As of October 12, 2026, the NIS 2 directive has not been transposed into French law. The bill on the resilience of critical infrastructure and the strengthening of cybersecurity, passed by the Senate on March 12, 2025, was scheduled for debate in the National Assembly on October 7 and 9. The Conference of Presidents removed it from the agenda on October 6. The rapporteur, Éric Bothorel, hopes for a new scheduling within two to three weeks.

Should one conclude that this matter can wait? No, for two reasons that do not depend on Parliament. First, the European directive places company leadership at the center: governing bodies approve cybersecurity measures, oversee their implementation, and can be held liable for non-compliance. Second, the market for Chief Information Security Officers (CISOs / RSSIs) does not follow the legislative calendar: it is scarce, highly mobile, and under strain.

This article answers the question facing Board Chairs, CEOs, CFOs, Group CHROs, and investment funds: which CISO, reporting to whom, and at what point should they be recruited or reinforced. It is written by Sam Lozinguez, Partner Tech & AI at Laroze Partners, an executive search firm for tech and AI leaders. Recruitment is merely the outcome of a governance decision. This article does not constitute legal advice.

Definition. CISO (Chief Information Security Officer, or RSSI in French): senior executive responsible for defining and enforcing the company's information systems security policy and reporting on it to executive leadership. NIS 2: European Directive 2022/2555 on the security of network and information systems, which extends cyber risk management and incident notification requirements across numerous sectors.

Key Figures to Know

Why This Topic Demands Attention Now

Three dated facts make this matter urgent, despite the postponement.

The postponement does not eliminate the deadline; it makes it uncertain. The directive was scheduled to be transposed by October 17, 2024. The French text is stalled on a specific point, Article 16 bis, which addresses encryption and the ban on intentionally weakening security. The rapporteur hopes for a swift rescheduling. Regulated entities will only learn their exact obligations once the law is enacted, after which compliance deadlines will begin immediately.

ANSSI advises not to wait. Its Director General, Vincent Strubel, called on entities to start without waiting for the law. In March 2026, the agency published a beta version of the ReCyF framework, which lists recommended measures to meet NIS 2 objectives. An executive who waits for the law before acting will fall behind peers.

The threat does not pause. According to CESIN, 40% of French companies experienced at least one significant cyberattack over the past year. ANSSI handled 1,366 confirmed incidents in 2025—a level stable compared to 2024—and 196 data thefts versus 130.

Three common misconceptions circulate.

“No law, no issue.” Existing frameworks already apply, depending on the business activity: the DORA regulation for financial entities since January 17, 2025, GDPR, and mandatory breach notification obligations. Furthermore, clients, insurers, and investors are already asking the questions the law will formalize.

“It is the CISO's problem.” It is primarily leadership's problem. The European text requires the management body to approve and oversee. A CISO without executive committee backing shoulders a responsibility they cannot effectively execute.

“NIS 2 only affects large corporations.” ANSSI states that the regulation targets entities ranging from SMEs to CAC 40 groups, depending on their size and sector. Thresholds published by ANSSI differentiate between essential entities (generally starting from 250 employees, or €50M turnover and a €43M balance sheet) and important entities (starting from 50 employees or €10M).

What NIS 2 Says About Executives

The European text provides the baseline on which the French legislation will be built. It does not yet represent final French law, which may clarify or adapt terms. Three provisions directly impact senior leadership.

1. Article 20, Governance. Management bodies of essential and important entities approve cybersecurity risk-management measures, oversee their implementation, and can be held liable for non-compliance. Members must undergo training to evaluate risks and practices effectively.

2. Article 32, Supervisory measures. For essential entities, when initial enforcement measures prove insufficient, the designated authority can request competent bodies to temporarily suspend any person exercising managerial responsibilities at CEO or legal representative level from their functions within the entity, until deficiencies are resolved.

3. Article 34, Administrative fines. Up to €10 million or 2% of total worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities.

This framework does not make executives automatically liable. It makes cybersecurity a matter they must be able to demonstrate having approved, overseen, and understood. Establishing that proof requires a designated partner capable of reporting directly to the executive committee: the CISO.

Three Faces of the CISO

The title "CISO" encompasses three distinct profiles. The Board must know which one it is seeking.

According to the January 2026 IANS study surveying 662 CISOs, the executive level is now the most prevalent profile, and it is gaining ground within large enterprises (47% in 2025, up from 33% in 2023). CISOs at this level more often report outside the IT organization. Across all respondents, 64% report to the CIO/IT leadership and 36% to business leaders: CEO, COO, General Counsel, or Chief Risk Officer. The source does not specify the geographical breakdown of the sample.

The Reporting Line: Who Can Say No, Who Can Approve

The reporting line signals what the organization expects from the CISO. Reporting to the CIO, the CISO balances security against service delivery alongside a manager who has their own timeline objectives. Reporting to general management, the CISO balances security against business strategy alongside an executive who bears ultimate responsibility before the Board.

No reporting line is universally ideal. The key criterion is access: the CISO must be able to escalate a disagreement to the executive committee and the audit committee without filtering. An entity subject to NIS 2 requires this channel to demonstrate that the management body has fulfilled its oversight obligations.

