CSPN and ANSSI Visa: French security certification

Hugues Orgitello updated 7 Oct 2026 15 min read

The CSPN (Certification de Sécurité de Premier Niveau, first-level security certification) is the French fixed-time product evaluation run by ANSSI, the national cybersecurity agency, since an experimental phase opened on 25 April 2008. Its rules are not folklore: they sit in a handful of short ANSSI procedures, and the central one, ANSSI-CSPN-CER-P-01, reached version 7.0 on 12 May 2026. This guide reads those procedures directly: the 25 man-day workload and its bounds, the three-year validity, the functions that can and cannot be evaluated, the ten licensed evaluation centres, the German BSZ recognition, the link with ANSSI qualification, and what the European EUCC scheme, the Cyber Resilience Act and the RED article 3(3) change, or do not change, for a CSPN.

ANSSI and the French certification scheme

ANSSI was created by decree n° 2009-834 of 7 July 2009 and reports to the SGDSN, the general secretariat for defence and national security. Product certification rests on an older text, decree n° 2002-535 of 18 April 2002 on the evaluation and certification of the security offered by IT products and systems, which defines the French evaluation and certification scheme. Within ANSSI, the Centre de certification national (CCN) runs both CSPN and Common Criteria certification.

ANSSI does not test products itself. Evaluations are done by licensed laboratories, the CESTI (Centres d'Évaluation de la Sécurité des Technologies de l'Information), and ANSSI validates their technical evaluation report, writes the certification report and issues the certificate. Per the ANSSI FAQ, the services of the certification centre are a public service and free of charge; the cost of a project is the CESTI contract, which ANSSI says varies from one project to another.

The Visa de sécurité is a mark, not a scheme

ANSSI describes the Visa de sécurité as the mark delivered to solutions that have obtained an ANSSI certification or qualification. It sits on top of two processes that answer different questions:

Process	What it attests	Typical basis
Certification (CSPN or Common Criteria)	Robustness of one specific product version against attacks, at a point in time	Evaluation by a CESTI, certificate by the CCN
Qualification	Fitness of a product or service for the needs of administrations and regulated operators, and trust in the supplier over time	Usually a certification, plus commitments made to ANSSI

ANSSI states that qualification is what answers the regulatory requirements of the Loi de Programmation Militaire (LPM), the Référentiel général de sécurité (RGS) and eIDAS. Certification alone does not presume anything about non-evaluated aspects or about the company. The ANSSI FAQ adds that the Visa covers certification, qualification, and the licensing of evaluation centres, while labels such as the EBIOS label and SecNumEdu are separate.

CSPN in figures, from the procedures

The table below collects the numeric rules of the scheme. Each line points to the procedure that sets it.

Parameter	Value	Where it is set
Reference workload	25 man-days over 8 calendar weeks	CER-P-01 v7.0, section 9.3
Cryptography supplement	+10 man-days when essential security functions rely on cryptography	CER-P-01, section 9.3
Workload bounds	Not below 15 nor above 60 man-days, except some re-evaluations	CER-P-01, section 9.3 (60 man-day cap since v5.0, 12 January 2023)
Grounds to adjust the workload	Heavy installation, many security functions, proprietary protocols, re-evaluation, source-code access	CER-P-01, footnote to section 9.3
Certificate validity	Three years, then archived	CER-P-01, section 11
Surveillance	None (removed by v3.0, 12 April 2021)	CER-P-01, change log
Maintenance request	Only within 24 months of certification	CER-P-01 section 13 and MAI-P-01 v1.1
Re-evaluation after a FAIL	File within four months of the closure letter, work starting within two months, at most half the initial workload	CER-P-01, section 10.3 (added in v7.0)
Corrective action after a non-conformity	Thirty calendar days before suspension or withdrawal	CER-P-01, section 13.1
Reduction of scope of a certificate	Not possible in CSPN	CER-P-01, section 13
CESTI licence	Two years, renewal requested at least four months before expiry	AGR-P-01 v2.0, sections 3.6 and 3.9
ANSSI certification fee	None (public service)	ANSSI FAQ

The workload has a history: the experimental phase used 20 man-days for the basic evaluation, raised to 25 man-days when version 1.0 ended the experiment on 30 May 2011.

