Do you run an SME or a mid-sized company in the BITD sector, and is security still an issue you put off until later—between two shipments and three responses to requests for proposals? The practical guide published in 2026 by the DRSD requires you to rethink this order of priorities. It no longer presents the protection of your sites, your teams, and your information as a defensive expense. Instead, it positions it as a criterion for selecting suppliers, a legal responsibility of management, and a measurable competitive advantage. At the same time, cyberattacks targeting the defense sector remain at a high level and primarily target subcontractors. This article breaks down the guide, compares it with the latest available figures, and shows you how to turn a constraint into a demonstration of credibility. One question guides your reading: What do you lose each month that your security measures remain informal?
The story can be summed up in a single sentence in the analysis published by OpexNews in May 2026, based on the DRSD overview. A French defense company was targeted with four Molotov cocktails, and its facilities were subsequently flown over repeatedly by drones. This is neither an isolated incident nor a fictional scenario. It is a modus operandi: reconnaissance, a physical attack, followed by further surveillance.
The parliamentary report on the BITD describes the same type of incidents. Several cases of cable cutting have been reported, particularly on ships under construction, as well as arson attacks on facilities critical to certain companies. It adds that the DRSD is also increasingly reporting drone flights over sensitive sites, which are difficult to detect and identify, as few drone pilots are apprehended.
In this context, the DRSD is publishing a 76-page document intended for executives who have neither a security director, nor a dedicated budget, nor the time to devote to this issue: the BITD’s Practical Guide to Security Management for Small and Medium-Sized Enterprises (SMEs) and Mid-Sized Companies. Its message boils down to one idea:
Security should no longer be viewed as a cost center, but rather as a business partner for the company.
Let’s start with the facts. Since 2022, there have been between 500 and 550 cyberattacks each year against BITD or defense research entities. This trend continues in 2025, with nearly 300 attacks recorded by the end of June.
The DRSD’s 2025 Outlook confirms that the situation is not calming down. The agency observes that the year 2025 is characterized by an acceleration and expansion of armed conflicts on an international scale, and that the defense sector continues to be regularly targeted. Its director summarizes this shift in the times: the acceleration and expansion of international armed conflicts in 2025 have led to a transformation from economic warfare to a war economy.
The targeted sectors are well known. France’s competitors are targeting the BITD and public defense research, particularly for their expertise in artificial intelligence, quantum computing, aeronautics, and space technology.
The nature of attacks is also evolving. In 2024, according to OpexNews, 15% of attacks involved corporate raiding—that is, the acquisition of stakes in French companies. Reputational attacks already accounted for 11% of incidents. In other words, the threat is not limited to physical or cyber attacks—it also involves capital, the legal system, and reputation.
The foreword to the guide, written by Lieutenant General Aymeric Bonnemaison, clearly explains the attacker’s reasoning. SMEs and mid-sized companies are often considered more vulnerable than large corporations, even though they are an essential link in their subcontracting chain. He draws a serious conclusion from this: a breach at a single subcontractor can jeopardize the integrity of an entire defense program.
Industry observers have reached the same conclusion. Faced with large corporations that are increasingly well-protected, foreign powers are seeking to paralyze or infiltrate lower-tier subcontractors, whose security and training budgets are more limited. As a result, nearly 80% of confirmed attacks target small and medium-sized enterprises (SMEs) and subcontractors.
The case of the CAESAr cannon, as reported by OpexNews, illustrates just how far contractors’ precautions go: KNDS France duplicated certain production tools out of fear of sabotage. If major contractors are taking such measures, they will demand the same level of rigor from their supply chain.
This is probably the most strategic section of the guide. The DRSD notes that the procurement departments of large companies in the BITD sector, as well as certain government agencies, now fully incorporate security as a key criterion in the selection of a supplier. As with cybersecurity, physical security requirements are gradually being formalized in contracts.
