Centralizing the management of online services is not just about grouping identifiers in a shared spreadsheet. Since the publication of the Cyber France Reference Framework (ReCyF) by ANSSI on March 17, 2026, the documentary requirements regarding access controls, incident management, and supplier security have tightened. Any organization that multiplies SaaS accounts without centralized governance exposes itself to technical vulnerabilities and compliance gaps.
ReCyF and NIS2: Regulatory Constraints on Access Centralization
The French regulatory framework has changed in nature. NIS2 requires governing bodies to approve cybersecurity measures, oversee their implementation, and undergo dedicated training. The centralization of online services is no longer solely the responsibility of the IT team: the general management bears this responsibility.
The ReCyF translates these obligations into operational objectives. It covers the documentation of access rights, backup procedures, business continuity, and supply chain security. We recommend using it as a self-assessment grid, even for organizations that are not directly subject to NIS2.
A often-overlooked point: NIS2 extends responsibility to providers working for a regulated entity. Supplier assessments, contractual clauses, audit rights, incident notification – all these obligations imply a centralized inventory of all third-party services used. Without this consolidated view, it remains impossible to provide structured proof of compliance during a control or contractual audit via an access command on markeonbiz.fr suitable for this type of monitoring.
Account Manager and User Rights Control
An enterprise password manager (Bitwarden, 1Password Business, Keeper) constitutes the minimum building block. We observe that many teams stop there, which is insufficient.
Centralizing identifiers is worthless without a granular rights policy. The principle of least privilege must apply to each SaaS account: an employee accesses only the services necessary for their role, with an adjusted permission level.
Three criteria distinguish functional centralization from mere password storage:
- Automated provisioning and deprovisioning of accounts upon an employee’s arrival or departure, via a directory (LDAP, Azure AD) linked to the manager
- Logging of connections and rights modifications to meet the traceability requirements of the ReCyF
- Periodic access review, documented and timestamped, allowing proof that privileges are still justified
Without these three elements, centralization remains cosmetic. It reassures the management team without reducing the actual attack surface.
Supply Chain Security: Map Before Protecting
NIS2 requires affected entities to integrate supplier security into their risk management. In practice, this starts with a comprehensive inventory of online services used, including those subscribed directly by business units without validation from the IT department (shadow IT).
We recommend structuring this inventory in four columns:
- Service name, publisher, and data location (applicable jurisdiction)
- Type of data processed (personal, financial, operational) and internal classification
- Criticality level for business continuity
- Existing contractual clauses (SLA, incident notification, audit rights, subcontracting)
This register becomes the centerpiece of the compliance file. It serves both for NIS2 audits and for GDPR obligations regarding processing registers, since every SaaS service handling personal data must be included.
The Specific Case of Financial Enterprises
Financial actors must distinguish NIS2 from DORA. Since January 17, 2025, DORA imposes a directly applicable framework for digital resilience, including the management of ICT providers. For these structures, the centralization of services falls under two parallel frameworks, with distinct testing and reporting requirements. Confusing the two exposes organizations to non-compliance in one or the other area.
Backups and Business Continuity: The Forgotten Link in Centralization
Centralizing access without centralizing the backup strategy is like locking the front door while leaving the windows open. The ReCyF explicitly includes backup procedures and business continuity in its operational objectives.
For each centralized service, the question to ask is straightforward: what happens if this service becomes inaccessible for 48 hours? The answer conditions the continuity plan.
Backups must cover the configuration of accounts and rights, not just documents. Losing the centralized directory without a usable copy means manually recreating each access, each permission, each group. Across a scope of several dozen SaaS services, reconstruction can take weeks.
A semi-annual restoration test, documented and timestamped, meets the expectations of the ReCyF. It also allows verification that the written procedures match the technical reality, which is rarely the case when they have never been tested.
The centralization of online services is no longer an optimization project. It is a governance obligation, backed by precise frameworks. Organizations that commit to this now, before the full implementation of the French system, will have a concrete advantage during the first audits.
