France

Europe

French telecom security is anchored in the Loi de Programmation Militaire (LPM) Operator of Vital Importance (OIV) regime for national-critical operators, plus the 2019 "Loi 5G" (Loi Cybersécurité) on core-network component authorization.

Regulator: ANSSI + ARCEP

Primary frameworks: LPM OIV regime, Loi 5G (2019), ANSSI PGSSI, CIIP

OIV designation

Designated telecom OIVs face prescriptive security obligations set by ANSSI, including SIEM integration, vulnerability management, and audit rights. Signaling-firewall deployment is inside scope.

Loi 5G authorizations

Deployment of 5G core equipment requires prior authorization from the Prime Minister on ANSSI advice. Authorization can be conditional, refused, or geographically restricted.

ANSSI qualification

ANSSI runs a security-product qualification scheme (CSPN, elementary/standard). Some critical components require qualified variants.

Key takeaways

• OIV status turns "best practice" into contractual obligation.
• Loi 5G is the closest EU analogue to the UK's high-risk-vendor regime.
• ANSSI qualification is worth checking before RFP shortlist — non-qualified variants may not deploy.