SecNumCloud (French sovereign cloud qualification)
A qualification granted by the French national cybersecurity agency to cloud offerings meeting high technical requirements and immunity from extraterritorial laws, where the hosting choice becomes a political risk question.
SecNumCloud is a set of requirements published by the French national cybersecurity agency, compliance with which entitles cloud providers to a qualification. Its requirements are first technical and organizational: encryption, isolation, access management, logging, physical security, continuity. Its 2022 revision added criteria protecting against extraterritorial laws: the provider must have its headquarters and data in the European Union, and no non-European shareholder may hold a stake enabling it to control the provider, so that data cannot be claimed by a foreign authority. French state doctrine has required since 2021 the use of qualified cloud for the administration's sensitive data, and some sectors, such as health, draw on it. The qualification shows how an IT security question becomes a sovereignty question: the feared risk is another state's law as much as attack. For insurance, it offers a readable criterion of a host's security, and it is a reminder that concentration of data with a few global providers is also a political exposure.
A government body migrating sensitive data to the cloud must, under the “cloud at the center” doctrine the French state set in July 2021, choose a SecNumCloud-qualified offering. An offering from a large global provider, even hosted in France, does not qualify if the operating company remains controlled by a shareholder subject to a law allowing a foreign authority to demand access to the data.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.