Cross-border: Belgium (CCB) vs France (ANSSI)¶
One directive, two countries¶
NIS2 is an EU directive, not a regulation. A directive is not law in itself; each member state must transpose it into national law, which means the details, the authorities, the portals and the supervision differ from country to country even though the directive underneath is the same. Scaldimet has its headquarters in Belgium and Site Beta in France, so it lives under two transpositions at once. This Lesson is about handling that without missing requirements because the two regimes differ.
The two regimes¶
The same directive produces two operating realities:
| Belgium (headquarters) | France (Site Beta) | |
|---|---|---|
| Authority | Centre for Cybersecurity Belgium (CCB) | ANSSI, with CERT-FR for incidents |
| Transposition | National NIS2 law in force since 2024 | Transposition still being finalised at the time of writing |
| Expected baseline | CyFun (the CCB's framework) | ANSSI's Référentiel Cyber France (ReCyF); EBIOS Risk Manager for the risk method |
| How you engage | The CCB's Safeonweb registration and reporting portal | The French national reporting channel and CERT-FR |
The directive keeps the important things aligned: the reporting timeline (24 hours, 72 hours, one month) comes from NIS2 itself, so it is the same on both sides. What differs is everything around it: which authority, which portal, which language, which national framework is expected, and the fine detail of supervision. Belgium, for instance, leans on CyFun and asks essential entities for a Statement of Applicability; France leans on ANSSI's ReCyF and EBIOS Risk Manager for the risk documentation. One company, two regulators, two sets of initial reporting procedures.
Demonstrating conformity, not just reporting incidents¶
Reporting an incident is only half of what a regulator checks. The other half, running all the time, is demonstrating conformity: showing each national authority that your measures meet its requirements.
Belgium gives Scaldimet a clear route: adopt CyFun (Lesson 3.1), and an accredited ISO 27001 certificate mapped to the right CyFun level is accepted as evidence of conformity. France, at the time of writing, is still finalising its transposition and has published its own national reference, the Référentiel Cyber France (ReCyF), playing a role similar to CyFun. This will keep moving, so treat them as current examples, not fixed facts.
For a multinational organisation, the practical rule is that NIS2 conformity is recognised country by country, so you keep one baseline and map it to each national framework. Where a certificate such as ISO 27001 is recognised as conformity, you rely on it; where it is not, you maintain an explicit mapping from your controls to the national requirements, and keep it current as the national rules evolve. This does not require a separate security programme for each country; it requires a clear mapping of the common control environment to each applicable national requirement.
One incident, two authorities¶
What happens when a single incident that touches both sites? Say a compromise that starts on Beta's French OT and reaches the Belgian ERP. Under NIS2, Scaldimet may have to notify both authorities, each under its own national rules, on the same 24/72-hour clock, in the middle of an incident when attention is scarce. Get this wrong and you have two problems: the incident itself, and a reporting failure in one or both countries that is a separate breach.
The governance lesson from Module 2 returns here in legal form. You keep one governance approach across the two regulators: a single incident-response and reporting playbook that knows, in advance, that an incident may be dual-jurisdiction, and that has the contacts, portals, account registrations and templates for both the CCB and ANSSI ready before anything happens. The cross-border complexity is itself a risk (a missed French report while you handle the Belgian one).
Scaldimet's dual-reporting reality
- Register and maintain reporting access with both authorities now, not during an incident: the CCB's portal for the Belgian entity, the French channel for Site Beta.
- Hold one playbook that, on detecting a significant incident, asks first: does this touch France, Belgium, or both? and routes the 24/72-hour reports accordingly.
- Keep one set of facts, two filings: the same incident, described to each authority under its own rules, on the shared NIS2 timeline.
- Treat a language and contact list for ANSSI and CERT-FR as part of the plan, since an incident is the wrong moment to discover you have neither.
Application: demonstrate conformity across two regimes¶
Scaldimet runs one baseline (CyFun Important) and holds an ISO 27001 certificate. On paper, two short tasks.
-
Demonstration. Site Beta falls under the French regime, which recognises its own national reference, not the Belgian CyFun label. Without building a second security programme, how does Scaldimet show conformity for the French site? Write the approach in three or four lines.
-
A judgement call. True or false, and why: "Scaldimet holds an ISO 27001 certificate, so it is covered for NIS2 in every country it operates in."
Model answer (open after you've drafted yours)
A workable answer to (1): keep the single baseline and map its controls to the French national framework's requirements; rely on the ISO 27001 certificate wherever the French regime recognises it, and where it does not, keep an explicit control-by-control mapping to the French requirements, maintained as the national rules are finalised. One socle, two national mappings, not two programmes.
For (2): false. Conformity under NIS2 is recognised country by country, not once for the whole EU. An ISO 27001 certificate is accepted as evidence in Belgium when mapped to a CyFun level, but another country may recognise it only in part, or expect its own national reference. The certificate is powerful, but a multinational still has to map its one baseline onto each national regime; a single certificate does not close the question everywhere.
Key takeaway
NIS2 is a directive, transposed separately by each member state, so Scaldimet answers to two authorities: Belgium's CCB (which expects CyFun) and France's ANSSI (which expects ReCyF), each with its own portal and procedures. The directive keeps the 24/72-hour and one-month timeline common, but everything around it differs. A single incident affecting activities in both countries may trigger reporting obligations in both jurisdictions. Scaldimet should therefore maintain a dual-jurisdiction playbook that identifies the competent authorities, reporting channels and applicable deadlines before an incident occurs.