Cyberpediaby Brain
ENDEFR

ANSSI qualifications for cloud and security providers

What ANSSI qualifications (SecNumCloud, PASSI, PRIS, PDIS) are for, and what they change for employees and for management.

In 30 seconds

Where it happens
When choosing an audit, detection, incident response or cloud hosting provider, especially for government bodies, OIVs and OSEs1.
What it guarantees
A provider evaluated against an ANSSI standard. The qualification carries the weight of a recommendation2.
The reflex
Before entrusting sensitive data to a cloud service, ask the IT department whether it is SecNumCloud-qualified and check the catalogue published by ANSSI1.
If it is already done
Report to the IT department or purchasing any unapproved tool used for sensitive data, without moving the data yourself.

What it is

When a company entrusts its security audit, network monitoring or data hosting to a provider, it can rely on the vendor's word or on an official label. For this purpose, ANSSI, the French national authority for information systems security, issues qualifications that identify the services judged reliable after an evaluation process1.

For an employee, these acronyms mostly turn up in choices made by management, purchasing or the IT department. Knowing what they mean helps explain why some data goes only to certain hosting providers.

Straight answers

What do SecNumCloud, PASSI, PRIS and PDIS mean?

They are provider qualifications. PASSI designates providers of information systems security audits, PRIS those of security incident response, PDIS those of security incident detection. SecNumCloud covers cloud computing providers1.

Who issues these qualifications?

ANSSI, after an evaluation process. A 2015 ENISA document describes evaluation bodies accredited by COFRAC and approved by ANSSI3.

Is a qualification the same thing as an ExpertCyber label?

No. The ExpertCyber label was developed by Cybermalveillance.gouv.fr with professional associations, France Assureurs and the support of AFNOR. It is open to any professional entity, except OIVs and OSEs, which are covered by other State schemes1. ANSSI qualifications target OIVs, OSEs, companies subject to the eIDAS regulation and government bodies1.

What does SecNumCloud change for my data?

The standard aims to guarantee the security of the most sensitive data hosted in the cloud against cyber threats and extraterritorial laws4. For the State, using a SecNumCloud-qualified offer is presented as ensuring the confidentiality, integrity and availability of data5.

Must all of a company's cloud tools be qualified?

The sources cited here do not say so for companies in general. The "cloud at the centre" doctrine covers the State's hosting of data of particular sensitivity4.

1What it changes for employees1 min

Employees do not choose providers, but they see the effects in the tools they are asked to use. Cybermalveillance.gouv.fr points out that some audiences must meet obligations when choosing their cybersecurity providers, services and solutions, notably when they handle sensitive information1.

In daily practice, this comes down to three actions. Use the tools approved by the IT department. Ask before transferring sensitive data to an unapproved online service. Notify the IT department without delay if an incident occurs.

2What it changes for managementManagement1 min

Management chooses the providers, and the qualification gives it a benchmark. Cybermalveillance.gouv.fr states that, to obtain a qualified or certified service, one can contact the provider of one's choice directly in the lists published by ANSSI1. The catalogue of qualified products and services is published online1.

The choice has a price and a timeline. According to a Senate report, SecNumCloud-qualified offers would cost 15% to 25% more than the others, according to an official heard by the committee4. For the providers themselves, ANSSI puts the minimum costs of the mandatory external audits and of the evaluation at around 200,000 euros over the three years of the qualification4. The same report gives an average processing time of 18 to 24 months and a success rate of 65%4.

The same report notes that the qualified offer remains limited. A lawyer interviewed there speaks of a "very limited panel of SecNumCloud hosting offers"4.

3What the text saysOfficial text1 min

Qualifications rest on ANSSI standards. Decree No. 2015-350 specifies the conditions for awarding qualification to security products and trust service providers for the needs of national security2.

The SecNumCloud standard addresses cloud operators providing PaaS, IaaS or SaaS services. It includes technical, operational and legal rules4. The evaluation checks technical resilience (partitioning of information systems), organisational resilience (the qualified provider must be the only one able to act on the resources supporting the service) and legal resilience (protection against foreign law)4. Version 3.2 includes requirements for immunity from non-European law4.

For audit services, the 2015 ENISA document lists the scopes of evaluation: architecture, configuration and source code audits, penetration testing, and physical and organisational audits3. For detection, it cites the management of events, incidents and alerts3. For incident response, it cites four profiles: response manager, system analyst, network analyst, malware analyst3.

4Where implementation stands2 min

Entry-into-force dates differ by service. A Senate opinion dated November 2018 states that qualification has existed for audit providers (PASSI) since 2013, for the cloud (SecNumCloud) since 2016, and for incident response (PRIS) and detection (PDIS) since 20172. During 2017, ANSSI awarded 25 product qualifications and 78 service provider qualifications2. In 2015, the PDIS, PRIS and cloud standards were still only versions published for comment3.

On the cloud, the interministerial circular of 5 July 2021 provides for the use of SecNumCloud offers, taken up in the SREN law of 21 May 2024, according to the ministerial reply published on 30 December 20255. The same reply asserts that it is essential for government bodies and State operators to rely on these offers for their particularly sensitive data hosted on a commercial cloud5. The Senate report states for its part that about fifteen offers are qualified and about a dozen are being qualified, backed by 19 companies4. It also notes that hybrid offers such as Bleu and S3NS have entered the qualification process without being qualified at the date of ANSSI's reply4.

At European level, the same ministerial reply indicates that several draft regulations, including the revision of the Cybersecurity Act and the Cloud and AI Act, "should make it possible to move forward on setting up a harmonised European scheme" in the face of non-European extraterritorial laws5. These texts are described as under preparation: they do not yet apply according to this source.

Fact sheet

Identifier
CP-383
Wing
6. Governance and GRC
Brain skill
Safeguarding Data (safeguard_data)
Brain reflex
cr-038
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
5 sources checked on 3 November 2026
Sources5 sources
  1. Cybermalveillance.gouv.fr, “Cybersécurité : comment trouver un professionnel qualifié ?”, 14 December 2021. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/actualites/cybersecurite-comment-trouver-un-professionnel-qualifie (accessed 3 November 2026)
  2. Senate (France), “Avis n° 149 (2018-2019), tome IX : Direction de l'action du gouvernement, coordination du travail gouvernemental”, 22 November 2018. https://www.senat.fr/rap/a18-149-9/a18-149-91.pdf (accessed 3 November 2026)
  3. ENISA, “Trust service providers in France”, 31 March 2015. https://www.enisa.europa.eu/sites/default/files/all_files/Cyberdefence%20trusted%20service%20providers%20in%20France.pdf (accessed 3 November 2026)
  4. Senate (France), “L'urgence d'agir pour éviter la sortie de route : Piloter la commande publique au service de la souveraineté économique - Rapport - Sénat”. https://www.senat.fr/rap/r24-830-1/r24-830-115.html (accessed 3 November 2026)
  5. National Assembly (France), “Question écrite n° 10401”, 30 December 2025. https://www.assemblee-nationale.fr/dyn/17/questions/QANR5L17QE10401 (accessed 3 November 2026)

Cite this article

Brain, “ANSSI qualifications for cloud and security providers”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/anssi-qualifications-secnumcloud-passi-pris-pdis/

BibTeX 
@misc{brain_cp383_en_2026,
  author = {Brain},
  title = {ANSSI qualifications for cloud and security providers},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/anssi-qualifications-secnumcloud-passi-pris-pdis/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence