--- id: CP-371 slug: french-military-programming-law-vital-operators lang: en title: The French LPM and vital operators description: What a vital operator is, what the 2013 military programming law (LPM) requires of it, and what NIS 2 changes. canonical_url: https://startbrain.io/cyberpedia/en/articles/french-military-programming-law-vital-operators/ markdown_url: https://startbrain.io/cyberpedia/en/articles/french-military-programming-law-vital-operators.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "The French LPM and vital operators", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/french-military-programming-law-vital-operators/ (CC BY 4.0) wing: 6 theme: safeguard_data reflex: cr-036 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/french-military-programming-law-vital-operators/ fr: https://startbrain.io/cyberpedia/fr/articles/lpm-oiv-operateurs-importance-vitale/ de: https://startbrain.io/cyberpedia/de/articles/lpm-oiv-betreiber-lebenswichtiger-einrichtungen/ es: https://startbrain.io/cyberpedia/es/articles/lpm-oiv-operadores-importancia-vital/ sources: - "n": 1 title: "Direction de l'action du Gouvernement : coordination du travail gouvernemental (avis n° 149, tome IX)" publisher: Senate (France) url: https://www.senat.fr/rap/a18-149-9/a18-149-91.pdf published: "2018-11-22" accessed: "2026-11-03" - "n": 2 title: Programmation militaire 2014-2019 publisher: Senate (France) url: https://www.senat.fr/leg/pjl12-822.html accessed: "2026-11-03" - "n": 3 title: "Projet de loi de finances pour 2015 : Direction de l'action du Gouvernement : coordination du travail gouvernemental - Sénat" publisher: Senate (France) url: https://www.senat.fr/rap/a14-110-9/a14-110-91.html published: "2014-11-20" accessed: "2026-11-03" - "n": 4 title: Programmation militaire 2014-2019 - Sénat publisher: Senate (France) url: https://www.senat.fr/dossier-legislatif/pjl12-822.html accessed: "2026-11-03" - "n": 5 title: "NIS2 Directive: securing network and information systems" publisher: European Commission url: https://digital-strategy.ec.europa.eu/en/policies/nis2-directive accessed: "2026-11-03" --- # The French LPM and vital operators Some organisations provide services the country cannot do without. French law calls them vital operators (opérateurs d'importance vitale, or OIV). Since the military programming law (loi de programmation militaire, LPM) of 2013, the Senate report of 2014 describes a law that strengthens the obligations of these operators, including the duty to notify significant IT incidents [3]. An employee of an OIV, or of a contractor working for one, is not named in these texts. The obligations fall on the operator. One can infer that they affect the work of its teams, but the texts cited here do not say so. ## In 30 seconds - Where it happens: in public and private operators judged to be of vital importance to the Nation. In 2018, a Senate report counts more than 200 of them, spread across 12 sectors of activity [1]. - What the law wants: that these operators apply security rules, detect attacks, report incidents and accept inspections [2][3]. - The reflex: if you work in such an operator, report any IT incident to your security team, because the operator itself has a duty to notify the State of significant IT incidents [3]. - If it has already happened: follow your organisation's internal procedure. The sources cited here describe no step for an employee. ## Straight answers ### What is a vital operator? The text of the bill speaks of public and private operators identified as "of vital importance to the war or economic potential, the security or the survival capacity of the Nation" (« d'importance vitale pour le potentiel de guerre ou économique, la sécurité ou la capacité de survie de la Nation ») [2]. The Senate report of 2018 counts more than 200 of them, in 12 sectors of activity [1]. ### What is an SIIV? The 2013 bill sets security rules for information systems whose security or operation, if compromised, would risk significantly reducing the war or economic potential, the security or the survival capacity of the Nation [2]. "SIIV" is the usual acronym for these systems; it does not come from the sources cited here. According to the 2018 report, ANSSI published the last sectoral orders in 2017, and 1,000 of these systems had been declared to the agency that year [1]. ### Who is ANSSI? The Agence nationale de la sécurité des systèmes d'information (the French national cybersecurity agency) is the national authority for the security and defence of information systems [1]. Before the LPM, its role was essentially one of advice and alerting. Since then, according to the 2014 report, it has extended powers to act [3]. ### Does an employee risk a penalty? The texts cited here provide penalties against the operator, not against the employee. The 2013 bill punished failure to comply with security obligations with a fine of 150,000 euros, after prior formal notice, except for failure to report an incident. Legal entities were also subject to the fine regime of article 131-38 of the penal code [2]. The sources cited here do not allow us to check whether the enacted text keeps these amounts. ## What it changes for employees The texts say nothing about employees. They set obligations for