How an evaluation runs

CER-P-01 describes the actors (sponsor, evaluation centre, ANSSI certification centre, optionally the developer and observers) and a fixed sequence:

Step	Who	Output
Prerequisites	Sponsor	Security target compliant with ANSSI-CSPN-NOTE-09, crypto documentation per CRY-P-01, eligible product, access to product and user documentation
Contract with a CESTI	Sponsor	CESTI licensed for the technical scope of the product
Application	Sponsor	Application file (form CER-F-01), security target, crypto documentation
Analysis of the application	ANSSI	Registration letter, or refusal (incomplete file, CESTI not licensed for the scope, product not eligible)
Evaluation in "tunnel mode"	CESTI	Technical evaluation report (RTE)
Validation and presentation	ANSSI, CESTI	Validated RTE, presentation of results to ANSSI
Decision	ANSSI	Certificate and certification report, electronically signed by the ANSSI director general on delegation from the Prime Minister

Tunnel mode means the sponsor does not interact with the evaluators during the work unless they ask, results are not passed to the sponsor before ANSSI validates them, and neither the product nor the deliverables may change during the evaluation. Version 7.0 eased two points: a new product version can be supplied before evaluation work starts, provided the security objectives and the schedule do not change; and the CESTI may notify the sponsor (and ANSSI at the same time) of a critical vulnerability found during the evaluation, without stopping it or allowing a patched version.

CER-P-02 v5.0, applicable since 1 September 2024, organises the evaluator tasks in five phases: analysis of the security target and cryptographic specifications, installation, documentation and development process analysis, conformity analysis, and resistance analysis (penetration testing, including vulnerabilities the product induces on its host system). It replaced the RGS_B cryptographic reference by ANSSI-PG-083 and added an annex justifying conformity with EN 17640:2022, the European fixed-time cybersecurity evaluation methodology for ICT products.

Which products and functions are eligible

This is where most marketing material is wrong. Annex B of CER-P-01 says ANSSI refuses certification where it has no state of the art, and that only these functions can be security functions in a CSPN target:

• secure communication;
• identification, authentication and access control of users;
• data protection, in storage or in transit, including secure erasure;
• self-protection: secure boot, self-tests, physical protection, partitioning;
• logging.

Analysis and detection functions (application firewall, file filtering, intrusion detection, vulnerability scanning, EDR, network probe, anti-virus) cannot be evaluated; they are only considered as attack surface. A footnote adds that biometric authentication and enrolment systems (such as KYC) cannot be evaluated either. Annex B also refuses, among others: products with too many security functions or components for the workload (the fix is a sequence of evaluations), products whose configuration is controlled only by the developer, SDKs, middleware and libraries, products below the consumer state of the art or not following the mandatory ANSSI guides (multi-factor authentication and passwords, TLS, GNU/Linux configuration), products built on unmaintained third-party components, proprietary cryptography, and targets that misrepresent real use. The ANSSI FAQ confirms that a software library is not eligible to CSPN, and that a complete multi-level workstation can only go through Common Criteria.

One more prerequisite: no Common Criteria certification under CCRA, SOG-IS or EUCC may be under way or completed on a similar version of the product, unless the sponsor justifies a specific need that ANSSI accepts.

The ten licensed CSPN evaluation centres

ANSSI lists the CSPN evaluation centres on its site, and its FAQ counts ten of them. On 7 October 2026 the list names ACCEIS, ALMOND (AMOSSYS), CEA-LETI, EDSI, LEXFO, OPPIDA, QUARKSLAB, SERMA SAFETY & SECURITY, SYNACKTIV and THALES/CNES.

Each centre is licensed for given scopes, and the list also flags scopes still being acquired, so check the current page before choosing. Since AGR-P-01 version 2.0 (24 February 2026), scopes are defined by technology rather than product type: three main scopes (Software, Hardware, Cryptography) and additional scopes (mobile platforms, industrial control systems, Web, integrated circuits, post-quantum cryptography). A licence is decided by the Prime Minister after a preliminary audit and a pilot evaluation, and lasts two years. A CESTI already licensed for Common Criteria can ask for CSPN licensing for the same product types without pilot evaluation. For Common Criteria, the CESTI must in addition be accredited by COFRAC against ISO/IEC 17025; AGR-P-01 sets no such accreditation requirement for CSPN.

