SecNumCloud

Our certifications
Standards & Directives SecNumCloud

In a constantly evolving digital environment, data protection is becoming a crucial issue for organizations of all sizes. The rise of cloud computing offers many benefits in terms of flexibility, agility and cost reduction, but it also raises critical security questions.

It is in this context that the qualification SecNumCloud of the National Information Systems Security Agency (ANSSI) plays a decisive role.

Become SecNumCloud Compliant

What is SecNumCloud ?

SecNumCloud is a security framework developed by ANSSI, a French reference authority in cybersecurity.

This framework defines a set of strict requirements that cloud service operators must respect to guarantee a high level of protection of the data hosted in their infrastructures.

Who is affected by the SecNumCloud qualification ?

The SecNumCloud repository is aimed at two main categories of actors:

  • Cloud service providers (hosters).
  • Cloud service users.

Cloud service providers (hosters)

  • IaaS, CaaS, PaaS and SaaS cloud operators wishing to demonstrate the robustness of their security infrastructures and services.
  • Data hosts keen to differentiate themselves in the market by promoting their commitment to data protection.
  • Developers of cloud security solutions who wish to certify the conformity of their products and services to the requirements of the framework.

Cloud service users

  • Organizations of vital importance (OIV) subject to strict regulatory obligations in terms of data and information systems security.
  • Public entities sensitive to data protection and digital sovereignty issues, particularly in the context of cloud computing .
  • Private companies of all sizes who want to guarantee the security of their data and processes hosted in the cloud.

What are the requirements of SecNumCloud ?

The requirements of the SecNumCloud repository are classified into 14 different themes.

The 14 themes are:

  1. Information security policies and risk management.
  2. Organization of information security.
  3. Human Resources Security.
  4. Asset management.
  5. Access control and identity management.
  6. Cryptology.
  7. Physical and environmental security.
  8. Operational safety.
  9. Communications security.
  10. Acquisition, development and maintenance of information systems.
  11. Relations with third parties.
  12. Management of information security incidents.
  13. Business continuity.
  14. Compliance.

01

Information security policies and risk management

  • Definition of a formal information security policy approved by management.
  • Identification and analysis of security risks to which the organization is exposed.
  • Implementation of a risk management plan to address identified risks.
  • Evaluation and monitoring of the effectiveness of the security measures put in place.

02

Information security organization

  • Designation of a Chief Information Security Officer (CISO) with clear powers and responsibilities.
  • Establishment of an information security committee to manage the organization's security strategy.
  • Raising awareness and training employees on information security issues.
  • Definition of clear and documented security procedures.

03

Human Resources Security

  • Implementation of a rigorous recruitment and authorization management policy.
  • Raising employee awareness of security risks such as phishing, social engineering and malware.
  • Training employees on good security practices, such as creating strong passwords and being vigilant about suspicious emails.
  • Implementation of measures to protect employees'personal data.

04

Asset Management

  • Inventory of all assets of the organization, such as hardware, software and data.
  • Classification of assets based on their criticality to the organization.
  • Implementing security measures to protect assets, such as data encryption and hardware access control.

05

Access control and identity management

  • Implementation of an identity and access management (IAM) system to centralize the management of user identities and authorizations.
  • Definition of granular access policies to control access to organizational resources based on user needs.
  • Implementing strong access controls, such as multi-factor authentication (MFA).
  • Monitoring access to organizational resources to detect unauthorized access.

06

Cryptology

  • Use of strong encryption to protect confidential data, in transit and at rest.
  • Secure cryptographic key management.
  • Implementation of access controls to cryptographic keys.

07

Physical and environmental security

  • Implementation of physical security measures to protect the organization's infrastructure, such as physical access control, video surveillance and alarms.
  • Protection of premises against fires, floods and other disasters.
  • Implementation of evacuation and recovery procedures in the event of an incident.

