France Calls PAs Into Cybersecurity Review

• AIFE has called all accredited platforms (PAs) to a cybersecurity meeting on 3rd September, just 48 hours after France’s e-invoicing mandate went live
• The meeting will verify the effectiveness of security measures in production and each PA’s ability to prevent, detect and manage incidents
• A post-production cyber monitoring file is being introduced, including governance and documents PAs need to provide
• Bilateral cybersecurity reviews will take place with each PA
• A security roadmap will lead through to the compliance audit

France is moving rapidly into post-go-live cybersecurity scrutiny of its new e-invoicing ecosystem.

The meeting follows discussions on 26th August between Public Accounts Minister David Amiel, DGFiP, AIFE and the PAs, and explicitly continues the direction set out by the Minister.

According to the invitation, its purpose is to “collectively verify the effectiveness of the security measures in production” and each party’s ability to prevent, detect and handle incidents.

This goes beyond a general cybersecurity briefing.

Alongside ecosystem-wide monitoring, AIFE plans bilateral cyber reviews with each PA, while the post-production monitoring file will establish governance and documentation requirements. AIFE has also warned that actions will need to be taken immediately following the meeting.

The French government has separately confirmed that PAs must provide a cybersecurity status report by the end of September, immediately report cyber incidents and undergo penetration testing from this autumn.

Platforms unable to demonstrate the required level of security could ultimately have their operations suspended.

The programme suggests France is moving from cybersecurity requirements for accreditation towards active, ongoing security assurance of the PA ecosystem in live production.

And that scrutiny is starting almost immediately after go-live.