Recognition: Germany yes, the rest of the world no

A mutual recognition agreement between ANSSI and the German BSI covers CSPN and the German BSZ scheme (accelerated security certification). It was first signed in 2022; version 3 was signed on 15 May 2024 and builds on EN 17640 (FiTCEM). Certificates issued from 1 August 2024 carry a joint logo; earlier certificates are still recognised but carry no logo. Note 001 of the agreement lists product types excluded from recognition. ANSSI notes that no similar agreement exists with any other partner.

Common Criteria certificates follow different rules, set out on the ANSSI recognition page:

• CCRA (since the arrangement of 8 September 2014): recognition up to EAL2 plus ALC_FLR for generic evaluations, and up to the level stated in a collaborative protection profile (cPP) for cPP-conformant evaluations.
• SOG-IS MRA (version of January 2010): up to EAL7 in the two technical domains "smart cards and similar devices" and "hardware devices with security boxes", up to EAL4 otherwise.
• EUCC: recognised across the EU, see below.

EUCC and what it did to national schemes

Implementing Regulation (EU) 2024/482 sets the European Common Criteria-based scheme (EUCC) under the Cybersecurity Act (EU) 2019/881. It entered into force on 27 February 2024 and applies from 27 February 2025. Article 49 provides that national schemes covering the ICT products covered by EUCC cease to produce effects 12 months after entry into force, with a derogation for certification processes started within those 12 months and finalised within 24 months.

At ANSSI, this translated into the following dates for Common Criteria under SOG-IS:

Date	Event (ANSSI recognition page and news)
27 February 2024	EUCC in force; EUCC registrations possible
27 February 2025	EUCC applies; no new SOG-IS evaluation can be registered
31 March 2025	ANSSI issues its first two EUCC certificates, after COFRAC accreditation of the CCN on 28 March 2025
27 August 2025	Last date for the CCN to receive a SOG-IS evaluation report
27 February 2026	Last date to issue a SOG-IS certificate
27 February 2031	Last possible SOG-IS maintenance horizon (last certificate plus five years)

Certification for public security, defence and national security is outside EUCC and stays national, without the EUCC mark.

EUCC has two assurance levels mapped on the Common Criteria vulnerability analysis family, not on EAL (Article 4): substantial covers AVA_VAN 1 or 2, high covers AVA_VAN 3, 4 or 5. EUCC certificates last at most five years unless the national authority approves a longer period (Article 12), and EUCC carries monitoring duties for the certification body and the certificate holder. ANSSI issues at the "high" level and was authorised for three domains: smart cards and similar devices, hardware devices with security boxes, and generic network or software products.

CSPN is not a Common Criteria scheme, and the ANSSI FAQ answers the question directly: EUCC will not replace CSPN. ANSSI describes CSPN as focused on penetration testing while EUCC includes conformity activities. The FAQ also gives AVA_VAN 3 as the reference point for the level a CSPN targets.

	CSPN	EUCC
Legal basis	Decree 2002-535, ANSSI procedures	Regulation (EU) 2024/482 under (EU) 2019/881
Method	ANSSI criteria CER-P-02, aligned with EN 17640	ISO/IEC 15408 and ISO/IEC 18045
Level	One fixed-time level	Substantial (AVA_VAN 1-2) or high (AVA_VAN 3-5)
Validity	Three years	At most five years, unless approved otherwise
Recognition	France, and Germany through BSZ	All Member States, CCRA where the country is a member
CRA presumption of conformity	No	Possible under CRA Article 27(8) and (9)

Qualification: levels and what sits behind them

The ANSSI product qualification process (QUAL-PROD-PROCESS, version 1.0 of January 2017, applied under decree n° 2015-350 of 27 March 2015 and decree n° 2010-112 of 2 February 2010 for the RGS) defines a qualification scope as a level plus the regulatory framework it refers to. The three levels are defined by threat, and the process gives the evaluation used as an indication when it is done through certification:

