# ANSSI Hygiene Guide, RGS & SecNumCloud

Framework id: `anssi`. Security Framework. Publisher: ANSSI (Agence nationale de la securite des systemes d'information). Version: 2022. Region: France. Mapping licence: CC BY-SA 4.0.
Source text: https://cyber.gouv.fr/en/publications/guideline-healthy-information-system-42-measures

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (96, average coverage 87%)
- Hygiene.1 Sensitise and train: AT-01, AT-02, AT-05, AT-06, PL-04 (92%)
- Hygiene.2 Define and apply a security policy: AC-01, AT-01, AU-01, CA-01, CM-01, CP-01, IA-01, IR-01, MA-01, MP-01, PE-01, PL-01, PL-02, PS-01, PT-01, RA-01, SA-01, SC-01, SI-01, SR-01 (90%)
- Hygiene.3 Carry out regular audits: CA-02, CA-07, CA-09, AT-02, AT-04, PL-04 (88%)
- Hygiene.4 Identify the person responsible for information systems security: AT-03, AT-04, AT-05, CP-03, IR-02, PM-02, PS-09 (92%)
- Hygiene.5 Establish an inventory of IT assets: CM-01, CM-02, CM-08, CM-12, IA-03, PL-02, SA-05 (92%)
- Hygiene.6 Establish access control procedures: AC-02, AC-13, IA-04 (90%)
- Hygiene.7 Manage arrivals, departures and movements of staff: AC-02, IA-04, MA-05, PS-01, PS-02, PS-03, PS-04, PS-05, PS-06, PS-07, PS-08, PS-09 (92%)
- Hygiene.8 Classify information to know how to protect it: AC-15, AC-16, CM-08, MP-03, PT-03, PT-07, RA-02, SI-12, CM-13 (88%)
- Hygiene.9 Control access to external services: AC-20, CA-03, CA-09, SA-09, SR-03 (88%)
- Hygiene.10 Implement strong authentication: AC-01, AC-07, IA-01, IA-02, IA-05, IA-06 (90%)
- Hygiene.11 Distinguish user, admin, and service accounts: AC-02, AC-14, IA-01, IA-02, IA-04, PS-09 (92%)
- Hygiene.12 Protect passwords and secret keys: AC-07, AC-10, AC-12, IA-02, IA-05, IA-07, SC-10, SC-12, SC-13, SC-17, SC-23, SC-38 (92%)
- Hygiene.13 Regularly review authorisations: AC-02 (85%)
- Hygiene.14 Implement least privilege: AC-01, AC-03, AC-06, MP-02, PS-05, SI-09 (90%)
- Hygiene.15 Implement separation of duties: AC-03, AC-05, AC-06, CM-05, MA-05, PS-02 (90%)
- Hygiene.16 Control access to administration functions: AC-06, CM-05, MA-04 (90%)
- Hygiene.17 Segment networks to limit admin access: AC-03, AC-05, AC-06, CM-05, SC-46 (88%)
- Hygiene.18 Keep software up to date: CM-02, CM-06, CM-07, CM-14, SI-02 (92%)
- Hygiene.19 Protect data stored on workstations: AC-19, MP-01, MP-02, MP-04, MP-05, MP-06, MP-08, SC-04, SC-13, SC-28, SI-12, SR-12 (92%)
- Hygiene.20 Restrict software installation: CM-06, CM-07, CM-14, MA-03, SA-06, SA-07, SC-18, SI-07 (92%)
- Hygiene.21 Protect against malware: SI-03, SI-08, SI-16, SC-44 (92%)
- Hygiene.22 Secure email usage: AC-20, SC-05, SC-07, SC-14, SC-15, SC-18, SI-08 (85%)
- Hygiene.23 Segment and filter network flows: AC-04, SA-08, SC-01, SC-02, SC-03, SC-06, SC-07, SC-20, SC-21, SC-22, SC-46 (92%)
- Hygiene.24 Implement secure remote access: AC-17, MA-04, SC-08, SC-11, SC-16, SC-23, SC-47 (92%)
- Hygiene.25 Secure wireless networks: AC-18, SC-40 (88%)
- Hygiene.26 Secure interconnections with partners: AC-18, CA-03, CA-09, IA-03, PE-04, SA-09 (88%)
- Hygiene.27 Use firewalls to protect internal networks: AC-04, SC-05, SC-07 (90%)
- Hygiene.28 Protect administration of network equipment: AC-17, MA-04, MA-07, SC-11 (88%)
- Hygiene.29 Implement centralised log management: AC-09, AU-01, AU-02, AU-03, AU-04, AU-05, AU-06, AU-07, AU-08, AU-09, AU-10, AU-11, AU-12, CA-07, IR-05, SI-04, SI-11 (92%)
- Hygiene.30 Implement regular data backups: CP-01, CP-02, CP-06, CP-07, CP-08, CP-09, CP-10 (90%)