This is not a distant goal. The ministry has already provided the necessary tools. The DGA’s physical security framework can be used contractually by a contracting authority with one of its subcontractors to ensure a minimum level of security, or by a company conducting a self-assessment to demonstrate its security level to its contracting authorities. It was developed in 2023 by the Ministry of the Armed Forces in collaboration with the Council of French Defense Industries (CIDEF) and industrial prime contractors.
Major corporations are already communicating this to their suppliers. Naval Group has published a supplier guide that notes that this framework aims to ensure a minimum level of security through the implementation of thirteen measures. The document also specifies that security incidents are reported to the DRSD and the DGA/SSDI.
In the cybersecurity realm, progress has been even more significant. The cybersecurity maturity framework includes a first level comprising 21 simple requirements, which is now mandatory in contractual relationships with the DGA, ahead of future mandatory certification. The DGA’s standard contract clauses, for their part, incorporate the physical security framework, which was added to Section 11.14 in its latest edition.
The reasoning is simple: if your competitor can submit a thorough self-assessment covering all 13 requirements and you cannot, the issue of price becomes secondary.
Many SME executives describe their security as “adequate”: a gate, an alarm, and access badges. The problem is rarely the lack of security measures. The problem is the inability to demonstrate that these measures exist and that they work.
A specialist consultant observes this firsthand: the most common discrepancies are not technical but rather related to documentation—measures that have been in place for years but have not been formalized or audited, and therefore cannot be demonstrated during an inspection.
This lack of formalization comes at a cost, even if it does not appear on any income statement. This is exactly the mechanism described in our analysis of the cost of strategic ambiguity for SMEs: what is not clarified ultimately takes its toll in the form of lost time, delayed decisions, and missed opportunities.
The guide also highlights a reality that many executives underestimate. Article L4121-1 of the Labor Code imposes a duty of care on employers toward their employees. According to the 2015 Air France case law, this duty requires enhanced measures, including for employees on international assignments. The so-called Abidjan case (Court of Cassation, December 7, 2011) even extended this obligation to the private life of employees on international assignments.
For an SME that exports and sends its engineers to trade shows or to visit clients abroad, safety is therefore the personal responsibility of the executive—and not just a matter of equipment.
The guide begins with a useful distinction. Safety focuses on preventing and combating malicious acts. Security focuses on accidental, natural, and technological risks. Your QHSE manager likely handles the latter well. The former requires a different approach: thinking like an adversary.
The DRSD then organizes security around three areas, which it presents as a chain whose strength depends on its weakest link:
| Field | Objective | Examples of measures |
|---|---|---|
| Employee Safety | Protect employees and verify who has access to strategic assets | Arrival and departure route, visitor management, awareness-raising |
| Physical Security | Physically Protecting the Company's Assets | Mechanical protection, access control, intrusion detection, video surveillance |
| Information Security | Ensure the availability, confidentiality, integrity, and traceability of information | Need-to-know, two-factor authentication, offline backups |
At the heart of the physicalsecurity system, the guide sets forth a simple rule—the security equation: “the braking time must be strictly greater than the combined times required for detection, alarm processing, and response.” In practice, your door, room, or safe must hold an intruder for longer than it takes to detect them, confirm the threat, and respond. If this is not the case, your system has a design flaw, regardless of how much the cameras cost.
The guide’s main strength is its hierarchical structure . Each topic is divided into two levels: “Getting Started” (the basics) and “Going Further.” Appendix 1 provides a roadmap of 15 actions spread across the PDCA cycle:
| PDCA Cycle | Priority Actions |
|---|---|
| Plan | Appoint a security officer; identify assets; conduct a self-assessment using the DGA framework; identify the 4 or 5 major risks; draft at least one security memo (at a minimum, the internal regulations) |
| Deploy | Establish the role of security manager; launch a staff awareness campaign; physically protect strategic assets; install an intrusion detection system |
| Check | Verify that measurements and systems are functioning properly; measure deviations from targets |
| Adjust | Conduct regular safety inspections; repair defective equipment; raise awareness; update procedures |
There are a few operational details that deserve your attention:
Once the foundation has been laid, the guide recommends replacing the initial safety note with four documents:
In addition, there is a crisis management plan (based on the AGIR method: present the facts, manage the impacts, identify stakeholders, and respond with an action plan), a business continuity and disaster recovery plan (BCP/DRP), and a monitoring system. The guide refers you to other DRSD tools: the risk analysis guide (2023), the crisis survival guide (2024), and the BCP guide (2025).
