SIE

French acronym: Systèmes d’Information Essentiels (ESI in english)

ESI is a concept introduced by the French transposition of the European NIS 1 Directive (Law No. 2018-133 of 26 February 2018). An SIE is an information system on which the provision of an essential service by an Essential Services Operator (ESO) depends. In other words, these are the information systems without which an ESO could not provide the service deemed essential to the functioning of the economy or society.

In practical terms, how does it work?

The identification of ESIs takes place as part of a general risk analysis process. The OSE must declare its ESIs within three months of its designation.

If information systems are essential to the provision of an essential service, they must be declared as EIS, regardless of how they are managed or hosted. This therefore includes managed information systems or those hosted in the cloud: the OSE remains responsible for compliance, including via its service providers.

There are three types of obligations relating to ESIs:

Application of security rules to ESIs (defined by the Order of 14 September 2018), notification to ANSSI of security incidents occurring on ESIs, and compliance checks by ANSSI or a qualified audit provider.

An ANSSI guide details the technical recommendations for bringing an SIE into compliance with the security rules set out in Articles 7 to 16 of the NIS Directive.

Developments with NIS 2: the NIS 1 framework (OSE/SIE) is currently being replaced by the NIS 2 framework, which significantly broadens the scope of entities covered (critical entities and important entities) and alters the regulatory approach. The concept of an SIE as defined under NIS 1 is set to evolve within this new framework.