does well

Credit where it is due: a structured list of measures is the most effective tool there is for getting out of vagueness. It provides a common vocabulary, makes gaps measurable, lets you answer an auditor, and spares every organization from reinventing a control taxonomy. An architecture framework claiming to do without one would condemn itself to producing unverifiable recommendations.

What a control framework cannot do

A framework is, by construction, a photograph. It says what ought to be true; it does not say since when it stopped being so. Three limits appear as soon as you apply it over time:

• It does not carry its own expiry. A measure judged in place at the last audit may have ceased to be the day after a migration, with nothing to signal it.
• It does not qualify the source of the finding. Does "measure in place" mean it was declared, observed in a log, inferred from a configuration, or validated by a test? The words are the same; the value of the information is not.
• It does not link the measure to the decision that produced it. A waiver granted two years ago for a good reason becomes, without a written trace, an inexplicable non-conformity.

Where Continuous Governance takes over

TEAF's answer is not a competing framework — it offers none — but a mechanism that keeps this one alive. Three connection points are enough to illustrate it.

ReCyF's Governance pillar plugs into Intent and Decision. A security policy, inside the Loop, is not an annual document: it is an Intent from which dated Living ADRs derive. Each waiver is a traced decision with a review date, which turns an exception into a governed object rather than a blind spot.

The Protection and Defence pillars plug into Automation and Observation. Measures that can be instrumented — multi-factor authentication, logging, monitoring — must report their real state into the Observation component, where they become Validated rather than Declared. That is the difference between "we have deployed MFA" and "97% of privileged accounts used it yesterday".

The Resilience pillar closes the loop through Learning. The 24-hour notification duty under NIS2 is, in Loop terms, an Observation → Decision path under a time constraint. A setup never rehearsed will not hold that deadline. And what the incident teaches must flow back into Learning, or the same measure will fail twice.

The Compliance Liaison role is precisely the one that attaches these obligations to the Loop instead of handling them in a parallel register — its mission since Book II — and ReCyF finally gives it a French list of measures to work from.

What neither of them settles

Two honesties to close with. The first: applying ReCyF makes you compliant with nothing as long as the law is not passed, and its exact standing will depend on the final text and its implementing decrees. The second: TEAF makes nobody compliant either. It is neither a security framework nor an audit method, and its own status remains that of a framework under validation. What it contributes here is limited but real — preventing compliance work done once from going stale in silence.

For an organization starting out, the order remains the one described in TEAF Light and the 1-1-1 principle: one process, one loop, one measurable objective. The twenty-two domains come later; they will only hold if there is a loop to carry them.

• ReCyF has existed since March 2026, the transposing law still does not: the framework precedes the obligation.
• Four pillars, twenty-two domains, not mandatory by default but relied upon if applied.
• A framework carries neither its expiry, nor the source of its findings, nor the decision that produced it.
• The Loop brings those three: Living ADR, the Declared/Observed/Inferred/Validated taxonomy, closure through Observation and Learning.
• Neither ReCyF nor TEAF makes you compliant: one lists, the other maintains.

Sources

• ANSSI — The NIS 2 directive
• Next — ANSSI publishes its ReCyF
• Leto — Resilience bill postponed, October 2026