Qualification level	Threat the product resists	Indicative evaluation
Élémentaire	Basic	CSPN
Standard	Advanced	Common Criteria EAL3 + ALC_FLR.3 + AVA_VAN.3
Renforcé	High	Common Criteria EAL4 + ADV_IMP.2 + ALC_DVS.2 + ALC_FLR.3 + AVA_VAN.5

A product qualification is set by ANSSI for at most three years, with conditions and restrictions of use that buyers must respect to be compliant. ANSSI also assigns a recommendation level shown as green, orange or red; by default, red means the qualification expires within two months and orange within six months. Protection of Diffusion Restreinte or classified information is a different instrument, product approval (agrément), which ANSSI describes as a discretionary decision.

Link with the LPM and OIV

Article 22 of the 2013 Loi de Programmation Militaire added cybersecurity obligations for Operators of Vital Importance (OIV) on their vital information systems (SIIV), now in articles L. 1332-6-1 and following of the Code de la défense. ANSSI defines 20 security rules, set out in sectoral orders applicable from 2016 and 2017, covering governance, risk control, control of information systems, incident management and protection. ANSSI lists decree n° 2015-350 on qualification among the references of this scheme, and its security controls of OIV can be run by a PASSI audit provider qualified for the LPM.

Service qualifications

ANSSI also qualifies services, with requirement baselines published on its site:

Baseline	Scope	Current version
PACS	Consulting: security accreditation (homologation), risk management, secure architecture, cyber crisis preparation	v2.0
PASSI	Audit: architecture, configuration, source code, penetration tests, organisational and physical	v2.2
PRIS	Incident response: compromise indicators, forensics, malware analysis, investigation steering, cyber crisis management	v3.2
PDIS	Security incident detection	v2.0
PVID	Remote identity verification, at "substantial" and "high" assurance	v1.1
SecNumCloud	Cloud services (IaaS, PaaS, SaaS)	v3.2

SecNumCloud qualified offers receive a Visa de sécurité. ANSSI describes them as cloud offers meant to protect sensitive data and processing against cybercrime and against the application of extraterritorial laws.

Where CSPN stands against CE marking, the CRA and the RED

CSPN and CE marking are independent. CE marking shows conformity with the applicable EU legislation (for electronics, typically LVD, EMC, RED, RoHS, and the CRA from its application dates). A CSPN shows that ANSSI certified a product version after a fixed-time evaluation.

• Cyber Resilience Act (EU) 2024/2847: reporting obligations from 11 September 2026, full application from 11 December 2027. Under Article 27, presumption of conformity comes from harmonised standards, common specifications, or a certificate or EU statement of conformity under a European scheme adopted under the Cybersecurity Act. Article 27(9) lets the Commission specify such schemes by delegated act, and a certificate at least at "substantial" level then replaces third-party assessment for the requirements covered. A national CSPN is none of these.
• RED article 3(3)(d)(e)(f): applies to the radio equipment concerned since 1 August 2025, with EN 18031-1/-2/-3 cited with restrictions (Decision (EU) 2025/138). See the EN 303 645 and EN 18031 guide.

In both cases a CSPN report can inform the risk assessment and the technical documentation, but it is not a conformity route.