A Rare and Mobile Talent Market

Two metrics illustrate the current talent search landscape.

According to IANS, nearly 7 out of 10 CISOs state they are open to a job move within the year, and 52% feel their scope is no longer entirely manageable. Sitting leaders are therefore both sought-after and under intense strain. According to ISC2, 88% of respondents state their organization suffered at least one significant consequence tied to a skills deficit, and only one-third report prioritizing cybersecurity as a critical business function.

For a company recruiting a CISO, the takeaway is clear: relevant candidates are almost all currently employed, highly solicited, and unlikely to respond to job postings. Discretion is an essential prerequisite for meaningful discussions. Direct headhunting of sitting executives is the only path to securing top talent, and counter-offers from current employers must be anticipated.

We do not publish compensation benchmarks: no reliable public data covers this market in France at this executive tier.

Software Vendors, MSPs, Cloud, and Data Centers: A Dual Exposure

Technology companies sit in a unique position. The directive explicitly targets providers of cloud computing services, data centers, and managed service providers (MSPs). A software vendor, IT services firm, or host can therefore simultaneously be a regulated entity and a supplier to other regulated entities demanding contractual guarantees.

For the leadership of such groups, security becomes a commercial value proposition and a prerequisite for market entry. The desired CISO profile in this scenario is the executive type: able to address clients, regulators, and the Board with equal credibility. This represents a case where hiring a CISO directly impacts top-line revenue.

PE-Backed Companies and Fundraising Stages

For a company backed by private equity, or preparing for a financing round or sale, cybersecurity becomes a driver of enterprise value. In our experience from dialogues with investors, prospective buyers and new shareholders increasingly inquire into who owns cybersecurity, at what organizational level, and with what resources. An established CISO reporting at the right level and capable of executive reporting is as critical to the deal room as the CFO. Conversely, a vacant or under-resourced security function during a transaction represents a glaring vulnerability. Private equity funds are well advised to address the CISO role early in the value creation plan rather than in the rush of due diligence.

Fintech and the Financial Sector: DORA Is Already Here

In the financial industry, the DORA regulation (EU) 2022/2554 has applied to EU financial entities since January 17, 2025. It mandates digital risk governance, incident management, operational resilience testing, and third-party ICT risk oversight. For a bank, insurer, asset manager, or payment institution, the question is not whether obligations are approaching, but whether leadership can demonstrate compliance. The Governance & Risk CISO is the profile that specifically meets this demand.

What This Demands Across Executive Functions

Two roles warrant deeper examination.

The CFO and Audit Committee. They are the first to encounter budget trade-offs. According to CESIN, 34% of companies are increasing their cybersecurity budget, 51% are keeping it flat, and 15% are cutting it. Maintaining a flat budget against expanding regulatory obligations is a deliberate decision. It must be made knowingly and documented.

The CHRO. An overburdened CISO represents an acute departure risk. According to IANS, 52% consider their scope no longer fully manageable. Right-sizing a scope, expanding a team, and adjusting the reporting line to grant decision-making authority are proactive moves a CHRO can make before a resignation forces an emergency search.

Seven Decisions to Make Before the Law Passes

1. Designate an executive sponsor on the executive committee who answers for cybersecurity to the Board.

2. Map regulatory scope: determine whether you qualify as an essential entity, an important entity, or a supplier to regulated entities.

3. Review ANSSI's ReCyF framework and evaluate the compliance gap against current operations.

4. Schedule executive training, as explicitly mandated for management bodies under Article 20.

5. Establish the CISO reporting line and secure direct access to the executive committee and audit committee.

6. Build succession and retention plans for the CISO and their primary deputies.

7. Determine the appropriate profile if the role is vacant or under-resourced: Operational, Governance & Risk, or Executive.

Common Pitfalls

Waiting for the law to pass before acting. ANSSI cautions against this. Existing frameworks and contractual client demands are already in force.

Confusing compliance with protection. An organization can satisfy checklists without being secure. Executive committees must demand evidence of response capabilities, not merely written policies.

Hiring a CISO without structuring their reporting line. An executive-level CISO placed under leadership that denies direct access to the executive committee will disengage within months.

Searching for an impossible all-rounder. Operational, governance, and executive profiles rarely exist within one individual. The Board must define the primary profile required and build out the supporting team.

Underestimating market mobility. Nearly 7 out of 10 CISOs are receptive to new opportunities. A structured retention plan is far preferable to a crisis search.

Neglecting leadership training. The directive requires it. An executive unable to articulate the rationale behind approved security decisions has failed to meet governance standards.

How to Evaluate a CISO

1. What major incident have they managed end-to-end, and how did they decide when information was incomplete? The answer separates administrative managers from crisis leaders.

1. How have they presented cyber risk to an executive committee or Board? They must communicate in terms of business choices, trade-offs, and financial exposure, not technical vulnerabilities.

1. What strategic disagreement have they had with a business or tech executive, and how was it resolved? A narrative free of conflict is questionable; a demonstrated resolution of conflicting priorities reveals true executive stature.

