What is the main objective of the ANSSI Cybersecurity Guide for Industrial Systems?
The ANSSI Cybersecurity Guide for Industrial Systems sets a minimum security baseline for industrial installations in France. Specifically, it is published by ANSSI (Agence nationale de la sécurité des systèmes d’information), France’s national cybersecurity authority. In practice, it translates cybersecurity expectations into concrete organizational and technical measures that industrial operators can deploy on the ground. Moreover, the guide distributes its recommendations across four cybersecurity classes of increasing stringency, from Class 1 (minor impact) to Class 4 (catastrophic impact).
How are security measures applied across the four ANSSI cybersecurity classes?
The 2025 revision removed likelihood from the classification equation, so the class now depends purely on impact. As a result, this change avoids the previous “looping effect” where deploying more controls could artificially lower a system’s class. Moreover, the measures are strictly cumulative across classes:
- Class 1 systems: implement Class 1 measures only
- Class 2 systems: implement Class 1 + Class 2 measures
- Class 3 systems: implement Classes 1 through 3
- Class 4 systems: implement all measures from Classes 1 through 4 combined
Why is securing industrial systems harder than securing traditional IT?
Industrial environments face constraints that simply do not exist in enterprise IT. Therefore, lifting IT security practices wholesale into operational technology (OT) rarely works. In fact, this is exactly why ANSSI published dedicated guidance.
Specifically, three constraints shape everything:
- Long equipment lifespans: industrial assets routinely run for 20 years or more, which creates deep obsolescence problems
- Availability and integrity come first: unlike IT where confidentiality often dominates, OT cannot tolerate unplanned shutdowns, so patches often cannot be deployed without risking production disruption or safety requalification
- Distributed physical footprint: operators often manage geographically dispersed sites with limited physical protection, which creates vectors that no enterprise firewall will ever see
What are the core principles for securing an industrial network architecture?
ANSSI’s foundational rule is network segmentation into coherent, mutually isolated functional zones. Specifically, you group assets by function and criticality, then strictly control every boundary. Moreover, traffic is denied by default, and only the flows needed for operations are explicitly authorized, documented, and monitored. However, for Class 3 and especially Class 4 systems, architectural controls tighten significantly. In fact, data exports to lower-class networks or corporate IT must rely on unidirectional flows enforced by an ANSSI-qualified physical data diode, so information can only flow outward and no inbound path can be exploited.
What are the ANSSI rules for remote access and telemaintenance?
Remote maintenance (télémaintenance) is one of the highest-risk activities in an industrial environment. In fact, it creates a direct path from an external network into live production systems. Therefore, ANSSI imposes strict baseline requirements across all classes. However, Class 4 systems go further: telemaintenance is strongly discouraged, and when unavoidable, the remote equipment must be fully integrated into the Class 4 perimeter.
Specifically, the core requirements are:
- On-demand only with a defined duration (always-on remote tunnels into OT are not acceptable)
- Multi-factor authentication (MFA) for every remote connection
- Encrypted communications through an IPsec VPN tunnel or equivalent
- Thorough event logging so every action during the maintenance window traces back to an identified user