The guide puts it bluntly: in small and medium-sized enterprises (SMEs), the security manager is usually the CEO, the head of general affairs, the QHSE manager, or even the HR director. In other words, security is most often a secondary responsibility.
This is not a problem in and of itself, provided that four conditions deemed essential by the DRSD are met. The security officer must have:
The DRSD makes a crucial point: the executive can delegate the task, but remains accountable for the outcome. When security relies solely on the founder, it becomes yet another item on an already overloaded desk. This is the phenomenon we describe in our article on the “bottleneck executive” in defense SMEs: tasks that are not structured and delegated ultimately slow down the entire organization.
The most underrated document in the guide is undoubtedly the security management review (Appendix 7). It verifies that the company’s strategy and security issues are aligned, assesses the effectiveness of the security system, ensures that resources are sufficient, and sets priorities for the following year.
The DRSD's advice for passing this review reads like a lesson in governance:
This report shows that management has taken responsibility. For a project manager’s client, it’s also a sign of maturity that speaks volumes—far more so than a brochure.
The image of espionage as purely digital is misleading. The number of so-called “human” attacks (blackmail, fake job interviews, computer theft, attempts to poach employees) has continued to rise in recent years; they accounted for 36% of attacks in 2024, compared to 45% in 2023. This proportional decline does not mean that the threat is receding: other forms of attacks have increased more rapidly.
The modus operandi is well documented. It includes the careful targeting of experts during their business trips abroad and the targeted poaching of high-level engineers through front recruitment firms. The guide’s foreword describes the typical sequence: social engineering—particularly via social media—is used to identify and approach employees in strategic positions. This phase often precedes a physical intrusion aimed at stealing documents or media, or even sabotage.
This raises a question that few small and medium-sized businesses take seriously: your engineers are both your greatest asset and your most vulnerable point. The battle to recruit and retain them—which we analyze in our article on the war for talent and employer branding in the defense sector—therefore also has a security dimension. An engineer who is unmotivated, poorly integrated, or unable to identify a threat is easier to target.
The guide offers practical and inexpensive measures:
This is where the guide directly addresses issues of brand and influence. A defense SME must make itself known in order to exist: to the DGA, prime contractors, investors, and talent. But every public statement can also provide information to an adversary.
The DRSD does not call for silence. It calls for a systematic approach: guidelines for external communications, approval of content shared outside the institution, guidelines for trade shows, and vigilance on social media. It also publishes a “Trade Show Memo” to help teams prepare. This is no small matter: in 2026, the DRSD will support companies at the Eurosatory and Euronaval trade shows.
We examined this dilemma between visibility and confidentiality in our analysis of visibility within the DGA when working under a veil of secrecy. The conclusion applies to security as well: secrecy does not condemn us to silence; rather, it requires us to choose what we say.
| What You Can Show | What You Need to Protect |
|---|---|
| The existence of a general security policy (the guide permits sharing it in consultation with clients and service providers) | Details on the systems, schedules, protected areas, and known vulnerabilities |
| Your self-assessment process based on the DGA framework | Detailed results of audits and penetration tests |
| Training and raising awareness among your teams | The identity and specific roles of employees in sensitive positions |
| Your operational capacity and your verified references | Program plans, specifications, and technical data |
Reputational risk is also a security threat in its own right. The guide lists image and reputation among the assets to be protected and recommends reputation monitoring. OpexNews notes that reputation-based attacks now account for 11% of breaches against the BITD, citing attempts to discredit the Rafale after Operation Sindoor. For an SME, a single hostile campaign can jeopardize a fundraising effort or an export contract.