1. How have they built and retained a security team in a hyper-competitive talent market? The answer reveals whether they understand that their mission depends on human capital.

1. What proportion of their time is dedicated to executive and Board reporting? A Governance or Executive CISO must be able to speak to this with clear metrics.

How a CISO Executive Search Unfolds

1. Frame the profile with executive leadership: Operational, Governance & Risk, or Executive, alongside the reporting structure.

2. Map sitting leaders through direct, highly confidential outreach.

3. Conduct trajectory-based interviews centered on past crisis management and strategic trade-offs.

4. Cross-reference feedback with CEOs, Board Chairs, and audit committee members who have seen the candidate perform under pressure.

5. Design the onboarding roadmap alongside the CIO, CFO, and CHRO.

At Laroze Partners, executive searches for Tech, AI, and Cybersecurity leaders are led by Sam Lozinguez, Partner Tech & AI.

Frequently Asked Questions

Is the NIS 2 Directive applicable in France in 2026?

Not yet. The European transposition deadline was October 17, 2024. The resilience bill passed by the Senate on March 12, 2025, was withdrawn from the National Assembly's agenda on October 6, 2026, with the aim of being rescheduled within two to three weeks. New legal obligations will only apply once the law is officially promulgated.

Are executives personally liable under NIS 2?

The European directive provides that management bodies approve and oversee cybersecurity measures and can be held liable for non-compliance. For essential entities, it also provides for the potential temporary suspension of individuals exercising managerial functions at CEO or legal representative level. The exact formulation in French law will be established in the final statute. Independent legal counsel should be sought for specific assessments.

How many entities are affected by NIS 2 in France?

ANSSI estimates several thousand entities across 18 sectors, from SMEs to CAC 40 groups. Various industry sources cite more specific, differing figures; we adhere to ANSSI's official guidance.

Who should the CISO report to?

It depends on the profile. According to IANS (January 2026), 64% of CISOs report to the CIO and 36% to an executive leader: CEO, COO, General Counsel, or Chief Risk Officer. Executive-level CISOs more frequently report outside IT. The critical factor is providing direct escalation access to the executive committee and audit committee.

What is the difference between an RSSI and a CISO?

There is no functional difference. RSSI is the French term (Responsable de la Sécurité des Systèmes d'Information), while CISO (Chief Information Security Officer) is the international standard. Organizations use them interchangeably. What truly varies is the seniority tier: Operational, Governance & Risk, or Executive.

How should an organization recruit a CISO?

Through three stages: aligning on profile and reporting structure with leadership, executing direct, confidential headhunting among sitting CISOs, and cross-referencing with executives who have observed them make high-stakes decisions. An executive search firm specializing in tech and cybersecurity comes in after scoping to access leaders who do not apply to open listings.

What is the salary of a CISO?

We do not publish fixed salary brackets due to the absence of reliable public data for executive-level positions in France. Compensation varies significantly based on profile archetype, reporting hierarchy, company scale, and sector.

Key Takeaways

• The French transposition of NIS 2 has faced another delay (October 6, 2026), yet corporate leadership is already at the center of the EU framework.

• The CISO role spans three archetypes: Operational, Governance & Risk, and Executive.

• 64% of CISOs report to IT, 36% elsewhere: the reporting line defines what the organization expects of them.

• Nearly 7 in 10 CISOs are open to a job move, and 52% feel their scope is no longer fully manageable (IANS, January 2026).

• Software vendors, MSPs, and cloud/hosting providers face dual exposure: as regulated entities and as key suppliers to regulated entities.

The Perspective from Laroze Partners

We frequently observe the CISO conversation happening too late, triggered only after an incident or regulatory mandate forces the issue. This is fundamentally a governance issue that concludes with a recruitment process. When leadership has selected an archetype, committed to an effective reporting line, and completed executive training, the search brief is straightforward and assessment centers on verifiable track records. Without these governance foundations, no CISO—regardless of pedigree—can succeed in the role.

The Laroze Pattern®, our methodology for assessing career trajectories, leadership behaviors, and performance dynamics, allows us to evaluate how a security executive made decisions when information was incomplete, how they navigated friction with commercial leaders, and how they maintained team stability under crisis. These are the decisive moments in a leader's trajectory.

The companies best positioned to navigate regulatory scrutiny will not be those with the most voluminous binders of policy. They will be those whose boards and executive leadership have decided, well ahead of the law, who owns security accountability before them.

Sources

Directive (EU) 2022/2555 (NIS 2), Articles 20, 32, and 34 · ANSSI, MesServicesCyber (scope, essential and important entities) and ReCyF, March 2026 · Leto Legal, "NIS 2: National Assembly Postpones Review Again," October 6, 2026 · Next, "NIS 2: ANSSI Publishes Its ReCyF," March 19, 2026 · CESIN, 2026 Barometer, January 29, 2026 · ANSSI, 2025 Cyber Threat Overview, March 11, 2026, reported by Le Monde Informatique · IANS Research, 2026 State of the CISO Benchmark Report, January 15, 2026 · ISC2, Cybersecurity Workforce Study 2025, December 4, 2025 · Regulation (EU) 2022/2554 (DORA).