- Hygiene.31 Perform vulnerability management: AC-13, CA-02, CA-04, CA-07, RA-05, RA-07, SA-11, SI-06, SR-06, SR-10 (92%)
- Hygiene.32 Manage user account lifecycle: AC-02, IA-04, PS-04, PS-05 (90%)
- Hygiene.33 Apply security patches promptly: RA-05, SA-11, SI-01, SI-02, SI-05, SI-10, CM-14 (92%)
- Hygiene.34 Manage changes carefully: CM-03, CM-04, CM-05, CM-14, MA-01, MA-02, MA-03, MA-04, MA-06, SA-03, SA-10, SI-01, SI-02, SI-07 (92%)
- Hygiene.35 Define and test an incident response plan: CP-02, CP-03, CP-04, CP-05, CP-10, IR-01, IR-02, IR-03, IR-04, IR-09 (92%)
- Hygiene.36 Establish a governance and risk framework: CA-01, CA-05, CA-06, CM-03, CP-05, PL-01, PL-02, PL-03, PL-06, PL-09, PL-10, PL-11, RA-04, RA-07, RA-09, SA-01, SA-02, SA-03, SA-08, SA-10, SR-01, SR-02 (88%)
- Hygiene.37 Secure premises and physical access: MP-04, PE-01, PE-02, PE-03, PE-04, PE-05, PE-06, PE-07, PE-08, PE-16, PE-17, PE-18, PE-19, PE-21, PE-22, PE-23, SR-09 (92%)
- Hygiene.38 Protect environmental infrastructure: PE-09, PE-10, PE-11, PE-12, PE-13, PE-14, PE-15, PE-18, PE-21 (92%)
- Hygiene.39 Implement monitoring and detection: AU-06, CA-07, IR-04, IR-05, PE-06, SI-04, SI-05, SC-48 (92%)
- Hygiene.40 Report and handle incidents: IR-01, IR-04, IR-06, IR-07, IR-09, SR-08 (92%)
- Hygiene.41 Conduct risk assessments: CA-02, CA-06, PL-05, RA-01, RA-02, RA-03, RA-04, RA-07, RA-09 (92%)
- Hygiene.42 Manage third-party and supply chain security: IR-07, SA-04, SA-09, SA-21, SR-01, SR-02, SR-03, SR-04, SR-05, SR-06, SR-07, SR-08, SR-09, SR-10, SR-11 (88%)
- RGS.1.2 Security awareness and competence: AT-01, AT-06 (88%)
- RGS.1.3 Security policy framework: AC-01, AU-01, CA-01, PL-01, PL-09, RA-01, SC-01 (82%)
- RGS.2.1 Non-repudiation and electronic signatures: AU-10 (75%)
- RGS.2.2 Authentication mechanisms: IA-01, IA-02, IA-05, SC-16 (80%)
- RGS.2.3 Cryptographic requirements: IA-07, SC-08, SC-12, SC-13, SC-17, SC-38 (78%)
- RGS.3.1 Risk assessment methodology: RA-03, RA-07, RA-09 (82%)
- RGS.4.1 Security qualification and compliance assessment: CA-02, CA-04, CA-06 (65%)
- SecNumCloud.6.1 Information security policies for cloud services: AC-01, AT-01, AU-01, CA-01, CM-01, CP-01, IA-01, IR-01, MA-01, MP-01, PE-01, PL-01, PS-01, PT-01, RA-01, SA-01, SC-01, SI-01, SR-01 (80%)
- SecNumCloud.6.2 Review and update of information security policies: PL-02, PL-03, PL-06 (85%)
- SecNumCloud.7.2 Risk assessment specific to cloud services: RA-03, RA-04, RA-07, RA-09 (82%)
- SecNumCloud.8.1 Human resources screening and roles: MA-05, PS-01, PS-02, PS-03, PS-07, PS-09 (88%)
- SecNumCloud.8.2 Terms and conditions of employment: PL-04, PS-06 (85%)
- SecNumCloud.8.3 Information security awareness, education and training: AT-02, AT-03, AT-04, AT-06 (92%)
- SecNumCloud.8.4 Disciplinary process and termination: PS-04, PS-05, PS-08 (85%)
- SecNumCloud.9.1 Asset inventory for cloud infrastructure: CM-08, CM-12, RA-02 (88%)
- SecNumCloud.9.2 Media handling and disposal: MP-01, MP-02, MP-03, MP-04, MP-05, MP-08, SI-12 (88%)
- SecNumCloud.9.3 Information disposal and data remanence: MP-06, MP-08, SC-04, SR-12 (88%)
- SecNumCloud.10.1 Access control policy for cloud services: AC-01, AC-08, AC-14, IA-01 (85%)
- SecNumCloud.10.2 User registration and identity management: AC-02, AC-13, IA-04 (90%)
- SecNumCloud.10.3 Access rights management: AC-03, AC-06, SI-09 (90%)
- SecNumCloud.10.4 Privileged access management: AC-05, AC-06 (85%)
- SecNumCloud.10.5 User authentication for cloud services: AC-07, AC-10, IA-02, IA-03, IA-05, IA-06, SC-23 (90%)
