Information security
ANSSI IT hygiene guide — 42 measures
The 42 baseline measures recommended by the French cybersecurity agency to secure an information system, from workstations to the network.
At a glance
- Type
- Good-practice guide (not certifiable)
- Publisher
- ANSSI (France)
- Version
- 2.0 (2017)
- Content
- 42 measures, 10 themes, standard and enhanced levels
42 requirements tracked · 99 shared controls
What is ANSSI hygiene guide?
Published by ANSSI, the French national cybersecurity agency (version 2.0, 2017), the IT hygiene guide sets out 42 measures in ten themes: awareness and training, knowing the information system, authentication and access control, securing workstations, securing the network, securing administration, managing mobile working, keeping the system up to date, monitoring, auditing and responding, and going further.
Each measure belongs to a standard level, the baseline every organisation should aim for first, or an enhanced level for more exposed organisations. It is not a certification, but an excellent, very practical starting point that contributes to the cyber hygiene practices expected by NIS2.
Key requirements
- 1
Awareness and training
Train IT teams and raise the awareness of all users.
- 2
Know the information system
Inventories of hardware, software and privileged accounts, and a network map.
- 3
Authentication and access control
Named accounts, strong passwords, multi-factor authentication, removal of rights on departure.
- 4
Secure workstations, network and administration
Workstation hardening, network segmentation, administration from dedicated workstations.
- 5
Keep up to date and monitor
Patch policy, logging, backups and an incident handling procedure.
Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.
How OK-GRC helps
- The 42 measures tracked one by one, linked to 99 common controls
- Measure-by-measure assessment and a prioritised action plan (high-leverage controls first)
- Authentication, patching, backup policies and an IT charter as templates
- Awareness campaigns (phishing, passwords, mobile working) with quizzes
- A score that automatically feeds your NIS2 and ISO 27001 frameworks
Related frameworks
With ISO 27001 controls in place, your ANSSI hygiene guide starting score is about 55 to 97%.
The controls you put in place for ANSSI hygiene guide also count for:
Frequently asked questions about ANSSI hygiene guide
Is the hygiene guide enough for NIS2?
No. It covers basic practices, but NIS2 also requires governance, risk analysis, supply chain security, continuity and incident reporting. It is, however, an excellent foundation.
Where should we start among the 42 measures?
With the standard-level measures that protect fastest: inventory, accounts and passwords, updates, offline backups, strong authentication for remote access. OK-GRC’s action plan then helps you prioritise the remaining measures.
Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment