--- id: CP-383 slug: anssi-qualifications-secnumcloud-passi-pris-pdis lang: en title: ANSSI qualifications for cloud and security providers description: What ANSSI qualifications (SecNumCloud, PASSI, PRIS, PDIS) are for, and what they change for employees and for management. canonical_url: https://startbrain.io/cyberpedia/en/articles/anssi-qualifications-secnumcloud-passi-pris-pdis/ markdown_url: https://startbrain.io/cyberpedia/en/articles/anssi-qualifications-secnumcloud-passi-pris-pdis.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "ANSSI qualifications for cloud and security providers", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/anssi-qualifications-secnumcloud-passi-pris-pdis/ (CC BY 4.0) wing: 6 theme: safeguard_data reflex: cr-038 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/anssi-qualifications-secnumcloud-passi-pris-pdis/ fr: https://startbrain.io/cyberpedia/fr/articles/qualifications-anssi-secnumcloud-passi-pris-pdis/ de: https://startbrain.io/cyberpedia/de/articles/anssi-qualifikationen-secnumcloud-passi-pris-pdis/ es: https://startbrain.io/cyberpedia/es/articles/cualificaciones-anssi-secnumcloud-passi-pris-pdis/ sources: - "n": 1 title: "Cybersécurité : comment trouver un professionnel qualifié ?" publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/actualites/cybersecurite-comment-trouver-un-professionnel-qualifie published: "2021-12-14" accessed: "2026-11-03" - "n": 2 title: "Avis n° 149 (2018-2019), tome IX : Direction de l'action du gouvernement, coordination du travail gouvernemental" publisher: Senate (France) url: https://www.senat.fr/rap/a18-149-9/a18-149-91.pdf published: "2018-11-22" accessed: "2026-11-03" - "n": 3 title: Trust service providers in France publisher: ENISA url: https://www.enisa.europa.eu/sites/default/files/all_files/Cyberdefence%20trusted%20service%20providers%20in%20France.pdf published: "2015-03-31" accessed: "2026-11-03" - "n": 4 title: "L'urgence d'agir pour éviter la sortie de route : Piloter la commande publique au service de la souveraineté économique - Rapport - Sénat" publisher: Senate (France) url: https://www.senat.fr/rap/r24-830-1/r24-830-115.html accessed: "2026-11-03" - "n": 5 title: Question écrite n° 10401 publisher: National Assembly (France) url: https://www.assemblee-nationale.fr/dyn/17/questions/QANR5L17QE10401 published: "2025-12-30" accessed: "2026-11-03" --- # ANSSI qualifications for cloud and security providers When a company entrusts its security audit, network monitoring or data hosting to a provider, it can rely on the vendor's word or on an official label. For this purpose, ANSSI, the French national authority for information systems security, issues qualifications that identify the services judged reliable after an evaluation process [1]. For an employee, these acronyms mostly turn up in choices made by management, purchasing or the IT department. Knowing what they mean helps explain why some data goes only to certain hosting providers. ## In 30 seconds - Where it happens: when choosing an audit, detection, incident response or cloud hosting provider, especially for government bodies, OIVs and OSEs [1]. - What it guarantees: a provider evaluated against an ANSSI standard. The qualification carries the weight of a recommendation [2]. - The reflex: before entrusting sensitive data to a cloud service, ask the IT department whether it is SecNumCloud-qualified and check the catalogue published by ANSSI [1]. - If it is already done: report to the IT department or purchasing any unapproved tool used for sensitive data, without moving the data yourself. ## Straight answers ### What do SecNumCloud, PASSI, PRIS and PDIS mean? They are provider qualifications. PASSI designates providers of information systems security audits, PRIS those of security incident response, PDIS those of security incident detection. SecNumCloud covers cloud computing providers [1]. ### Who issues these qualifications? ANSSI, after an evaluation process. A 2015 ENISA document describes evaluation bodies accredited by COFRAC and approved by ANSSI [3]. ### Is a qualification the same thing as an ExpertCyber label? No. The ExpertCyber label was developed by Cybermalveillance.gouv.fr with professional associations, France Assureurs and the support of AFNOR. It is open to any professional entity, except OIVs and OSEs, which are covered by other State schemes [1]. ANSSI qualifications target OIVs, OSEs, companies subject to the eIDAS regulation and government bodies [1]. ### What does SecNumCloud change for my data? The standard aims to guarantee the security of the most sensitive data hosted in the cloud against cyber threats and extraterritorial laws [4]. For the State, using a SecNumCloud-qualified offer is presented as ensuring the confidentiality, integrity and availability of data [5]. ### Must all of a company's cloud tools be qualified? The sources cited here do not say so for companies in general. The "cloud at the centre" doctrine covers the State's hosting of data of particular sensitivity [4]. ## What it changes for employees Employees do not choose providers, but they see the effects in the tools they are asked to use. Cybermalveillance.gouv.fr points out that some audiences must meet obligations when