France SecNumCloud — ANSSI Cloud Security Certification
- ClassificationCategoryCloud SecurityDomainCloud SecurityFramework FamilyOther
- Regulatory ContextTypeCertification / Assurance ProgramLegal InstrumentStandardSectorTechnology SectorIndustryCloud & Technology Providers
- Region / PublisherRegionEuropeRegion DetailFrancePublisherAgence nationale de la sécurité des systèmes d'information (ANSSI)
- VersioningVersionRéférentiel d'exigences v3.2 (8 March 2022)Effective DateMarch 8, 2022 (v3.2); first applicable version 3.0 on December 8, 2016Issue DateMarch 8, 2022
- AdoptionAdoption ModelCertificationImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The référentiel d'exigences v3.2 and its English requirements baseline are published by ANSSI on cyber.gouv.fr; qualification assessments are paid services from licensed evaluation centers.
Framework text is licensed by its publisher and is included only where stated above.
- SecNumCloud is ANSSI's qualification for cloud providers whose offers meet its référentiel d'exigences, version 3.2 of March 8, 2022.
- It is voluntary for providers but is the level the French State recommends for hosting sensitive data, with an ANSSI security visa.
- Version 3.2 added protections against non-European law: EU establishment, caps on non-EU shareholdings, and no non-EU technical access to customer data.
- The référentiel reuses the ISO/IEC 27001 Annex A structure in chapters 5 to 18 and adds chapter 19 on localization and extra-European law.
- A qualification is valid for three years, with annual surveillance audits, and can be renewed.
Overview
SecNumCloud is the ANSSI qualification for cloud service providers (IaaS, CaaS, PaaS and SaaS) whose offers meet the agency's requirements baseline, Prestataires de services d'informatique en nuage – référentiel d'exigences, version 3.2 of 8 March 2022. It is voluntary for providers, but it is the level the French State recommends for hosting sensitive data and processing, and qualified offers carry an ANSSI security visa.
ANSSI created the référentiel in 2016 (version 3.0 of 8 December 2016 was the first applicable version). Version 3.2 added the criteria that protect customers against non-European law: a provider established in the European Union, caps on non-EU shareholdings, and no technical ability for non-EU third parties to reach customer data (chapter 19.6). A qualification is valid for three years, is followed by annual surveillance audits and can be renewed.
The référentiel reuses the structure of ISO/IEC 27001 Annex A in chapters 5 to 18 and adds chapter 19 with service agreement, data localization, regionalization, end-of-contract, personal data and extra-European law requirements. A provider must meet every requirement on the scope it chooses (chapter 3.2); recommendations are optional.
Why does it matter?
SecNumCloud is how a French public body or regulated company tells a trustworthy cloud from the rest. ANSSI's 2024 recommendations on hosting sensitive information systems in the cloud, which follow the State's 2021 cloud doctrine (circular 6282-SG of 5 July 2021), point to SecNumCloud-qualified offers for defined use cases, and the HDS health-data référentiel accepts a SecNumCloud 3.2 qualification as proof that no third-country law imposes access. For providers, qualification is the ticket to those customers.
Key benefits include:
- Resistance to extraterritorial law
Chapter 19.6 requires an EU head office and central administration, non-EU holdings of no more than 24 percent individually and 39 percent collectively, and no non-EU veto or board majority.
- A defined threat model
ANSSI states the qualification is designed to resist isolated or hacktivist threats, capable cybercriminals and injunctions based on extraterritorial law, and to protect sensitive data.
- Hygiene at the reinforced level
Requirement 5.1 b) obliges the provider to apply the ANSSI IT hygiene guide at its reinforced level to the service's information system.
- Continuous assurance
Qualification lasts three years with annual surveillance audits, and version 3.2 introduced penetration testing throughout the qualification lifecycle.
- Transparent scope
A provider is qualified only for the activities and scope assessed (chapter 3.2) and cannot claim the qualification for services outside it.
How does it work?
