The Challenge of Complying with the NIS 2 Directive for Local Governments

At a time when the number of cyberattacks has skyrocketed, with a 22% increase in Europe in 2025[1], such regulations represent a first step toward building a digital fortress on the Old Continent. This is all the more true given that, through this revised version of the directive, Brussels aims not only to standardize the level of cybersecurity maturity across member states but also to extend its application to the broadest possible scope.

Unlike its predecessor, the NIS 1 Directive—which focused on Operators of Essential Services (OES) and Digital Service Providers (DSPs)—the NIS 2 Directive now distinguishes between two new categories: essential entities (EE) and significant entities (SE). This redefinition of categories means that new organizations—including central and local government agencies—are now included.

In France, involving local governments presents a real opportunity, as they have been regularly targeted by cyberattacks for many years[2]. However, it also presents challenges—political, economic, and social alike. Indeed, local public administrations form the very fabric of the French territory and are therefore ideal targets for cyberattackers. However, they do not have the same financial resources or protection as certain central government agencies, and the budget they can allocate to cybersecurity and the resilience of their systems varies from one local government to another depending not only on its revenue but also on the priorities of its elected officials. Furthermore, their largely autonomous management of their systems and the services they subscribe to significantly increases the attack surface and complicates their protection. So to what extent does compliance with NIS 2 represent both an opportunity and a challenge for local governments?

(Geo)political Issues

Directly linked to the implementation of the NIS 2 Directive, political and geopolitical challenges remain the main issues in this compliance effort. As stated earlier, France’s decentralized system means that local governments now form the very fabric of the country. Well-executed and coordinated cyberattacks could therefore easily paralyze the region and disrupt services that are essential to the country’s proper functioning. In October 2025, the Hauts-de-France Region[3] was hit by ransomware from the Qilin Group, which operates within the Russian sphere of influence. Among other things, this cyberattack affected 80% of the region’s public high schools—a total of 60,000 computers[4]. In addition, more than one terabyte of data is believed to have been exfiltrated[5].

Similarly, in August 2025, the city of Poitiers fell victim to a cyberattack, which resulted in the city’s urban planning and media library services being shut down for several weeks[6]. To date, no group has been officially identified or has claimed responsibility for the attack[7]. Based on these two isolated examples—which have already had significant local impacts—it is easy to imagine the consequences of a simultaneous attack targeting many more organizations of this kind, not only for the continuity of public services but also for the confidentiality of the data hosted by these same organizations…

While cyberattacks targeting these organizations have so far had limited impact, there is no guarantee that future attacks could not have more devastating consequences. Today, France is increasingly targeted by states and criminal organizations that leverage—at times—colossal financial resources to achieve their goals. In addition to states opposed to the French democratic model, such as Russia and North Korea, cyberterrorist organizations and criminal gangs share a common interest in attacking the information systems (IS) of French local organizations. It is in this context that local governments, as noted above, represent an easy way to inflict harm on the state. Whether it involves deploying lucrative ransomware, stealing sensitive data, or simply disrupting the operation of public services, there are numerous motivations for attacking these organizations.

Under these circumstances, it is therefore essential that a country like France be sufficiently protected to be prepared to face all the cyberthreats to which it is exposed. As the world’s seventh-largest power and through its hard power, France also serves as a role model in the field of cybersecurity. The NIS 2 Directive is therefore an essential step in confirming France’s ability to adapt to today’s new technological and geopolitical challenges.

The specific scope of local governments involved

According to the General Code of Local Authorities (CGCT) and the 1958 Constitution, a local authority is a public-law entity, distinct from the State, that enjoys legal and financial autonomy to manage the affairs of a specific territory. It has its own powers, budget, and staff. The three main levels of local government are the municipality, the department, and the region.

Within this highly regulated administrative framework, the first challenge for ANSSI was to classify these various local authorities into the two essential categories under NIS 2: Critical and Important Entities.[8]

A Critical Entity (EE) is an organization that employs at least 250 people, or that has annual revenue exceeding 50 million euros and annual assets exceeding 43 million euros. ANSSI has decided to include in this category regions, departments, municipalities with more than 30,000 residents, and public intermunicipal cooperation entities (EPCI) that include a city with more than 30,000 residents.