- SecNumCloud.10.6 Session management and timeout: AC-11, AC-12, AC-19, SC-10 (90%)
- SecNumCloud.10.7 Remote access to cloud administration: AC-17, SC-47 (82%)
- SecNumCloud.11.1 Cryptographic controls and key management: IA-07, SC-08, SC-12, SC-13, SC-17, SC-38 (82%)
- SecNumCloud.12.1 Physical security of cloud data centres: MP-04, PE-01, PE-17, PE-18, PE-23 (88%)
- SecNumCloud.12.2 Physical access controls for cloud facilities: PE-02, PE-03, PE-04, PE-05, PE-06, PE-07, PE-08, PE-16, PE-19, PE-22, SR-09 (92%)
- SecNumCloud.12.3 Environmental protection for cloud infrastructure: PE-09, PE-10, PE-11, PE-12, PE-13, PE-14, PE-15, PE-21 (92%)
- SecNumCloud.13.1 Operational procedures and hardening: CM-01, CM-02, CM-06, CM-07, CM-14, SA-06, SA-07, SC-18, SI-03, SI-08 (88%)
- SecNumCloud.13.2 Change management for cloud services: CM-03, CM-04, CM-05, CM-14 (92%)
- SecNumCloud.13.3 Capacity management: SC-06, SI-13 (78%)
- SecNumCloud.13.4 Maintenance and support: MA-01, MA-02, MA-03, MA-04, MA-06, MA-07 (92%)
- SecNumCloud.13.5 Backup and restoration for cloud services: CP-09 (85%)
- SecNumCloud.13.6 Vulnerability and patch management: RA-05, RA-07, SI-01, SI-02, SI-05, SI-06, SI-07 (92%)
- SecNumCloud.13.7 Logging and monitoring for cloud services: AC-09, AU-01, AU-02, AU-03, AU-04, AU-05, AU-06, AU-07, AU-08, AU-09, AU-10, AU-11, AU-12, CA-07, SI-04 (92%)
- SecNumCloud.14.1 Network security for cloud infrastructure: AC-04, CA-03, SC-01, SC-02, SC-03, SC-07, SC-15, SC-20, SC-21, SC-22, SC-46 (88%)
- SecNumCloud.14.2 Secure communications and data in transit: AC-17, SC-08, SC-11, SC-16, SC-38 (88%)
- SecNumCloud.14.3 Wireless network security: AC-18, SC-40 (82%)
- SecNumCloud.14.4 Protection against denial of service: SC-05, SC-07, SC-14, SC-47 (88%)
- SecNumCloud.15.1 Security in development and acquisition: SA-01, SA-02, SA-03, SA-04, SA-20, SA-21 (88%)
- SecNumCloud.15.2 System documentation and change control: SA-05 (85%)
- SecNumCloud.15.3 Technical security requirements: SA-08, SA-23, SI-10, SI-11 (82%)
- SecNumCloud.15.4 Configuration management for cloud platforms: SA-10, CM-14 (88%)
- SecNumCloud.15.5 Security testing for cloud services: SA-11, SA-20 (88%)
- SecNumCloud.16.1 Supplier and subcontractor management: AC-20, PS-07, SA-04, SA-09, SA-21, SR-01, SR-02, SR-03, SR-04, SR-05, SR-07, SR-08, SR-09, SR-11 (78%)
- SecNumCloud.16.2 Supplier assessment and monitoring: SA-09, SR-03, SR-06, SR-10 (80%)
- SecNumCloud.17.1 Incident management for cloud services: AU-06, IR-01, IR-02, IR-04, IR-05, IR-06, IR-07, IR-09 (88%)
- SecNumCloud.17.2 Incident response testing and exercises: IR-03, IR-04 (90%)
- SecNumCloud.18.1 Business continuity planning for cloud services: CP-01, CP-02, CP-05, SI-13 (82%)
- SecNumCloud.18.2 Business continuity testing: CP-03, CP-04 (85%)
- SecNumCloud.18.3 Redundancy and disaster recovery: CP-06, CP-07, CP-08, CP-10, SC-47 (82%)
- SecNumCloud.19.1 Compliance with legal and contractual requirements: CA-01, CA-05 (65%)
- SecNumCloud.19.2 Independent security audits and ANSSI qualification: CA-02, CA-04, CA-06, CA-07 (70%)
- SecNumCloud.19.3 Data protection and privacy compliance: PT-01, PT-02, PT-03, PT-04, PT-05, PT-06, PT-07, PT-08, SI-18, SI-19 (72%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=anssi
- Control-to-clause mappings as JSON: /api/v1/frameworks/anssi?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/anssi.json
- Page for people: /frameworks/anssi/