SecNumCloud

SecNumCloud is the requirements framework published by ANSSI (the French National Cybersecurity Agency) to qualify cloud computing offerings able to host sensitive French data. Current version is 3.2. In practice it is mandatory for Operators of Vital Importance (OIV), Operators of Essential Services (OSE), central government, and increasingly for health and defense data. Qualified French providers today: OVHcloud, 3DS Outscale, Cloud Temple, NumSpot — a limited but growing market. Qualification covers the full chain: datacenters certified in France, EU-based operations teams, European legal governance, contractual isolation from the US Cloud Act (extraterritoriality). SecNumCloud is stricter than ISO 27001 on legal sovereignty: ISO 27001 validates the information security management system, SecNumCloud additionally enforces protection against extraterritorial laws (Cloud Act, CLOUD Act, FISA 702). For companies migrating from AWS / Azure / GCP, the cost and technical complexity of switching are real: rewriting managed services, losing some serverless features, but regulatory alignment becomes essential as soon as sensitive public or OIV/OSE data is involved.