On the other hand, there are Significant Entities (EI). If an organization is not a critical entity, employs at least 50 people, or has annual revenue and total assets exceeding six million euros, it falls into this category. In particular, ANSSI has classified other EPCIs with fewer than 30,000 residents into this category.

This initial classification allows for the establishment of objectives tailored to the size of different local governments. However, it creates inequality in the protection of these organizations’ information systems. Indeed, this could encourage cyberattackers to target larger entities that are less well-protected and have a more limited cybersecurity budget.

The Challenge of Raising Cybersecurity Awareness in Local Governments

This is probably the most significant challenge in this type of organization: successfully establishing a genuine cybersecurity culture. While larger organizations have now managed to implement regular awareness campaigns that are generally well-received by their employees, smaller entities remain the weak link when it comes to cybersecurity.

According to the economic report “Data, AI, and Cybersecurity in the Regions”[9]published by the Banque des Territoires in 2025, 50% of municipalities with fewer than 300 residents consider themselves “not a target,” even though they represent a real opportunity for attackers. This complacency regarding digital risk is further exacerbated by the very high turnover of elected officials in these organizations, who prioritize other projects deemed more important for the public good. It is also exacerbated by the general public’s own lack of concern, as people have other priorities: cybersecurity is generally not one of the key issues in campaign platforms. Elected officials focus their budgets and efforts on issues that have a greater impact on their constituents.

Paradoxically, according to the study cited above, 49% of municipalities with fewer than 3,500 residents now view cyber threats as a governance issue rather than merely a technical problem.

It is this contradiction, in particular, that explains the current disparity in the implementation of cybersecurity best practices among different local governments. Therefore, in this scenario, NIS 2 provides the means to require these local governments to follow a set of rules that will help standardize cybersecurity best practices.

We can also hope that, for the largest local governments with greater resources, the recent cyberattacks this summer on numerous public agencies—which resulted in the leak of massive amounts of sensitive citizen data (the National Education System, the DGFIP, the “Zero Vacant Housing” public platform, France Travail, Santé publique France, the Nice Côte d’Azur Chamber of Commerce and Industry…), have also raised awareness among government agencies and citizens, motivating elected officials to place greater priority on cybersecurity.

Funding Issues

This is likely one of the biggest challenges regarding NIS 2 compliance. Local governments, particularly smaller ones, often have limited budgets for cybersecurity. However, even for entities classified as critical, the costs of compliance—including the deployment of security solutions or enhanced infrastructure security measures—can amount to very large sums for smaller organizations.

That is why the government has decided to implement a three-pronged strategy to fund local governments’ compliance with NIS 2:

• Enhanced support from ANSSI: ANSSI has developed two tools to help affected organizations achieve compliance with NIS 2. These are MonEspaceNIS2[10]for self-assessment and registration, and the MonServiceSécurisé[11]to assist with drafting security policies.
• Specific programs to enhance the security of information systems: funding has been allocated, notably through cybersecurity training tracks, as well as through specific calls for proposals managed by regional CSIRTs.
• Pooling of resources: Among other measures, the government encourages the pooling of resources within EPCIs to share the costs associated with achieving compliance, as well as the use of central purchasing agencies such as the Union of Public Purchasing Groups (UGAP) to obtain preferential rates on security solutions.

By implementing these three different measures, the government aims to make it as easy as possible for local governments—particularly the smallest ones—to secure funding for NIS 2 compliance. This effort by the government also symbolizes its commitment to accelerating the cybersecurity efforts of its organizations and to better protecting itself against the various threats currently facing France. At the same time, the government is establishing a clearer roadmap for local governments based on the type of entity to which they belong.

Significant challenges, but a unique opportunity

That is why, like other entities subject to the NIS 2 Directive, local governments have a duty to comply with these regulations. This will undoubtedly strengthen the resilience of all information systems within the government’s administrative system and protect society as a whole from the digital threats that are on the rise today.

Compliance with NIS 2 for local governments, while a difficult challenge to overcome, thus represents a unique opportunity for the government to strengthen cybersecurity across its ecosystem and protect itself against the threats currently facing France and Europe. Despite challenges related to awareness, funding difficulties, and major geopolitical issues, NIS 2 is intended to serve as a catalyst for cybersecurity within the European Union, enabling essential and important entities in member states to adopt uniform cybersecurity standards. It is these standards that will enable us, in the future, to counter parastatal groups, cybercriminals, and digital terrorism.