CERT France

CERT France
Name	CERT France
Native name	Centre gouvernemental de veille, d'alerte et de réponse aux attaques informatiques
Formation	2009
Type	Computer emergency response team
Headquarters	Paris, Île-de-France
Parent organization	Agence nationale de la sécurité des systèmes d'information
Website	(official site)

CERT France is the national computer emergency response team responsible for coordination of incident response, analysis of cybersecurity threats, and dissemination of alerts within the French public sector and critical infrastructure communities. It operates under the authority of the Agence nationale de la sécurité des systèmes d'information and interfaces with European, NATO, and United Nations cybersecurity bodies to manage cross-border incidents. The unit provides technical guidance, situational awareness, and operational support to ministries, operators, and partner organizations.

Overview

CERT France provides reactive incident handling, proactive alerting, and strategic threat intelligence for public administrations and critical operators such as energy, transport, healthcare, and finance. It publishes advisories, indicators of compromise, and mitigation measures while coordinating notification and response across entities like the Ministère de l'Intérieur, Ministère des Armées, and Autorité des Marchés Financiers. The team contributes to national contingency planning, supports crisis cells during major incidents, and liaises with sector-specific authorities including RATP, SNCF, and Assistance Publique–Hôpitaux de Paris.

History and Development

Established in 2009 within the Agence nationale de la sécurité des systèmes d'information framework, the organization succeeded earlier computer emergency arrangements influenced by European Union cybersecurity initiatives and OECD recommendations. Its evolution tracks major events such as the Stuxnet revelations, the WannaCry outbreak, and the NotPetya disruption, prompting expansion of rapid-response capabilities and public-private collaboration with companies like Orange, Capgemini, and Atos. Legislative milestones impacting its remit include reforms linked to the Loi de Programmation Militaire and European directives such as the NIS Directive, which shaped national incident reporting and resilience requirements. Over time, it broadened technical services, threat research, and cooperative ties with academia including École Polytechnique and Télécom Paris.

Organization and Governance

As an operational service of the national cybersecurity agency, the team is governed by administrative leadership appointed within the agency's executive structure and coordinated with the Prime Minister's services for national crisis management. Its internal organization includes incident response teams, malware analysis labs, CERT analysts, and a communications cell that works with the Secrétariat Général de la Défense et de la Sécurité Nationale during crises. Governance interfaces involve oversight by the Conseil d'État for regulatory compliance, interactions with the Cour des comptes for budgetary review, and alignment with European Union Agency for Cybersecurity guidelines. Staffed by specialists recruited from institutions such as INRIA, CNRS, and private-sector CERTs, the organization uses operational playbooks and service-level agreements to define missions.

Roles and Services

Operational roles cover alert diffusion, forensic assistance, vulnerability coordination, and support to incident-handling within ministries and critical operators. Services include CERT advisories, vulnerability coordination akin to vulnerability disclosure platforms used by MITRE, malware sample exchange, and technical assistance in incident triage and containment. It offers capacity-building through workshops and exercises with partners like NATO Cooperative Cyber Defence Centre of Excellence and CNIL, contributes to national exercises such as cyber defense wargames, and maintains watch functions for botnets, phishing campaigns, and supply-chain compromises affecting entities like Airbus, BNP Paribas, and TotalEnergies. The team also publishes technical notes that reference standards from ISO, ETSI, and NIST when applicable.

Notable Incidents and Responses

The unit coordinated national responses during high-profile incidents including large-scale ransomware events (WannaCry era echoes), supply-chain attacks reminiscent of SolarWinds, and targeted intrusions against ministries and critical infrastructure. It has issued alerts during campaigns attributed to state-linked groups implicated in operations targeting NATO members and EU institutions, and supported recovery for entities impacted by distributed denial-of-service attacks and data breaches involving healthcare and transportation providers. Collaborative investigations have involved law enforcement partners such as the Parquet National Financier and judicial police cyber units, and have contributed to sanctions and attribution statements coordinated with the Ministry for Europe and Foreign Affairs.

Partnerships and International Collaboration

Internationally, the organization maintains operational links with EU Agency for Cybersecurity, NATO cyber defense structures, CERT-EU, and national CSIRTs including those of Germany, Spain, the United Kingdom, and the United States. It engages with multilateral frameworks like the Council of Europe on cybercrime matters and works with Interpol and Europol on cross-border criminal investigations. Bilateral industry partnerships exist with cybersecurity firms including Thales, Kaspersky (in research contexts), and CrowdStrike for intelligence sharing. Academic collaborations include research projects with Université Paris-Saclay and Sorbonne University, while participation in standardization bodies aligns efforts with ISO/IEC working groups and ETSI Cyber.

Category:Computer emergency response teams Category:Cybersecurity in France Category:Agence nationale de la sécurité des systèmes d'information