Military Programming Law (LPM): A Key Standard for Cybersecurity in France and Europe

Main Objectives of the Military Programming Law

The LPM is adopted by Parliament and is based on three major strategic axes:

• Defining national defense priorities in the face of new threats (cyberattacks, espionage, terrorism, etc.).
• Setting the necessary budgets to develop modern military capabilities.
• Ensuring the protection of critical infrastructure, including the energy, transport, health, and communications sectors.

In terms of cybersecurity, the LPM imposes specific obligations on Operators of Vital Importance (OIVs) and Operators of Essential Services (OESs), such as the implementation of robust technical and organizational measures.

Cybersecurity and LPM: A Strategic Priority

Strengthened Integration of Cybersecurity in LPM 2024-2030

LPM 2024-2030 allocates a significant portion of its budget to cybersecurity with an overall funding of almost 413 billion euros for the period, including a portion dedicated to the modernization of digital capabilities. This strategic choice responds to several observations:

• The resurgence of attacks targeting critical infrastructure.
• The increased sophistication of threats (APTs, ransomware, supply chain attacks).
• The growing interdependence of industrial and digital systems.

Industrial cybersecurity is a focal point of the LPM. OT (Operational Technology) environments are increasingly targeted by attacks aimed at disrupting production or collecting sensitive data. These threats represent a risk to business continuity and, ultimately, to national security.

Obligations of Operators of Vital Importance (OIVs)

OIVs, defined by the Defense Code, play an essential role in implementing the security measures imposed by the LPM. These operators, from sectors such as energy, transport, or health, must comply with strict requirements:

• Regular assessment of digital risks.
• Deployment of minimum security measures, such as the use of segmented information systems and encryption of sensitive data.
• Mandatory notification of security incidents to competent authorities (notably ANSSI – National Cybersecurity Agency of France).

In case of non-compliance, the penalties provided by the LPM include significant fines, or even the suspension of critical activities.

Impact on Industrial Cybersecurity

Cybersecurity of Industrial Control Systems (ICS/SCADA)

Industrial infrastructures rely on automation systems (ICS/SCADA), often designed before the emergence of modern cyber threats. The LPM imposes reinforced controls on these systems to prevent risks of intrusion, sabotage, or diversion. Recommendations include:

• Separation of IT (Information Technology) and OT (Operational Technology) networks to limit attack vectors.
• Regular system updates to correct vulnerabilities.
• Integration of intrusion detection solutions specific to OT environments.

Securing Industrial Supply Chains

Supply chains are another weak point identified in the LPM. Companies working with OIVs must guarantee the security of their products and services by integrating cybersecurity requirements from the design stage (security by design).

The LPM and European Collaboration

Synergies with the NIS2 Directive

The NIS2 directive, adopted by the European Union, complements the LPM by harmonizing the cybersecurity obligations of critical operators within member states. France, with its LPM, is ahead in several aspects, particularly supervision by ANSSI. However, convergence with the European directive strengthens the effectiveness of measures and facilitates cross-border cooperation in the event of a major attack.

Strategic Partnerships

The LPM also encourages partnerships between public and private actors to develop innovative solutions. The objective is to strengthen European digital sovereignty while reducing dependence on non-European technologies.

LPM and Technological Innovation

Role of Artificial Intelligence and New Technologies

LPM 2024-2030 plans investments in emerging technologies such as artificial intelligence, quantum computing, and predictive cybersecurity. These tools enable:

• Proactive threat analysis through advanced algorithms.
• Attack simulation to test the resilience of critical infrastructure.
• Strengthening of rapid response capabilities in case of an incident.

Development of Cybersecurity Skills

Finally, the LPM emphasizes the training and recruitment of cybersecurity experts. The lack of skills is a major obstacle to securing critical infrastructure. Specific programs, funded by the state, aim to bridge this gap.

Upcoming Challenges and Issues

The implementation of LPM 2024-2030 raises several challenges:

• Complexity of industrial systems: OT environments remain difficult to secure due to their diversity and increasing interconnection with IT networks.
• High investment costs: Small structures, subcontractors of OIVs, may experience difficulties in meeting the requirements of the LPM.
• Rapid evolution of threats: The LPM must remain flexible enough to adapt to unforeseen threats, such as cyber weapons exploiting zero-day vulnerabilities.

References

• Law n°2023-703 of July 30, 2023 relating to military programming for the years 2024 to 2030.
• ANSSI – National Cybersecurity Agency of France: The SAIV mechanism
• NIS2 Directive: Strengthening cybersecurity within the European Union and its impact on member states.

Conclusion

The Military Programming Law 2024-2030 marks a significant step forward in the protection of critical infrastructure and industrial cybersecurity. By imposing strict obligations on OIVs and encouraging technological innovation, it plays a central role in securing France's strategic interests.

For industrial companies, this law represents both a constraint and an opportunity. It requires a technological and organizational upgrade, while offering prospects for collaboration and innovation.

By being part of a European dynamic, the LPM contributes to building a resilient ecosystem in the face of modern cyber threats. For players in the sector, compliance with its requirements is imperative to ensure business continuity and guarantee national security.

FAQ

Question 1: What is the Military Programming Law (LPM)?

The LPM is a law defining the strategic and budgetary priorities of the French armed forces for a period of several years. It specifically covers the cybersecurity of critical infrastructure.

Question 2: Who are the stakeholders concerned by the LPM in terms of cybersecurity?

Operators of Vital Importance (OIVs), Operators of Essential Services (OESs), industrial subcontractors, and public administrations must comply with the LPM's cybersecurity requirements.

Question 3: What obligations does the LPM impose on industrial companies?

Companies must strengthen the protection of their OT/ICS systems, secure their supply chains, and report any major cyber incidents to the competent authorities, particularly ANSSI.

Question 4: How does the LPM interact with the NIS2 Directive?

The NIS2 directive harmonizes cybersecurity obligations at the European level. The LPM integrates these requirements while imposing specific rules for France, particularly for OIVs.

Question 5: What are the major challenges related to the implementation of the LPM in cybersecurity?

The main challenges include the complexity of industrial systems to secure, the cost of compliance, the shortage of cybersecurity experts, and adaptation to new emerging threats.