Chapter 2 defines the four activities a provider can qualify: SaaS, PaaS, CaaS and IaaS. Chapter 3 sets the modalities: ANSSI qualifies the provider under its trusted service provider qualification process, assessment is carried out by the evaluation centers ANSSI lists for SecNumCloud, and every requirement on the chosen scope must be met. Chapter 4 fixes the security level: storage and processing of data for which an incident would have significant consequences for the customer, without attesting conformity to the State information system security policy (PSSIE). Data under specific legal regimes, such as Diffusion Restreinte or health data, needs extra requirements set through a homologation and risk assessment (chapter 3.3.2).
Chapters 5 to 18 carry the ISO/IEC 27001 Annex A structure with SecNumCloud-specific wording: security policy and risk assessment (5), organization (6), human resources (7), asset management (8), access control and identity management (9), cryptology (10), physical and environmental security (11), operations security including controlled software installation (12.10), communications security (13), and continuity (17) with an annual plan review (17.1). Chapter 18 covers compliance reviews, including review of major changes (18.2.3) and technical conformity checks (18.4).
Chapter 19 holds the requirements that make the qualification distinctive: a service agreement (19.1), data localization (19.2), regionalization (19.3), end of contract and reversibility (19.4), personal data protection (19.5) and protection against extra-European law (19.6), under which the provider must notify the customer within one month of any legal, organizational or technical change affecting that chapter. Version 3.2 modified chapters 1.3.1, 3.2, 3.3.2, 4, 5.3, 6.1, 7.1, 7.2, 8.1, 9.1, 9.5, 9.7, 10.2, 11.2.1, 11.5, 12.10, 12.13, 12.14, 17.1, 18.2.3, 19.1 and 19.6.
Key Elements
- Qualification, not certification (chapter 3.1)
ANSSI attests conformity to the référentiel through its qualification process; qualified offers receive an ANSSI security visa and are listed in the agency's catalog.
- Four service types (chapter 2)
SaaS, PaaS, CaaS and IaaS, with the scope defined by all or part of these activities (chapter 3.2).
- Security level (chapter 4)
Suitable for data whose compromise would have significant consequences for the customer; reinforced-level IT hygiene (5.1 b)); regulated data needs complementary requirements.
- Extra-European law protection (chapter 19.6)
EU establishment, the 24 percent and 39 percent shareholding caps, no non-EU veto or board majority, no technical access by non-EU third parties, operating autonomy, one-month change notice.
- Localization and reversibility (19.2 to 19.4)
Data localization, regionalization and end-of-contract requirements that fix where data is held and how it is returned.
- Lifecycle assurance
Three-year qualification, annual surveillance audits, and penetration testing across the lifecycle since version 3.2.
What does it cover?
SecNumCloud applies to commercial cloud providers offering SaaS, PaaS, CaaS or IaaS who seek ANSSI qualification, and the référentiel also applies to classic shared external hosting (chapter 1.1.1). It is used by French administrations, operators and companies choosing a host for sensitive data under the State's 2021 cloud doctrine and ANSSI's hosting recommendations. The qualification covers the provider's service, not the security of the customer's own applications running on it, as ANSSI's FAQ makes explicit.
What are its objectives?
The référentiel sets the conditions for a cloud service to be recognized as trustworthy by the French State.
Qualify cloud providers whose services reach the ANSSI security level for sensitive data (chapter 4).
Keep customer data out of reach of non-European law through establishment, ownership and technical requirements (chapter 19.6).
Fix data localization, regionalization and reversibility in the service agreement (chapters 19.1 to 19.4).
Require ISO/IEC 27001-style controls at the reinforced hygiene level across chapters 5 to 18.
Maintain assurance through three-year qualification, annual surveillance and lifecycle penetration testing.
Framework in Context
SecNumCloud is France's national scheme while the European cloud certification scheme (EUCS) under the 2019 Cybersecurity Act is still unfinished; ANSSI has carried the SecNumCloud criteria into that work. The référentiel is built on ISO/IEC 27001, so providers usually hold the ISO certificate alongside the qualification. In health data hosting, HDS requirement 31 accepts a SecNumCloud 3.2 qualification as proof against third-country access; in Germany the BSI C5 attestation plays the assurance role for cloud customers, and C5:2026 is aligned with the EUCS Substantial level.
