0.4Official resources (ANSSI, Cybermalveillance, CNIL)
The essentials in 30 seconds
- 3 sources cover everything: ANSSI (technical, cyber.gouv.fr), Cybermalveillance.gouv.fr (victim assistance), CNIL (personal data, cnil.fr).
- Free tools to know BEFORE an incident: SecNumacadémie MOOC, good-practice guides, reflex sheets, reporting platforms.
- The first reflex stays internal: know your security contact before needing them — official platforms come as backup.
Threaded mini-case — Karim organises his resource box
Karim, an office employee in Algiers, had got into the habit of looking for cyber advice at random on the internet — until the day two articles contradicted each other on passwords. He decides to start again on solid ground: he bookmarks Cybermalveillance.gouv.fr, downloads the ANSSI “Guide to good computer practices”, finds the CNIL section for professionals and notes his IT contact's number on a paper stuck to his screen. When in doubt, he now knows whom to call and what to read.
Standalone case for this section: it returns in the lesson, the diagram, the script and the 48h challenge of section 0.4.
1. Three reference institutions
In France, three official sources cover everything: the ANSSI (technical cybersecurity, cyber.gouv.fr), the CNIL (personal data and GDPR, cnil.fr), and Cybermalveillance.gouv.fr (victim assistance: online diagnosis, connection with providers, reflex sheets). Karim bookmarked them: no more contradictory advice gleaned at random — official reference guides are free and up to date.
2. Free tools
These institutions offer free tools: the ANSSI SecNumacadémie MOOC (the reference training, with certificate — detailed in 5.5), CNIL practical guides, Cybermalveillance awareness kits, reporting platforms (PHAROS, Signal-Spam). Real resources to know before any incident — not during. Karim downloaded the “Guide to good computer practices”: the condensed reference at hand.
3. The first reflex stays internal
In case of incident: Cybermalveillance.gouv.fr is the assistance entry point — for individuals as for professionals. But the first reflex stays internal: know your security contact before needing them, because they isolate and handle. Beware of unsourced cyber advice. Note for Karim in Algiers: these French platforms remain excellent good-practice references even outside France, but in case of a real incident, he first applies his organisation's procedure and contacts his local contact or provider — and if doubt persists, he asks a professional for advice.
🔎 Concrete example — 🔎 Concrete example — Building your resource box
Bookmarks: cybermalveillance.gouv.fr (reflex sheets).
ANSSI: “Guide to good computer practices”.
CNIL: section for professionals. + Note your internal contact.Takeaway: Karim sticks his contact's number to his screen: the first reflex is internal.
Lesson: when in doubt, the internal contact is the first number — platforms as backup.
Section vocabulary
- ANSSI
- The French national cybersecurity agency: the French cyber-defense authority (cyber.gouv.fr), reference guides and alerts.
Simple example: Karim downloads the good-practice guide on cyber.gouv.fr instead of following an anonymous article.
What it is not: a commercial provider selling security solutions.
Reflex: check any important technical advice against ANSSI guides.
- Cybermalveillance.gouv.fr
- The national victim-assistance platform: online diagnosis, connection with providers, reflex sheets.
Simple example: Karim browses the reflex sheets and bookmarks the site: his entry point in case of incident.
What it is not: an anonymous forum where everyone gives unverified opinions.
Reflex: in case of incident, start with the platform's online diagnosis.
- CNIL
- The French data protection authority: the authority for personal data and GDPR (cnil.fr).
Simple example: Karim finds the CNIL section for professionals for personal-data questions in the office.
What it is not: a technical support service in case of hacking.
Reflex: for any personal-data question, start from cnil.fr.
- SecNumacadémie
- The free ANSSI MOOC: the reference cybersecurity training, with certificate (detailed in 5.5).
Simple example: Karim enrols in the free MOOC to extend this guide with recognised training.
What it is not: paid unrecognised training found at random.
Reflex: plan the MOOC as the next step after this level.
In practice — In practice — Build your resource box
- Visit Cybermalveillance.gouv.fr: browse the reflex sheets and bookmark the site.
- On cyber.gouv.fr (ANSSI), download the “Guide to good computer practices” — the condensed reference.
- On cnil.fr, find the section for professionals.
- Note your organisation's internal contact (IT/security contact): that is YOUR first number when in doubt.
Ready-to-say script — report an incident to your contact (1 min)
“I received a suspicious message and I clicked / I have a doubt about an attachment. I deleted nothing and noted the time. Here is the message — what should I do: disconnect the workstation, change my password, run the Cybermalveillance diagnosis?”
Say it fast, with no shame: reporting early protects the whole organisation; bring the facts (time, message, actions already taken).
Copy-paste template — my resource sheet
CYBERMALVEILLANCE.GOUV.FR (bookmark + reflex sheets): DONE / TO DO
ANSSI — good-practice guide (cyber.gouv.fr): DONE / TO DO
CNIL — section for professionals (cnil.fr): DONE / TO DO
SECNUMACADÉMIE (free MOOC, see 5.5): DONE / TO DO
MY INTERNAL CONTACT (name + number): _______________VSE / tight budget
With no dedicated contact: designate whom to call (the IT provider, the manager) and display the number with the 3 official bookmarks near each workstation.
SME in Algeria
Karim combines both worlds: good practices from French references to train himself, and his organisation's local procedure in case of a real incident — the internal contact first.
Personal use
At home: the same resources apply — Cybermalveillance.gouv.fr also assists individuals (passwords, hacked accounts, online scams).
Trainer / relay
To raise your team's awareness: project a Cybermalveillance reflex sheet for 5 minutes at the start of a meeting — the resource box becomes collective.
✓ Best practices
- Bookmark the three official sources right now.
- Identify your internal security contact before needing them.
- Prefer official references to unsourced advice.
✗ Common pitfalls
- Looking for cyber advice on dubious sources.
- Only discovering your internal contact at the time of the incident.
- Forgetting these resources also serve personal life.
Key takeaways
- Three official sources cover everything: ANSSI (technical), Cybermalveillance (victims/reflexes), CNIL (personal data).
- In case of personal or professional incident: Cybermalveillance.gouv.fr is the assistance entry point.
- The first reflex stays internal: know your security contact before needing them.
- Beware of unsourced cyber advice: official references are free and up to date.
48h Challenge - apply tomorrow
Install your resource box: Cybermalveillance.gouv.fr bookmark, ANSSI guide downloaded, CNIL professional section found — and note your internal contact's number on your screen. Check each domain before sharing.
- I cite the 3 official sources and the role of each.
- My bookmarks and the ANSSI guide are installed.
- I know the name and number of my internal contact.
Frequently asked questions
Are these resources usable for my personal life?
Yes: Cybermalveillance.gouv.fr assists both individuals AND professionals — passwords, hacked accounts, online scams. Good reflexes are the same at home as in the office: locked mailbox, unique passwords, verification before clicking. Karim applied his diagnosis to his personal accounts the same evening — and the ANSSI SecNumacadémie MOOC, free, works as well for yourself as for work. Security does not stop at the office door: a hacked personal account (same password as at work) can contaminate the company.
Whom to call first in case of incident at work?
Your internal contact (IT/security), immediately — they isolate and handle (disconnection, password changes, analysis). Official platforms come as backup: diagnosis and assistance on Cybermalveillance.gouv.fr, reporting (signal-spam.fr, dedicated platform), filing a complaint. Start neither by erasing traces, nor by searching alone for hours: reporting early means protecting the whole organisation. The full circuit (who does what, in which order) is detailed in level 5 — but your contact's number must be known from today.
Which platform assists victims (individuals and companies)?