France: What the State Cybersecurity Roadmap 2026-2027 Really Foresees

The map is not the territory. The Polish semanticist Alfred Korzybski was talking about logic, not state cybersecurity, but the formula comes at just the right time. On September 7, ANSSI announced REACTIV, its new power to compel ministries in the event of an attack. The press release refers to a text published five months earlier, the state’s digital security roadmap for 2026-2027, which REACTIV aims to accelerate. This document sets out ten projects and about a hundred deadlines. An unusual admission slips into the preface regarding the budgetary constraints that hampered the previous edition. The map, then. Let’s look at the territory. Key points of this article:

• ANSSI announced REACTIV, a power allowing it to compel ministries in the event of an attack, to accelerate the 2026-2027 digital security roadmap.
• The 2026-2027 roadmap, despite budgetary constraints, sets deadlines for implementing cybersecurity measures, some extending to 2030.

The official document spans eight pages and sets ten objectives, from the most basic (closing generic accounts by June 30, 2026) to the most distant (deploying quantum-resistant cryptography by 2030). In between, a stack of dates.

For example, multi-factor authentication for system administrators must be in place by December 31, 2026. For users of systems deemed high-stakes, the same mechanism is expected by February 28, 2027. For all other state systems, without distinction, it will be necessary to wait until February 28, 2028, two years after the data leaks that justified the document.

Security certification follows the same tiering, mandatory by the end of 2026 for systems carrying the essential missions of ministries, postponed to the end of 2028 for the rest. And the famous EDR and XDR (software that detects an intrusion before it turns disastrous) must cover workstations and servers by December 31, 2026, prioritizing the most sensitive systems.

On paper, REACTIV gives ANSSI the power to force a ministry to act within the hour. On the calendar, the same administration gives itself until 2028 to generalize a measure as basic as two-factor authentication.

However, let’s nuance this. The two texts do not really contradict each other. They simply describe two speeds of the same house. Emergency intervention on one side, fundamental compliance on the other. Except that the roadmap itself warns that it takes into account the budgetary constraints that weighed on the implementation of the previous one. In other words, the 2025-2026 edition did not keep its schedule due to lack of resources, and this one solidifies certain deadlines without any new budget figures accompanying the document. Inspection bodies are mobilized to monitor the application of the ministerial roadmaps, the text specifies. Monitoring does not finance anything.

Searching for cryptocurrency in the eight pages of the document is a quick exercise. The word does not appear anywhere, nor do Bitcoin, crypto-asset, or wallet. The only cryptography mentioned is that which protects state communications, with an entire chapter dedicated to post-quantum transition.

The text describes this technique in black and white without ever naming it: Some attacks consist of capturing currently sensitive information [...] in order to decrypt it when the capabilities become available. Security experts call it harvest now, decrypt later, capturing today to decrypt later. The timeline provides for an inventory of sensitive data by the end of 2026, identified technical bricks by the end of 2027, and then a complete deployment aimed for 2030. A timeline that resembles, almost word for word, the one that the G7 demanded from the crypto industry in early September. Except that Bitcoin already has a technical candidate on the table, BIP-360, while the French state is still at the inventory stage. Quantum computing threatens both worlds in the same way. One has an execution plan. The other has a census plan.

The comparison has its limits, starting with the actual computing power available today. The best-known quantum processor, Willow at Google, aligns 105 physical qubits, but its record demonstration only concerns a single logical qubit, the unit that really matters against encryption. In contrast, the tracker ecdsa.fail estimates that 813 logical qubits are needed to break a Bitcoin key. The post-quantum threat is therefore not immediate. But the state, which gives itself until 2028 to generalize two-factor authentication on its own systems, also sets, without saying so, the pace at which it intends to keep its own promises. REACTIV gives full powers for emergencies. The roadmap, on the other hand, votes for patience.