When a client asked us to support the accreditation of its "Diffusion Restreinte" information system (DR IS, the French restricted classification level), they were confident. A dedicated room was ready, the workstations had just been delivered and the network was physically isolated. "We should wrap this up in a few weeks," they told us at the kickoff meeting. It took four months.
This was neither a failure nor a delay. Accrediting a DR IS is a demanding process, and the difficulties rarely lie where you expect them. Here is what we learned, and what we recommend to any organization getting started.
What the regulatory framework says
French interministerial instruction no. 901 (II 901) governs the protection of information systems that process information marked "Diffusion Restreinte". It applies to government bodies, but also to companies that handle such information under contract, particularly in the defense industrial and technological base (BITD) and among its subcontractors.
The core principle is simple: a DR IS must be accredited before it goes into service. Accreditation is a formal decision. An accreditation authority, appointed within the organization, certifies that it is aware of the residual risks to the system and accepts them. This decision is based on an accreditation file that includes, among other things, a risk analysis, a security policy, the measures implemented and the results of an audit.
On paper, the process is clear. In reality, every step reveals gaps between the system as imagined and the system as it actually is.
Step 1: scoping, or the art of defining the perimeter
The first meeting focused on a seemingly trivial question: what is part of the DR IS?
The client had in mind three workstations, a file server and a switch. Digging deeper, we found something else:
- a multifunction printer;
- a network-manageable UPS;
- an administration workstation used "every now and then";
- an external hard drive reserved for backups, kept in a drawer.
None of these items appeared in the initial inventory.
So we started with a physical inventory, room by room, cable by cable. It took half a day. It was probably the most worthwhile half-day of the entire project.
Step 2: risk analysis, more than a box-ticking exercise
For the risk analysis, we used the EBIOS Risk Manager method, scaled to the size of the system. The goal was not to produce a 200-page document, but to identify credible scenarios and proportionate measures.
The workshops brought out a point no one had formalized: the main threat was not a sophisticated attacker from outside. Since the IS was isolated, the most likely scenarios involved human error and physical access. This could mean DR information copied to a personal USB stick, a printed document forgotten in the tray, or a visitor left alone in the room.
This finding redirected part of the security budget. The client was considering an expensive network intrusion detection tool. We instead recommended strengthening physical access control and user awareness, which were far more effective given the actual risks.
Step 3: the audit, and its surprises
The security audit is a key part of the accreditation file. As a PASSI-qualified provider, we carried out a configuration audit of the workstations and servers, an architecture audit and an organizational and physical review.
The printer that talked too much
On day one, the multifunction printer had a surprise in store. It was connected to the DR network, as planned. But it also had Wi-Fi Direct enabled by default, a factory setting that had never been changed. In practice, any smartphone within a few dozen meters could see a wireless access point named after the printer model.
The "physically isolated" network therefore had a wireless interface open to the outside. No one had noticed it, simply because no one had looked for it.
The shared badge
The physical review revealed another gap, a more human one. The access badge to the DR room was personal, but it was passed between three colleagues "to help out" when its holder was away. The access log therefore showed that only one person had entered the room, while three different people had actually worked there.
No one was acting in bad faith. The organization simply had not planned for replacement badges, and the teams had found a practical workaround. But for a DR IS, access traceability is fundamental: in the event of an incident, you must be able to answer the question "who was there?".
The solution combined several measures: personal badges for each cleared person, an escorted access procedure for visitors and a reminder of the rules during an awareness session.
Windows hardening, over several iterations
On the technical side, hardening the Windows workstations took several rounds. We relied on ANSSI recommendations and checked the essentials:
- USB ports blocked, except for explicitly authorized media;
- BIOS/UEFI password protection and booting from external media disabled;
- disk encryption;
- user accounts without administrative privileges;
- security event logging and centralized log collection;
- unnecessary services and features disabled.
With each pass, we found a few gaps: a misapplied group policy, a local administrator account still active, logging that was too verbose for some events and missing for others. Each gap was recorded in an action plan with an owner, a priority and a deadline.
The question of updates
An isolated IS raises a question many people underestimate: how do you keep it up to date?
The client had no answer. The workstations, delivered several weeks earlier, had not received a single security patch since installation. Yet an isolated but vulnerable system is still a vulnerable system.
Together with the team, we defined a controlled import procedure. Patches are downloaded on a connected workstation, then scanned on a decontamination station. They are then transferred on dedicated media, used for this purpose only, and every operation is logged. This procedure became one of the cornerstones of the system's security maintenance.
Step 4: the accreditation board
After three months of work, the file was ready. It contained the risk analysis, the system security policy, the audit report, the action plan and the list of residual risks.
On the day of the board, the client was nervous. Several items in the action plan were not yet closed, and they feared a refusal.
The accreditation authority read the file carefully, asked specific questions about the printer and the update procedure, then made its decision. It did not ask for a perfect IS. It asked for an IS whose residual risks were known, understood, accepted and monitored.
Accreditation was granted for a limited period, subject to follow-up of the action plan. That is exactly the logic of the process: an informed and accountable decision, not a certificate of perfection.
After accreditation: the hard part begins
Many organizations see accreditation as a finish line. In reality, it is a starting point.
An accredited IS must be kept in a secure state, which involves several obligations:
- applying patches;
- monitoring logs;
- regularly reviewing access rights;
- updating the risk analysis with every significant change.
Adding equipment, changing the architecture or switching providers can call the accreditation into question. Renewal then takes place on the date set by the authority.
Six months after the board, the client called us back. They wanted to add a scanner to the system. Thanks to a well-maintained accreditation file, the impact analysis took one day instead of several weeks.
Our advice for a successful DR IS accreditation
- Start from the real inventory. Walk through the room and list every piece of equipment, cable and removable medium.
- Involve the accreditation authority from the start. It needs to understand the stakes and trade-offs throughout the project, not discover them on the day of the board.
- Don't forget peripherals. Printers, UPSs and network equipment must be hardened just like workstations.
- Address people as much as technology. Physical access control, awareness and clear procedures are often the most effective measures.
- Plan for security maintenance. Without a defined update procedure, an isolated IS quickly becomes a vulnerable one.
- Aim for control, not perfection. A realistic, monitored action plan is worth more than a promise of full compliance.