How is the governance of the France Cybersecurity Label organized ?
The France Cybersecurity Label is spearheaded by two structures :
- A governance structure that defines the general governance of the Label and especially the evolution of award criteria. This structure also oversees the Label’s communication, external relations and administration.
- An award structure also known as the “Award Committee”, which is informed by third-party advisers. This structure decides whether or not to award the Label to applicants.
The governance of the France Cybersecurity label is overseen by a committee composed of each involved party’s representatives, all gathered in 3 colleges and assigned as follows:
- College of officials: composed of representatives from the Direction générale de l’armement (DGA, the French Government Defense procurement and technology agency), the Direction générale des entreprises (DGE, the French Directorate General for Enterprise within the Ministry of Economy, Industry and Digital), and the Agence nationale de la sécurité des systèmes d’information (ANSSI, the French National Cybersecurity Agency).
- College of industrials: composed of representatives from the “Alliance pour la Confiance Numérique” (ACN) and HEXATRUST.
- College of users : composed of representatives from user college, such as: CIGREF, GITSIS, CESIN, CLUSIF espace RSSI.
The College of officials consists of one representative for each structure that initially enters its composition (ANSSI, DGA et DGE), therefore three (3) individuals in total.
The college of users consists of one representative for each participating organization (CIGREF, GITSIS, CESIN, CLUSIF espace RSSI), therefore four (4) persons in total.
The college of industrial corporations consists of two (2) representatives from ACN and two (2) representatives from HEXATRUST.
The Award Committee
The Award Committee is composed of two (2) representatives of the « College of officials », two (2) representatives of the « College of users » and two (2) representatives of the « College of industrial corporations ».
However, each college can only vote with a single voice. For each decision, the award committee adjudicates through a voting process, which requires two votes out of three – two colleges out of three – in order for each decision to be endorsed.