choosing their cybersecurity providers, services and solutions, notably when they handle sensitive information [1]. In daily practice, this comes down to three actions. Use the tools approved by the IT department. Ask before transferring sensitive data to an unapproved online service. Notify the IT department without delay if an incident occurs. ## What it changes for management Management chooses the providers, and the qualification gives it a benchmark. Cybermalveillance.gouv.fr states that, to obtain a qualified or certified service, one can contact the provider of one's choice directly in the lists published by ANSSI [1]. The catalogue of qualified products and services is published online [1]. The choice has a price and a timeline. According to a Senate report, SecNumCloud-qualified offers would cost 15% to 25% more than the others, according to an official heard by the committee [4]. For the providers themselves, ANSSI puts the minimum costs of the mandatory external audits and of the evaluation at around 200,000 euros over the three years of the qualification [4]. The same report gives an average processing time of 18 to 24 months and a success rate of 65% [4]. The same report notes that the qualified offer remains limited. A lawyer interviewed there speaks of a "very limited panel of SecNumCloud hosting offers" [4]. ## What the text says Qualifications rest on ANSSI standards. Decree No. 2015-350 specifies the conditions for awarding qualification to security products and trust service providers for the needs of national security [2]. The SecNumCloud standard addresses cloud operators providing PaaS, IaaS or SaaS services. It includes technical, operational and legal rules [4]. The evaluation checks technical resilience (partitioning of information systems), organisational resilience (the qualified provider must be the only one able to act on the resources supporting the service) and legal resilience (protection against foreign law) [4]. Version 3.2 includes requirements for immunity from non-European law [4]. For audit services, the 2015 ENISA document lists the scopes of evaluation: architecture, configuration and source code audits, penetration testing, and physical and organisational audits [3]. For detection, it cites the management of events, incidents and alerts [3]. For incident response, it cites four profiles: response manager, system analyst, network analyst, malware analyst [3]. ## Where implementation stands Entry-into-force dates differ by service. A Senate opinion dated November 2018 states that qualification has existed for audit providers (PASSI) since 2013, for the cloud (SecNumCloud) since 2016, and for incident response (PRIS) and detection (PDIS) since 2017 [2]. During 2017, ANSSI awarded 25 product qualifications and 78 service provider qualifications [2]. In 2015, the PDIS, PRIS and cloud standards were still only versions published for comment [3]. On the cloud, the interministerial circular of 5 July 2021 provides for the use of SecNumCloud offers, taken up in the SREN law of 21 May 2024, according to the ministerial reply published on 30 December 2025 [5]. The same reply asserts that it is essential for government bodies and State operators to rely on these offers for their particularly sensitive data hosted on a commercial cloud [5]. The Senate report states for its part that about fifteen offers are qualified and about a dozen are being qualified, backed by 19 companies [4]. It also notes that hybrid offers such as Bleu and S3NS have entered the qualification process without being qualified at the date of ANSSI's reply [4]. At European level, the same ministerial reply indicates that several draft regulations, including the revision of the Cybersecurity Act and the Cloud and AI Act, "should make it possible to move forward on setting up a harmonised European scheme" in the face of non-European extraterritorial laws [5]. These texts are described as under preparation: they do not yet apply according to this source. ## Sources 1. Cybermalveillance.gouv.fr, "Cybersécurité : comment trouver un professionnel qualifié ?", 14 December 2021. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/actualites/cybersecurite-comment-trouver-un-professionnel-qualifie (accessed 3 November 2026) 2. Senate (France), "Avis n° 149 (2018-2019), tome IX : Direction de l'action du gouvernement, coordination du travail gouvernemental", 22 November 2018. https://www.senat.fr/rap/a18-149-9/a18-149-91.pdf (accessed 3 November 2026) 3. ENISA, "Trust service providers in France", 31 March 2015. https://www.enisa.europa.eu/sites/default/files/all_files/Cyberdefence%20trusted%20service%20providers%20in%20France.pdf (accessed 3 November 2026) 4. Senate (France), "L'urgence d'agir pour éviter la sortie de route : Piloter la commande publique au service de la souveraineté économique - Rapport - Sénat". https://www.senat.fr/rap/r24-830-1/r24-830-115.html (accessed 3 November 2026) 5. National Assembly (France), "Question écrite n° 10401", 30 December 2025. https://www.assemblee-nationale.fr/dyn/17/questions/QANR5L17QE10401 (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/anssi-qualifications-secnumcloud-passi-pris-pdis/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.