INTRA/FRFrance

What the record establishes for France, measure by measure, and what each source requires of the measure it governs.

Binding: 11
Recommended: 4
Reported: 0
Measures touched: 15 of 110
Sources cited: 3

Control	Source	What it establishes	Prerequisite or recommendation
11Mandatory
DP007/FR Data loss prevention deploymentMandatory	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The social and economic committee has to be informed and consulted before the decision to deploy the capability, and the worker informed before content of theirs is inspected.
GV010/FR Worker representative engagementMandatory	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The body brought in is the social and economic committee, informed and consulted before the decision, and informed again before automated personnel management processing is introduced.
MD004/FR Endpoint activity monitoringMandatory	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The social and economic committee has to be informed and consulted before the decision to put the endpoint agent in place, and the worker informed before it reaches them.
MD005/FR Network and egress monitoringMandatory	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The social and economic committee has to be informed and consulted before the decision to put the traffic inspection in place, and the worker informed before it reaches them.
MD006/FR Electronic mail and collaboration monitoringMandatory	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The committee has to be informed and consulted before the decision to record the platform, and the worker informed that what passes through it is kept.
MD011/FR Privileged session recordingMandatory	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The social and economic committee has to be informed and consulted before the decision to put the session recorder in place, and the worker informed before it reaches them.
MD012/FR User and entity behavior analyticsMandatory	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The social and economic committee has to be informed and consulted before the decision to put the analytics engine in place, and the worker informed before it reaches them.
MD013/FR Physical access monitoringMandatory	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The social and economic committee has to be informed and consulted before the decision to put the access-control recording in place, and the worker informed before it reaches them.
MD014/FR Video surveillance of the workplaceMandatory	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The committee has to be informed and consulted before the decision to install the cameras, and the workers informed before they are recorded.
MD015/FR Geolocation of vehicles and devicesMandatory	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The social and economic committee has to be informed and consulted before the decision to put the tracking device in place, and the worker informed before it reaches them.
MD016/FR Measurement of pace and performanceMandatory	Décision n° 492830, Amazon France LogistiqueConseil d’État, tenth and ninth chambers · read 16 Aug 2026	That the fine for scanner-measured warehouse work stands, reduced to 15,000,000 euros, the original deliberation remaining what states the finding.	Measuring warehouse work through handheld scanners has been found unlawful in its detail, and the fine for it stands at 15,000,000 euros after review.
4Recommended
DP005Privileged access managementwhere writtenRecommended	Guide d'hygiène informatiqueAgence nationale de la sécurité des systèmes d'information · read 29 Aug 2026	Forty two measures at a standard and a reinforced level, among them the joining, leaving, and function change procedures written with the human resources function, and a minimum retention of one year for security critical events.	An exhaustive inventory of the privileged accounts is kept current, and reviewed periodically to make sure access to sensitive items is held, the working directories and the mailboxes of senior managers named among them. The review is also what removes the access left behind by a departure. A simple naming convention for service and administration accounts is wanted, because it makes both the review and the detection of an intrusion easier.
MD002Log collection and centralizationwhere writtenRecommended	Guide d'hygiène informatiqueAgence nationale de la sécurité des systèmes d'information · read 29 Aug 2026	Forty two measures at a standard and a reinforced level, among them the joining, leaving, and function change procedures written with the human resources function, and a minimum retention of one year for security critical events.	The critical components are determined first, the workstations of sensitive users named among them, and the logging on each is configured to match. Security critical events are kept for at least a year, or longer where the sector’s legal obligations require it, and the time synchronization source is the same across components so that events can be correlated. At the reinforced level the logs are centralized on a dedicated device, which is wanted for three reasons: automated searching, long archiving, and preventing an attacker from erasing the traces of their passage on what they compromised.
PS007Role change and internal transferwhere writtenRecommended	Guide d'hygiène informatiqueAgence nationale de la sécurité des systèmes d'information · read 29 Aug 2026	Forty two measures at a standard and a reinforced level, among them the joining, leaving, and function change procedures written with the human resources function, and a minimum retention of one year for security critical events.	The procedures for arrival, departure, and change of function are defined together with the human resources function, and what they have to reach is listed: the creation and deletion of accounts and the mailboxes attached to them, the rights to grant and to withdraw from a person whose function changes, physical access to the premises with badges and keys issued and returned, the mobile equipment assigned, and the handling of sensitive information, transferring or changing the passwords and codes on existing systems among it.
PS008Leaver processwhere writtenRecommended	Guide d'hygiène informatiqueAgence nationale de la sécurité des systèmes d'information · read 29 Aug 2026	Forty two measures at a standard and a reinforced level, among them the joining, leaving, and function change procedures written with the human resources function, and a minimum retention of one year for security critical events.	The rights assigned to a person are revoked on their departure, and the procedure covers the accounts and mailboxes, the badges and keys, the mobile equipment issued, and the passwords and codes on existing systems, which are transferred or changed.