- SecNumCloud is first and foremost a TECHNICAL qualification from ANSSI: it imposes stringent security rules on a cloud service (encryption, tenant isolation, controlled operations, logging, audit by a PASSI).
- Version 3.2 (2022) adds legal requirements (European capital control, contractual immunity from extraterritorial laws) - but these are contractual clauses, not a neutralisation of US law itself.
- It is required for sensitive data of the State and of Operators of Vital Importance, and is becoming a reference standard for the public sector and several regulated industries.
- Caution: a technical qualification has no power over the legal dimension. It does not neutralise FISA 702 or the CLOUD Act as soon as an offer relies on a US software stack (potentially the case for Bleu and S3NS). SecNumCloud should therefore not be presented as a guarantee of legal sovereignty.
What is SecNumCloud?
SecNumCloud is a qualification awarded by the French National Cybersecurity Agency (ANSSI) to cloud computing service providers. It stems from a framework first published in 2016 and revised in 2022 (version 3.2).
The qualification combines three dimensions: high-level technical security, compliance with national requirements for the protection of sensitive information, and legal safeguards to limit exposure to extraterritorial laws. Version 3.2 marked a turning point by explicitly formalising these latter requirements, in contrast with a purely technical approach.
SecNumCloud targets IaaS, PaaS and SaaS services that host sensitive data, but is not intended to cover classified defence data, which falls under other schemes.
Seven families of requirements
Technical requirements
Encryption of data at rest and in transit, key management, strong tenant separation, auditable security logs, tested business continuity and recovery plan.
Organisational requirements
Security policy, access rights management, incident process, internal and external audits, control of subcontractors. The scope covers the entire life cycle.
Operational requirements
Operation, monitoring and management of the service carried out from the European Union, continuously (24/7). Security monitoring (SOC), incident management, business continuity and recovery plan tested regularly. No routine administration from a third country.
Legal requirements
The provider and its parent companies must be established in an EU Member State. Immunity from extraterritorial laws must be documented and contractually guaranteed.
Data location
Data, metadata, logs and keys reside within the territory of the European Union. No administration or routine operations may be carried out from a third country.
Personnel
Administrators with privileged access must be EU nationals and subject to a documented suitability check.
Independent audit
The qualification is awarded after an audit carried out by a certified Information Systems Security Audit Provider (PASSI), first on documents and then on site.
From 2016 to today
- 2016ANSSI publishes the first SecNumCloud framework, derived from the SecNumCloud SaaS framework and inspired by NIST’s Cloud Computing Security Reference Architecture.
- 2018Version 3.1 of the framework, extended to new service models.
- May 2021The Interministerial Digital Directorate (DINUM) announces the “cloud au centre” doctrine, which makes SecNumCloud mandatory for the State’s most sensitive data.
- March 2022Publication of version 3.2 of the framework, which adds explicit requirements for immunity from extraterritorial laws and European capital control.
- 2023-2025First qualifications awarded on the extended IaaS-PaaS scope. The Bleu (Capgemini + Orange with Microsoft) and S3NS (Thales with Google) partnerships are announced on this basis.
Effects on the market and on organisations
Five trends observed in public procurement policies and architecture choices since 2022.
“Cloud au centre” doctrine
Central government departments and public operators must justify choosing a service that is not SecNumCloud-qualified to host sensitive data. The qualification becomes a de facto criterion in public procurement.
Regulated industries
Health, defence, energy, finance: several sectors now include SecNumCloud in their specifications, alongside existing sector qualifications (HDS, PCI DSS).
A European standard in the making
The future European Cybersecurity Certification Scheme for Cloud Services (EUCS), under discussion at ENISA, is expected to draw partly on the SecNumCloud approach for the High level.
Market effect
Three qualified providers as of May 2026, several more in progress. Supply remains limited but is widening, notably through Franco-American partnerships that aim to combine technological richness with sovereignty requirements.
Cost and complexity
Obtaining the qualification requires substantial resources. For the end customer, choosing a SecNumCloud offer can mean an additional cost of 10 to 30 per cent compared with an equivalent non-qualified public service.