Common Framework Mappings
SecNumCloud reuses the ISO/IEC 27001 Annex A structure, so providers map its chapters to the cloud and privacy standards below to reuse evidence and to show customers outside France how the qualification compares.
Mapped frameworks include:
CSA CCM v4
CSA STAR
ISO 27001:2022
ISO 27002:2022
ISO 27017
ISO 27018
ISO 27701
SOC 2
How SmartSuite Supports France SecNumCloud
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to hold the SecNumCloud requirements of chapters 5 to 19 as controls with owners and evidence for the scope you are qualified for, and Third Party Risk Management to track the establishment, ownership and technical-access facts that chapter 19.6 requires of every third-party supplier and subcontractor.
Qualification Scope Record
Record the SaaS, PaaS, CaaS or IaaS services in scope, the evaluation center, the qualification date, the three-year expiry and each annual surveillance audit.
Requirement Library (chapters 5 to 19)
Hold each requirement with its chapter number, owner, implementation status, evidence links and the ISO/IEC 27001 Annex A control it shares.
Chapter 19.6 Ownership and Supplier Register
Track shareholdings, governance rights, the EU establishment facts and every supplier's ability to reach customer data, with the one-month customer notification log.
Risk Assessment Workflow
Run the chapter 5.3 risk assessment, record treatment decisions and approvals, and link residual risks to the service agreement.
Penetration Test and Compliance Review Tracker
Schedule lifecycle penetration tests, major change reviews (18.2.3) and technical conformity checks (18.4), with findings and closure.
Reversibility and Localization Evidence
Keep the data localization, regionalization and end-of-contract commitments of chapters 19.2 to 19.4 with the evidence that supports each customer contract.
Related frameworks
CSA STAR is the Cloud Security Alliance's public registry for cloud assurance: a CAIQ self-assessment at Level 1, an ISO/IEC 27001 or SOC 2 audit at Level 2, built on CCM v4.1.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
ISO/IEC 27017:2026 gives cloud security control guidance for customers and providers, built on ISO/IEC 27002:2022, with four cloud-specific controls; it replaced the 2015 edition.
ISO/IEC 27018:2025 gives guidelines for protecting PII in public clouds acting as PII processors, built on ISO/IEC 27002:2022 with an extended control set.
Frequently Asked Questions For France SecNumCloud (ANSSI Cloud Security Certification)
A qualification. ANSSI qualifies a provider under its trusted service provider process after assessment by a licensed evaluation center, and qualified offers receive an ANSSI security visa (chapter 3.1). The qualification is valid for three years, followed by annual surveillance audits, and can be renewed.
Chapter 2 covers four activities: SaaS, PaaS, CaaS and IaaS. The provider chooses its scope from these activities and must meet every requirement on that scope (chapter 3.2). Services outside the assessed scope cannot claim the qualification.
The provider's registered office, central administration and principal establishment must be in the European Union; non-EU entities may hold no more than 24 percent of capital or voting rights individually and 39 percent collectively, with no veto or board majority; non-EU suppliers must have no technical ability to reach customer or technical data; and the customer must be told within one month of any change affecting these conditions.
Not for providers in general. It is the level ANSSI recommends for hosting sensitive information systems in its 2024 recommendations under the State's 2021 cloud doctrine, and the HDS health-data référentiel accepts a SecNumCloud 3.2 qualification as proof against third-country access. Customers with regulated data still need complementary requirements set through a homologation (chapter 3.3.2).
The référentiel reuses the ISO/IEC 27001 Annex A structure and adds its own requirements, so providers usually hold both. ANSSI has carried the SecNumCloud criteria into the European cloud certification scheme (EUCS) under the 2019 Cybersecurity Act, which ANSSI states is not yet finalized.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.