{"id":16146,"date":"2026-09-17T10:43:14","date_gmt":"2026-09-17T08:43:14","guid":{"rendered":"https:\/\/blog.outscale.com\/?p=16146"},"modified":"2026-09-17T11:12:21","modified_gmt":"2026-09-17T09:12:21","slug":"secnumcloud-the-qualification-now-mandatory-for-the-states-sensitive-data-the-complete-guide-to-the-legal-framework-and-scope-of-application","status":"publish","type":"post","link":"https:\/\/blog.outscale.com\/en\/secnumcloud-the-qualification-now-mandatory-for-the-states-sensitive-data-the-complete-guide-to-the-legal-framework-and-scope-of-application\/","title":{"rendered":"SecNumCloud, the qualification now mandatory for the state’s sensitive data: the complete guide to the legal framework and scope of application"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Since 22 August 2026, the rules have changed for French government bodies that host their most sensitive data in the Cloud. An order published in the Official Journal approves the SecNumCloud<\/a> framework as the reference framework for meeting the security and protection requirements set out in the new regulatory framework.<\/p>

This legal shift, in preparation for several years, raises a very concrete question for government bodies, their operators, and the companies that work with them: who is affected, from when, and for exactly which data?<\/p>

This guide reviews the legal framework, the scope of the obligation, how SecNumCloud compares with other security frameworks, and the outlook for this digital sovereignty doctrine.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

What is SecNumCloud?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

SecNumCloud is the qualification framework for Cloud service providers, developed and issued by ANSSI<\/a> (Agence nationale de la s\u00e9curit\u00e9 des syst\u00e8mes d’information \u2014 France’s national cybersecurity agency). Created in 2016, it has gone through several revisions, with version 3.2 now the framework in force.<\/span><\/p>

One important point of vocabulary to clarify from the outset: SecNumCloud is a qualification, not a certification in the sense of ISO 27001 or HDS. An ANSSI qualification involves an assessment carried out by an accredited audit provider, on the basis of which the agency itself grants the recognition: a process that is more demanding and more tightly controlled than a certification issued by a standard accredited body.<\/span><\/p>

In concrete terms, SecNumCloud attests to a high level of technical and organizational security, but above all, it guarantees immunity from foreign extraterritorial legislation, first and foremost the US Cloud Act and FISA. It is this dimension of legal independence that sets SecNumCloud apart.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

The legal framework that made SecNumCloud mandatory<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Since when has SecNumCloud really been mandatory, rather than recommended? Are there any exemptions? Could an equivalent European certification be enough?<\/span><\/i><\/p>

These are the questions that come up most often on this topic. The answer lies in a precise timeline, built in three stages.<\/span><\/p>

The obligation did not appear out of nowhere: it is the culmination of a trajectory that began in 2021, with the government’s “Cloud at the center” (“Cloud au centre”) doctrine, which already recommended that government bodies use qualified offerings for certain sensitive data. Three texts then built, step by step, the current legal framework:<\/span><\/p>