A technical qualification, not a legal shield
SecNumCloud imposes stringent security rules, and that is its real value. But it is a technical and organisational qualification: it has no power over the legal dimension. FISA 702 and the CLOUD Act are US laws; no ANSSI qualification can repeal them.
Yet FISA 702 applies as soon as a provider depends on a US orchestration stack - hypervisor, control plane, managed services, telemetry or update chain supplied by Google, AWS or Microsoft. Locating data in France and obtaining the qualification does not remove this software dependency.
The core of these platforms is closed: ANSSI cannot audit the source code of Google, AWS or Microsoft, which is not disclosed. A qualification covers an observable architecture and processes, not the binary actually executed nor what a remote update might introduce into it.
That is why Bleu (Microsoft + Orange + Capgemini) and S3NS (Google + Thales) are not immune: as long as they embed non-auditable code from the US vendor, nothing guarantees the absence of a dormant component or an update channel through which US authorities could compel the vendor to impose a backdoor - at any operator, whatever the French joint venture. SecNumCloud remains an excellent security baseline, but should not be presented as a guarantee of legal sovereignty.
Diagram: technical qualification (covered) vs US law (out of reach)
Covered - technical & operational
- Technical security: encryption at rest and in transit, key management, strong tenant isolation.
- Operation & monitoring from the EU, continuously (SOC, incident management, tested BCP/DRP).
- Administration staff who are EU nationals and security-cleared; no operations from a third country.
- Independent audit (PASSI) of the architecture, processes and configurations.
Out of reach - legal
- Repealing or neutralising FISA 702 / the CLOUD Act: these are US laws.
- Auditing the closed source code of Google, AWS or Microsoft - it is not disclosed.
- Detecting a dormant component hidden in this non-auditable code.
- Preventing a backdoor imposed on the vendor and propagated through an update.
Diagram: the path that triggers FISA 702 (beyond location)
- Data hosted in France. Geolocation alone seems reassuring.
- But a US orchestration stack. Hypervisor, control plane, managed services, updates: Google, AWS or Microsoft.
- Vendor subject to US law. The software stack supplier has a connection to the United States.
- FISA 702 & CLOUD Act apply. US law prevails over the contract and the location of the servers.
- Closed code, not auditable by ANSSI. ANSSI audits an architecture and processes, not the vendor’s binary.
- A backdoor can be imposed. Nothing guarantees the absence of a dormant component or a remotely activatable update channel.
Six questions to help you decide
What is the SecNumCloud qualification?
It is a qualification awarded by ANSSI to cloud service providers. It certifies that a service meets enhanced requirements for security, data location and immunity from extraterritorial laws. The current version of the framework is 3.2 (March 2022).
Which providers are SecNumCloud-qualified?
Three providers are currently qualified on the IaaS-PaaS scope: 3DS OUTSCALE, OVHcloud (dedicated offer) and Worldline. Other players are preparing their applications, notably Bleu (Capgemini-Orange) and S3NS (Thales-Google).
Is SecNumCloud mandatory?
For the French State, yes: the “cloud au centre” doctrine makes the qualification mandatory for hosting sensitive data. For the private sector, it is not mandatory but is becoming de facto required in several regulated industries (defence, health, finance).
How long does a qualification take?
Generally allow 12 to 24 months between commitment and award, depending on the provider’s initial maturity and the intended scope. The audit phase by a PASSI lasts several months and includes tests first on documents and then on site.
How does it differ from EUCS?
SecNumCloud is French (ANSSI). EUCS is European (ENISA) and still being finalised. Both schemes share a tiered structure and a requirements-based approach. The EUCS High level is expected to draw on SecNumCloud for sovereignty requirements.
How much does a SecNumCloud offer cost the end customer?
The qualification effort represents a significant cost for the provider, passed on in its prices. Typical additional cost of 10 to 30 per cent compared with an equivalent non-qualified public service, varying with scope and commitment period.
Further reading
- SecNumCloud framework v3.2, ANSSI (cyber.gouv.fr)
- Official list of SecNumCloud-qualified providers (cyber.gouv.fr)
- “Cloud au centre” doctrine, DINUM (numerique.gouv.fr)
- Circular of 5 July 2021 on the doctrine for the State’s use of cloud computing
- ENISA, European Cybersecurity Certification Scheme for Cloud Services (EUCS) draft