08

Operational Safety

  • Implementation of an incident and vulnerability management process effective in identifying, remediating and exploiting system and application security vulnerabilities.
  • Implementation of malware protection measures such as antivirus, anti-malware and firewalls.
  • Implementation of a backup and recovery strategy to ensure data availability in the event of an incident.
  • Implementation of strict access controls to limit access to systems and data to authorized individuals.
  • Implementation of adequate logging and traceability to enable the investigation of security incidents.
  • Implementation of network security measures to protect systems against network attacks.
  • Implementation of a rigorous password security policy to protect user accounts against unauthorized access.
  • Implementation of security awareness and training for cloud users.

09

Communications security

  • Setting up a firewall to protect the organization's network against external attacks.
  • Using a virtual private network (VPN) to secure remote communications.
  • Implementation of an intrusion detection system (IDS) to detect attacks on the network.
  • Implementation of an intrusion prevention system (IPS) to block attacks on the network.

10

Acquisition, development and maintenance of information systems

  • Implementation of a secure development process for the organization's applications.
  • Carrying out security tests of applications before their deployment in production.
  • Implementation of security patches for vulnerabilities identified in applications.

11

Relations with third parties

  • Identify and select Cloud Service Providers (PCS) using rigorous criteria, by carrying out prior security audits and by contractualizing security commitments.
  • Implement security controls by carrying out monitoring of PCS activities, through regular security audits of PSCs and by providing incident response procedures.
  • Effectively protect data, by putting data protection measures in place, ensuring that PCS have adequate protection measures in place and obtaining prior consent from data subjects.
  • Carry out clear and detailed incident management procedures.

12

Information security incident management

  • Definition of an incident and crisis management plan.
  • Establishment of an incident response team (CERT).
  • Implementation of communication procedures in the event of an incident.
  • Carry out regular tests of the incident and crisis management plan.

13

Business continuity

  • Implementation of a business continuity plan (BCP) to guarantee the continuity of the organization's critical services in the event of an incident.
  • Implementation of a business recovery plan (PRA) to enable the organization to resume normal activity as quickly as possible after an incident.
  • PCA and PRA tests.

14

Compliance

  • Identification of regulatory requirements applicable to the organization regarding information security.
  • Implementation of measures to comply with regulatory requirements.
  • Carry out regular audits of regulatory compliance.

What are the advantages of the SecNumCloud repository ?

SecNumCloud repository offers many benefits to cloud service providers and users.

Benefits for cloud service providers

Demonstrate a leading level of security

SecNumCloud qualification allows cloud service providers to differentiate themselves from their competitors by demonstrating their commitment to data and system security. This can help them attract new customers and retain existing customers.

Access new markets

SecNumCloud qualification is particularly important for cloud service providers who want to work with public sector and OIV customers, who have strict security requirements.

Strengthen customer trust

By obtaining the SecNumCloud qualification , cloud service providers can show their customers that they take security seriously and have adequate measures in place to protect their data. This can help build customer trust and improve customer satisfaction.

Improve security practices

SecNumCloud qualification process can help cloud service providers identify and remediate security vulnerabilities in their systems and processes. This can lead to an overall improvement in the company's security posture.

Attract and retain talent

Potential employees are more likely to apply to companies that have a strong reputation for security. The SecNumCloud qualification can help cloud service providers attract and retain top talent.

Benefits for cloud service users

The assurance of reinforced data protection

Users of cloud services can be assured that their data is protected against cyber threats and security incidents if it is hosted by a qualified SecNumCloud provider.

Regulatory Compliance

SecNumCloud qualified cloud service providers must comply with strict data security regulations, such as GDPR. This means that users of cloud services can have confidence that their data complies with these regulations.

Increased visibility into security practices

SecNumCloud qualified cloud service users have access to more information about the provider's security practices. This allows them to better understand how their data is protected and make informed security decisions.

Increased confidence

SecNumCloud qualified cloud service users can have greater confidence in the reliability and security of information systems hosted in the cloud.

Meet the strictest security requirements

SecNumCloud qualified cloud service users can meet the most stringent security requirements, especially for OIVs and public entities.

A need for an IT security audit?

Our team of IT security experts is ready to offer you the audit that best suits your needs and your business.

Your satisfaction and security are our priorities. Contact us

Contact us!

+33 1 85 09 15 09
*required