With countries around the world facing an increase in cybercrime, a complex and sophisticated attacks, the need for a national response strategy was both essential and imminent.

In this context, the national information security framework called ‘’ RNSI’’ was developed in 2016 and updated in 2020.

Principles and Objectives:

The RNSI brings together guidelines and good practices in the field of information systems security.

It aims to improve the cybersecurity posture of organizations by putting in place adequate security controls through a risk-based approach.

The RNSI 2020 is based on international information systems security standards and benchmarks: ISO/IEC 27001:2013, ISO/IEC 27002:2013, ISO/IEC 27005:2018, ISO/IEC 22301:2019, ……

It provides :

• A set of information security requirements and measures;
• Implementation recommendations that enable any public body or government entity to better protect its information assets and strengthen its resilience to cyber-attacks.

The RNSI is composed of several parts, we can mention the fundamental principles of information security, the security requirements which encompass the different domains: networks, information systems, applications…, the audit and conformity assessment procedures, but also the guides and tools to help organizations to implement the standard.

The standard is composed of five (05) main parts:

1. Fundamental principles of information security: this section includes the basic principles of information security (confidentiality, integrity, availability of data, legal and regulatory requirements…);
2. Security requirements: this section focuses on the security requirements applicable to each area such as networks, information systems, applications, data, security incident management, etc. The security requirements are classified according to three levels, taking into account the potential impact on the organization in the event of a security breach: critical, important, normal.
3. Audit and conformity assessment procedures: This section details the procedures for audit and conformity assessment against the security requirements defined in the standard. It includes information on information security certificates.
4. Guides and tools to support implementation: these are made available to organizations to help and support them in implementing the security requirements specified in the standard.
5. Glossaries and acronyms: they contain the terms, acronyms and abbreviations used in the RNSI but also in the field of information security.

Areas of security and controls :

The main areas of security and controls of the RNSI are shown in the diagram.

The RNSI’s security controls:

• Are designed to meet the information security needs of all organizations and public entities;
• Vary in terms of applicability from one sector to another, taking into consideration organizational aspects, internal regulations, the nature of the activity and the technologies deployed.

It is essential to draw up a statement of applicability justifying the inclusion or exclusion of a safety measure on the basis of the outcome of the risk assessments.

The 20 areas covered by the RNSI 2020 are :

1. Asset management
2. Protection of personal data
3. Access management and control
4. Security of mobile devices
5. Network security
6. Security of information systems
7. Operational safety
8. Security of critical information systems
9. Security of cloud services
10. Cryptography
11. Physical Security
12. Internet of Things
13. Monitoring and Logging
14. Security Incident Management
15. Business continuity management
16. Human resources
17. Security related to the use of Social Networks
18. Integration of safety during the software development life cycle
19. Security requirements for information technology projects
20. Relationship with third parties

Normative framework of the RNSI 2020:

The normative framework of the RNSI is based on international best practice and recognized standards in information security.

How can  Intervalle Technologies teams support you?

Our teams are certified on the methodologies and standards of information systems security audits (ISO 27001, PCI DSS, CSP SWIFT, CISA).

They have a mastery of the RNSI 2020 Framework and have proven skills in:

• GRC: Governance of Information Security, Risk and Compliance;
• Safety audits ;
• Network & security architecture audits ;
• Configuration audits ;
• Design and implementation of security solutions;
• Vulnerability management solutions ;

We have carried out numerous security and organizational audits in many territories.