Claims the texts contradict

Common claim (including earlier versions of this page)	What the text says
"CSPN has limited recognition abroad; for German public buyers you need a BSI certificate."	CSPN certificates are recognised in Germany under the CSPN-BSZ agreement with the BSI (version 3 of 15 May 2024), except product types listed in its application note.
"EDR, anti-virus and network probes are typical CSPN domains."	CER-P-01 Annex B: analysis and detection functions (EDR, anti-virus, network probe, IDS, application firewall, vulnerability scanner) cannot be evaluated; they count only as attack surface.
"CCRA recognises certificates up to augmented EAL4."	Since the 2014 arrangement: EAL2 plus ALC_FLR for generic evaluations, or the level in a cPP.
"EUCC substantial is EAL1 to EAL4, high is EAL5 to EAL7."	Article 4 of Regulation (EU) 2024/482 maps levels on AVA_VAN: substantial = AVA_VAN 1-2, high = AVA_VAN 3-5.
"EUCC ends national schemes, so CSPN is being phased out."	Article 49 applies to national schemes covered by EUCC. ANSSI FAQ: EUCC will not replace CSPN.
"Qualification renforcé is for Diffusion Restreinte data."	Qualification levels are defined by threat (basic, advanced, high). Protection of Diffusion Restreinte or classified information falls under product approval (agrément).
"The qualification follows the certificate validity."	Qualification is a separate ANSSI decision, at most three years, with its own conditions of use and recommendation level.
"CESTI performing CSPN are under COFRAC quality control."	AGR-P-01 licenses CSPN centres through ANSSI audits and a pilot evaluation; ISO/IEC 17025 accreditation is a requirement for Common Criteria centres.
"CSPN workload is a few dozen days, set case by case."	25 man-days over 8 weeks, +10 for cryptography, never below 15 nor above 60 except some re-evaluations.
"A CSPN supports CRA presumption of conformity."	CRA Article 27(8) refers only to European schemes under the Cybersecurity Act.
"Requirements per level are in the RFS, Réglement fédéral de sécurité."	No such French text. The references are the qualification process, the RGS and the decrees of 2010 and 2015.
"A library or SDK can get a CSPN."	Not eligible (CER-P-01 Annex B and ANSSI FAQ); evaluate the application that uses it instead.

Practical approach for a manufacturer

1. Check eligibility before anything else. Read Annex B of CER-P-01 against your product: security functions within the five eligible families, no detection engine as a claimed function, maintained third-party components, standard cryptography, compliance with the mandatory ANSSI guides. Check that no Common Criteria or EUCC certificate exists on a similar version.

2. Write the security target to NOTE-09. The target must name the exact version, the intended use, the technical and organisational environment, the sensitive assets (always including the host system), the attackers, the threats and the third-party components with versions.

3. Pick a CESTI licensed for your scopes. Use the ANSSI list and check the scopes, including cryptography if needed. The sponsor contracts with the CESTI and files the application with ANSSI.

4. Prepare for tunnel mode. Freeze the version and deliverables before work starts; afterwards, only a critical vulnerability notice can come out, and fixes wait for the end.

5. Plan the life cycle. The certificate lasts three years; maintenance is only possible within 24 months; a FAIL gives four months to file a re-evaluation. If the target market requires qualification, plan it as a separate ANSSI decision with its own duration.

See also

• Product cybersecurity: obligation, evaluation, label
• CMMC and UK Cyber Essentials: defense cyber baselines
• PSA Certified: Arm-led IoT security baseline
• SESIP: IoT platform security evaluation methodology
• TPM 2.0 and TCG hardware security

Working on preparing a CSPN evaluation or an ANSSI Qualification for an electronic product for a real product? AESTECHNO can audit your design and certification plan. Get in touch

Recent changes to watch

• CER-P-01 moves fast. Version 6.0 (2 March 2026) brought electronically signed certificates and reports, a maximum delay for maintenance requests and the link with vulnerability management (VUL-P-01); version 7.0 (12 May 2026) changed tunnel mode and created the post-FAIL re-evaluation path. Always work from the version in force on the ANSSI documents page.
• CESTI scopes by technology. Since February 2026, a centre is licensed for technologies such as post-quantum cryptography or integrated circuits rather than for product types.
• SOG-IS is closed at ANSSI. New Common Criteria work goes through EUCC; only maintenance of existing SOG-IS certificates remains.
• CRA dates. Reporting obligations apply from 11 September 2026; the rest from 11 December 2027.

A 30-minute audit with AESTECHNO engineers.

AESTECHNO is the electronics design house that edits spilma. We help product teams scope their certification effort and avoid the common mistakes.

