Cybersecurity in companies is no longer just about stacking layers of perimeter protection. The experiences published by the CNIL in 2024 regarding massive data breaches show that the exploited vulnerabilities are often structural: insufficient segregation between frontend and backend, lack of usable logging, unaudited subcontractors. Here, we address the technical and regulatory aspects that truly change an organization’s defense posture.
Logging and flow segregation: the two recurring blind spots
The majority of compromises analyzed by the CNIL in 2024 share a common point: the affected companies did not have sufficient logging to reconstruct the attack chain. Logging does not mean just storing logs in a corner. The CNIL recommends systematic logging of application, API, system, and network accesses, coupled with automated alerts allowing for quick verification by a human operator.
The effective segregation of data between application layers is the second lesson. An attacker who compromises a web server should never have direct access to business databases. We recommend segmenting networks by zones of trust, with strict filtering rules between each segment, and periodically checking that these rules have not been circumvented by infrastructure changes.
To deepen these practices, information from the Simpler Computing website details approaches suitable for organizations that have not yet formalized their security architecture.
NIS2 Transposition in France: concrete obligations for companies
The NIS2 directive profoundly modifies the scope of companies subject to cybersecurity obligations. Its transposition into French law requires the affected entities to appoint a Chief Information Security Officer (CISO), conduct an annual risk analysis, and notify any significant incident within 24 hours.
The penalties can reach 2% of global revenue or €10 million. This level of penalty places cybersecurity compliance on the same level as GDPR compliance in terms of financial risk.
A common mistake is to treat NIS2 as a documentation exercise. Producing a security policy without verifying its technical implementation does not protect against attacks or sanctions. We observe that companies that make the best use of this regulatory constraint are those that integrate risk analysis into their project management cycle, not in a fixed annual report.
Expected technical and organizational measures
- Establishing an incident detection process with updated compromise indicators, and a defined escalation path before a crisis occurs.
- Integrating security requirements into contracts with subcontractors, including an audit right and a notification obligation in case of a compromise of their own information system.
- Periodic verification of the security of service providers with access to data or systems, through technical tests or structured questionnaires.
Cyber Resilience Act: what changes for software and connected devices in companies
The European regulation 2024/2847, known as the Cyber Resilience Act (CRA), published in the Official Journal of the EU on November 20, 2024, introduces security-by-design requirements for all products containing digital elements. Specifically, any software or connected device marketed in the EU must meet security criteria from the moment it is placed on the market.
For user companies, the impact is indirect but real. Software publishers and equipment manufacturers will need to provide security updates throughout the expected lifespan of the product. A product without patch support can no longer be legally marketed. This changes the way suppliers are evaluated: the software maintenance criterion becomes a regulatory compliance criterion, not just a commercial advantage.
Companies using custom software solutions or industrial connected devices must anticipate the security lifecycle of these products now. An IoT sensor deployed without an update policy will become a point of vulnerability and a risk of non-compliance.
Managing subcontractors: the link that security policies ignore
The massive data breaches analyzed by the CNIL show that compromises often occur through a service provider. A subcontractor accessing your information system with high-privilege credentials and without supervision poses a risk equivalent to the absence of a firewall.
The CNIL recommends explicitly integrating applicable security requirements for subcontractors into contracts. This goes beyond a generic confidentiality clause:
- Defining the expected protection measures (encryption, multi-factor authentication, access segregation) with verifiable criteria.
- Providing for a technical audit right, exercised at least once a year or after any incident reported by the provider.
- Requiring prompt notification in case of a compromise of the subcontractor’s system, even if your company’s data does not seem directly affected.
An unaudited subcontractor is an open door to your information system. Contractual formalization alone is not enough: without technical verification, it remains declarative.
Companies strengthening their cybersecurity in 2024 can no longer be content with protecting their own perimeter. Between NIS2, the Cyber Resilience Act, and feedback from the CNIL, the regulatory framework now imposes an extended approach across the entire digital value chain. Security is as much about contracts and audits as it is about firewalls.
