SecNumCloud v3.2
France's national cloud security qualification scheme, administered by ANSSI. The strictest sovereign cloud standard in Europe — model for EUCS High — requiring full French legal and operational independence.
2
Qualification Levels
Standard · Renforcé
France
Jurisdiction
Metropolitan territory
PASSI
Auditor Requirement
ANSSI-licensed
ANSSI
Legal Basis
National cyber authority
What is SecNumCloud?
SecNumCloud is the French national cloud security qualification framework, issued and administered by ANSSI (Agence Nationale de la Sécurité des Systèmes d'Information). It defines mandatory technical, operational, and legal requirements for cloud service providers wishing to serve French public sector and critical infrastructure organisations.
Unlike EUCS, SecNumCloud's Enhanced (Renforcé) level imposes strict legal sovereignty requirements: the CSP must be incorporated under French law with no controlling foreign shareholder that could be subject to non-EU government access laws (e.g., US CLOUD Act, FISA 702). This makes it one of the most demanding sovereign cloud standards globally.
SecNumCloud directly influenced the design of EUCS High. Operators such as Thales S3NS (Google Cloud under French sovereignty) and Bleu (Microsoft Azure under French sovereignty) were specifically created to pursue SecNumCloud qualification.
Qualification Levels
Baseline qualification for commercial services. Covers fundamental security hygiene, data residency, and access management.
- Data hosted exclusively on French territory
- Encryption at rest and in transit (AES-256 / TLS 1.2+)
- Documented incident response and breach notification
- Supplier security assessment for subprocessors
Required for sensitive government data, critical infrastructure, and classified workloads (Diffusion Restreinte). Highest commercial qualification tier.
- French-incorporated CSP — no foreign parent company control
- HYOK with HSM physically located in France
- French-national personnel only for all privileged access roles
- CSP cannot transfer data under foreign government order (legal immunity)
- Air-gapped or sovereign private cloud architecture for classified use cases
- ANSSI-certified security products for cryptographic operations
- On-site audit by ANSSI-licensed third-party auditor (PASSI)
- WORM audit logs with no modification capability by CSP personnel
SecNumCloud — Control Mapping
How this platform's sovereignty pillar model maps to SecNumCloud Enhanced (Renforcé) requirements.
Data Sovereignty
SecNumCloud §19 – Localisation des données- All data stored and processed within Metropolitan France
- Cryptographic residency controls verifiable by customer
- Cross-border transfer prohibited without explicit written authorisation
- ANSSI-validated encryption for all data at rest (AES-256)
Operational Sovereignty
SecNumCloud §18 – Personnel et sous-traitants- Privileged operations performed by French-national personnel only
- Subcontractors subject to equivalent qualification requirements
- Customer-controlled access approval for all CSP support interventions
- Sovereign SOC with French-cleared staff for 24/7 monitoring
Technological Sovereignty
SecNumCloud §22 – Réversibilité- Documented reversibility plan (réversibilité) with tested procedures
- Open standards and interoperable formats — no proprietary lock-in
- Infrastructure operated independently of foreign parent entities
- IaC and orchestration tooling under customer control
Legal Sovereignty
SecNumCloud §17 – Droit applicable- CSP and all subprocessors subject exclusively to French/EU law
- Contractual immunity from US CLOUD Act and FISA 702
- No foreign shareholder with ability to compel data disclosure
- Transparency reporting for all government access requests
Identity Sovereignty
SecNumCloud §20 – Contrôle des accès- Customer-owned IdP decoupled from CSP platform identity
- JIT privileged access — zero standing privileges for CSP personnel
- FIDO2 or smartcard MFA for all administrative roles
- Identity and access logs retained on French territory under customer control
SecNumCloud Timeline
ANSSI publishes first SecNumCloud reference framework for cloud qualification
SecNumCloud v3.1 released — adds detailed operational sovereignty requirements
SecNumCloud v3.2 published — strengthens legal sovereignty (CLOUD Act immunity) and subprocessor controls
French government mandates SecNumCloud for all sensitive public sector cloud procurement
EUCS negotiations reference SecNumCloud High as a model for EUCS High assurance level
Bleu (Microsoft FR) and S3NS (Thales/Google) pursue SecNumCloud qualification
Disclaimer
Assessments produced by this platform are self-attested evaluations and do not constitute official SecNumCloud qualification. Organisations seeking qualification must engage an ANSSI-licensed PASSI auditor and complete the full ANSSI review process. Control descriptions are based on publicly available SecNumCloud v3.2 documentation.
Ready to assess your SecNumCloud posture?
Run a full sovereignty assessment aligned to SecNumCloud Enhanced requirements.