A manager does not make an investment without evidence of a return. The guide recognizes this and identifies three categories of indicators:
| Family | What it measures | Examples from the guide |
|---|---|---|
| Activity Tracking | The number of actions taken | Number of patrols, badges issued, employees trained, and false alarms |
| Performance (KPI) | The Effectiveness of the Measures | Percentage of staff trained annually, voluntary reports from employees, average time to resolve a case |
| Return on Investment (ROI) | Economic and Strategic Value | Cost of incidents prevented, number of sensitive bids that became accessible, contracts won where security was a deciding factor, revenue preserved after a disaster |
The third family is changing the way we talk about this in executive committee meetings. The day you can write, “Three consultations made possible by our compliance with the DGA framework,” security moves out of the cost column and into the growth drivers column.
One metric deserves special attention: the number of unsolicited reports from employees. The guide emphasizes that raising awareness encourages the reporting of early warning signs and helps thwart simple attacks. A team that reports issues is a team that understands what’s at stake.
Finally, every incident must lead to a structured RETEX— conducted not to assign blame but to understand the causes, as stated in the guide. This information is invaluable, provided it is put to use. As we show in our article on RETEX, a wasted business asset for SMEs in the BITD sector, accumulated experience that is neither formalized nor leveraged remains a dormant resource.
A well-researched article must also address controversial topics. Here are five nuances that the guide and the sources consulted require us to keep in mind.
1. Existing standards are designed for large corporations. The DRSD itself acknowledges this: the numerous standards (ISO 22340, ISO 22342, ISO 31000, AFNOR SPEC 2404) and CNPP guidelines are better suited to large companies and difficult to implement in a small organization. The guide is not a certification. It is a starting point.
2. Statistics should be interpreted with caution. As the parliamentary report states, these figures must be interpreted with caution, even though the number of reported incidents nearly doubled in 2024 compared to previous years. An increase in reports may also reflect, in part, heightened vigilance. This is our interpretation, not a claim made by the sources. Furthermore, the sources do not always agree on the distribution of physical assaults across different years.
3. This guide excludes specific regulatory frameworks. It does not address the protection of national defense secrets (PSDN), the protection of scientific and technical capabilities (PPST), or the security of activities of vital importance (SAIV). If these apply to you, these frameworks are in addition to the foundation described here.
4. Hiring an outside service provider creates a risk in and of itself. The DRSD emphasizes that an external audit grants a third party access to sensitive information. It recommends a rigorous selection process (references, independence from suppliers and competitors), a confidentiality agreement, the principle of least privilege, and the destruction of data at the end of the engagement. The same precautions apply to any external support, including that provided by a consulting firm.
5. The sovereignty of the tools matters. The guide recommends prioritizing European brands for video surveillance, European data transfer platforms, and—depending on your competitors’ extraterritorial laws—a French or European hosting provider for your strategic information. This recommendation comes at a cost, which you must weigh with full knowledge of the facts.
Let’s summarize. Security breaches targeting the BITD remain at a high level and primarily affect SMEs and subcontractors. Contracting authorities and the DGA are formalizing their security and cybersecurity requirements in contracts. Executives bear legal responsibility that they cannot fully delegate. In response, the DRSD 2026 guide proposes a step-by-step approach: 15 initial actions, a PDCA cycle, and metrics capable of demonstrating a return on investment.
But the guide also says something else, between the lines: success depends first and foremost on leadership, long before cameras or locks. The first of the principles set forth by the DRSD is security integrated into strategy. The second is a clear commitment from management, which is essential for its legitimacy, funding, and effectiveness. Without a shared vision, clearly defined roles, and decision-making processes such as management reviews, even the best equipment remains nothing more than a one-off expense.
That is precisely where The Governance Framework from Autour de l’Image. Security technology is the domain of specialized experts. Our role comes earlier in the process: to help you clarify your vision, define who makes decisions and who takes action, align security requirements with your business strategy, and establish management practices that transform compliance—which is often seen as a burden—into a demonstration of credibility to your clients. A security policy is useless if it is not championed, understood, and embodied by senior management.
Do you want to turn your governance into a source of trust rather than a blind spot? Talk to our consultants about structuring your strategic management.