the operator, and it is the operator that passes them on internally. Three points of the 2013 bill touch daily work. The operator applied, at its own expense, the security rules set by the State [2]. A tool or procedure imposed by security can therefore come from this obligation. The rules could also prescribe qualified detection systems, run by qualified providers, by ANSSI or by other State services [2]. Finally, the bill provided that the operator inform the Prime Minister "without delay" of incidents affecting its systems [2]. The text does not say so, but such an obligation assumes that an incident quickly reaches those in charge of it. The 2014 report, for its part, speaks of the obligation to notify significant IT incidents [3]. ## What it changes for management The 2013 bill made the operator bear the cost of the security rules and of the inspections the Prime Minister may request [2]. These inspections are carried out by ANSSI, by State services or by qualified providers [2]. The 2014 report summarises the change: the law provides in particular for the obligation to notify significant IT incidents or to carry out regular audits [3]. In 2017, ANSSI carried out 63 audits of ministries and OIV, and OIV account for nearly half of the agency's audit activity [1]. ## What the text says Law no. 2013-1168 of 18 December 2013 was promulgated and published in the Journal officiel of 19 December 2013 [4]. The chapter on cyber threats draws on the White Paper of April 2013, which provided that the State would set security standards and that operators would notify incidents [3]. In the law, article 21 gives the Prime Minister competence over the defence of information systems, and article 22 strengthens the obligations of OIV [3]. The bill tabled on 2 August 2013 detailed these obligations in the defence code [2]: - security rules set by the Prime Minister, applied by the operator at its own expense; - qualified detection systems, whose qualifications are issued by the Prime Minister; - information to the Prime Minister without delay in the event of an incident; - inspection of the systems at his request, at the operator's expense; - measures imposed by the Prime Minister in the event of a major crisis. The bill also provided that the State preserve the confidentiality of information gathered from operators [2]. A decree of the Conseil d'État was to specify the conditions of application [2]. These elements come from the bill as tabled. The article numbers of the final law differ from those of the bill [2][3]. ## Where implementation stands In 2014, entry into force still depended on implementing texts. A decree of the Conseil d'État was to specify the obligations of OIV, and sectoral orders, public or classified, were to follow, mostly during 2015 [3]. Working groups had been launched in mid-October 2014 for energy and electronic communications [3]. The 2018 report shows what followed: implementation continued after 2014, the last sectoral orders date from 2017, and 1,000 vital systems had been declared that year [1]. The sources cited here give no more recent status of the application of the LPM to OIV. ### The move to NIS 2 The NIS directive, adopted on 6 July 2016, was transposed in France by the law of 26 February 2018. The introduction of the notion of operators of essential services will make it possible to cover entities beyond OIV [1]. The NIS 2 directive (directive 2022/2555) entered into force in January 2023. Member States had until 17 October 2024 to transpose it, and the first NIS directive has been repealed since 18 October 2024 [5]. It covers 18 critical sectors and adds sectors such as digital services, waste management, postal services and public administration [5]. As a general rule, medium and large entities in these sectors must take risk management measures and notify significant incidents to national authorities [5]. The directive also establishes management accountability for failure to comply with these measures [5]. On 20 January 2026, the Commission proposed targeted amendments to NIS 2 to clarify the law and simplify compliance [5]. The sources cited here do not specify the state of NIS 2 transposition into French law or its effect on OIV status. ## Sources 1. Senate (France), "Direction de l'action du Gouvernement : coordination du travail gouvernemental (avis n° 149, tome IX)", 22 November 2018. https://www.senat.fr/rap/a18-149-9/a18-149-91.pdf (accessed 3 November 2026) 2. Senate (France), "Programmation militaire 2014-2019". https://www.senat.fr/leg/pjl12-822.html (accessed 3 November 2026) 3. Senate (France), "Projet de loi de finances pour 2015 : Direction de l'action du Gouvernement : coordination du travail gouvernemental - Sénat", 20 November 2014. https://www.senat.fr/rap/a14-110-9/a14-110-91.html (accessed 3 November 2026) 4. Senate (France), "Programmation militaire 2014-2019 - Sénat". https://www.senat.fr/dossier-legislatif/pjl12-822.html (accessed 3 November 2026) 5. European Commission, "NIS2 Directive: securing network and information systems". https://digital-strategy.ec.europa.eu/en/policies/nis2-directive (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/french-military-programming-law-vital-operators/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.