ANSSI's first-level certification proved that weeks of expert attack, honestly reported, beat years of paperwork for most products. It remains the key that opens the French market — and the template Europe's lightweight schemes are built on.
At a glance
Owner
Evaluations by ANSSI-licensed CESTI labs
Type
Time-boxed conformity analysis + penetration testing
Effort
Weeks end-to-end when the vendor is prepared
Methodology
The FITCEM standard grew from CSPN practice
Opens
Frequent prerequisite on the road to ANSSI qualification
Typical targets
Firewalls, VPNs, authentication, embedded products, industrial components
What it is
CSPN certifies a product against its own security target within a fixed evaluation budget: a licensed CESTI checks that the security functions do what the vendor claims, then spends the remaining days attacking them the way a competent adversary would. ANSSI reviews and certifies. No EALs, no protection-profile machinery — a sharp, dated statement that this configuration resisted this level of attack.
Its influence exceeds its scope. Fifteen-plus years of CSPN practice supplied the template for EN 17640 (FITCEM) and its siblings across Europe, and inside France it functions as trust infrastructure: a familiar signal to public buyers, OIV/OSE operators and integrators, and frequently the evaluation step en route to ANSSI qualification — which is where French regulated procurement is actually decided.
In the CRA era, CSPN’s position is strategic rather than threatened: it exercises precisely the evidence and testing discipline CRA conformity will reward, in a national scheme with an active regulator, while the European machinery assembles itself. For vendors with French revenue, it is rarely the wrong first move.
When it's the right tool
Public sector, critical operators and defence-adjacent buyers read CSPN fluently. For many tenders it is the difference between shortlisted and unread.
ANSSI qualification — the real gate for sensitive French procurement — builds on evaluation. CSPN is the established on-ramp.
The time-boxed format tolerates release cycles that full CC never will. Re-evaluation of a new version is a project, not an era.
The fixed clock is unforgiving: unclear security targets and unstable test configurations consume attack days. Preparation is where CSPN succeeds or embarrasses.
Where it matters
Connected products selling into French public and industrial buyers — CSPN evidence doubles as CRA preparation.
Components supplied to French OIV/OSE environments meet CSPN expectations layered onto IEC 62443 programmes.
Software in qualified cloud stacks and sovereign offerings moves through the same ANSSI trust ecosystem.
For scheme designers, CSPN is the case study: how a national first-level scheme becomes a European methodology.
Expert notes
A CSPN security target that overclaims invites findings; one that underclaims produces a certificate nobody values. The craft is a target that matches what buyers need certified to what the product genuinely resists — written before lab selection, stress-tested against the evaluation clock. Most CSPN disappointments were authored months earlier, in the target.
Our position: we write or red-team the security target first, and only then talk labs and dates. In fixed-time evaluation, scoping is the strategy.
CSPN’s recognition is national, but its evidence travels: an EN 17640-shaped dossier converts to Germany’s BSZ or Spain’s LINCE as a delta, feeds CRA technical documentation almost verbatim, and pre-answers much of what a notified body will ask. The mistake is treating each national certificate as a separate project with separate evidence — the family exists precisely so you don’t.
Our position: build one evaluation dossier to the EN 17640 structure, certify where revenue demands, and bank the rest as CRA readiness. Paying three times for one product’s evidence is a choice.
Security targets, CESTI selection, qualification strategy — with people who know how ANSSI reads a dossier.
We’ll send you access by email.