Book a free audit

Going further

• Cyber Resilience Act: EU product cybersecurity baseline
• ETSI EN 303 645: consumer IoT cybersecurity
• Common Criteria ISO/IEC 15408: international normative framework
• RED directive: radio equipment and article 3.3 cybersecurity
• Glossary: definitions of ANSSI, ENISA, CESTI, EUCC terms

Sources & references

1. ANSSI, French national cybersecurity agency, ANSSI cyber.gouv.fr/
2. ANSSI Visa de sécurité, overview and usage charter, ANSSI cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/comprendre-levaluation-de-securite/visa-de-securite/
3. Presentation of the first-level security certification (CSPN), ANSSI cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/comprendre-levaluation-de-securite/certification-de-produits/presentation-certification-cspn/
4. Documents applicable to CSPN (procedures, forms, methodologies), ANSSI cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/comprendre-levaluation-de-securite/certification-de-produits/referentiel-dexigences-pour-la-certification/documents-applicables-certification-de-securite-de-premier-niveau/
5. ANSSI-CSPN-CER-P-01 v7.0, first-level security certification procedure (12 May 2026), ANSSI cyber.gouv.fr/documents/51/ANSSI-CSPN-CER-P-01_Certification_de_securite_de_premier_niveau_v7.0.pdf
6. ANSSI-CSPN-CER-P-02 v5.0, criteria for a CSPN evaluation (applies 1 September 2024), ANSSI cyber.gouv.fr/documents/770/ANSSI-CSPN-CER-P-02_Criteres_pour_evaluation_en_vue_dune_CSPN_v5.0.pdf
7. ANSSI-CSPN-MAI-P-01 v1.1, maintenance of confidence (23 September 2025), ANSSI cyber.gouv.fr/documents/59/ANSSI-CSPN-MAI-P-01_Maintien_de_la_confiance_continuit%C3%A9_de_lassurance_v1_zU1fdjB.1.pdf
8. ANSSI-CSPN-AGR-P-01 v2.0, licensing of CSPN evaluation centres (24 February 2026), ANSSI cyber.gouv.fr/documents/69/ANSSI-CSPN-AGR-P-01_Agrement_des_centres_evaluation_v2.0.pdf
9. Evaluation centres licensed for CSPN, ANSSI cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/evaluer-les-produits-et-services/centres-evaluation/centres-evaluation-cspn/
10. FAQ on product certification and qualification, ANSSI cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/comprendre-levaluation-de-securite/faq-qualification-certification/
11. Common Criteria mutual recognition: EUCC, SOG-IS and CCRA timeline, ANSSI cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/comprendre-levaluation-de-securite/certification-de-produits/accords-de-reconnaissance-criteres-communs/
12. CSPN and BSZ mutual recognition agreement, ANSSI cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/comprendre-levaluation-de-securite/certification-de-produits/accords-de-reconnaissance-mutuelle-certification-de-securite-de-premier-niveau-cspn/
13. Renewal of the CSPN-BSZ mutual recognition agreement (24 May 2024), ANSSI cyber.gouv.fr/actualites/renouvellement-de-laccord-de-reconnaissance-mutuelle-cspn-bsz-entre-lanssi-et-le-bsi/
14. ANSSI issues its first EUCC certificates (3 April 2025), ANSSI cyber.gouv.fr/actualites/le-centre-de-certification-de-lanssi-%C3%A9met-ses-premiers-certificats-eucc/
15. Product qualification process QUAL-PROD-PROCESS 1.0, ANSSI cyber.gouv.fr/documents/648/qual_prod_process-processus-de-qualification-d-un-produit.pdf
16. Requirement baselines for qualification (PACS, PASSI, PRIS, PDIS, PVID, SecNumCloud), ANSSI cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/comprendre-levaluation-de-securite/qualification-de-produit-et-services/referentiels-qualification/
17. SAIV scheme, Loi de Programmation Militaire and OIV obligations, ANSSI cyber.gouv.fr/reglementation/cybersecurite-systemes-dinformation/directives-nis-nis2-et-dispositif-saiv/dispositif-saiv/
18. Cloud and SecNumCloud qualification, ANSSI cyber.gouv.fr/enjeux-technologiques/cloud/
19. Security services evaluated by ANSSI, ANSSI cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/services-de-securite-evalue/
20. Implementing Regulation (EU) 2024/482, EUCC scheme, EUR-Lex eur-lex.europa.eu/eli/reg_impl/2024/482/oj
21. Regulation (EU) 2024/2847, Cyber Resilience Act, EUR-Lex eur-lex.europa.eu/eli/reg/2024/2847/oj