SecNumCloud-Certified Solutions

SecNumCloud 3.2: The New Requirements of the Framework

SecNumCloud

HDS

ISO 27001 / 27701

Updated in 2022 by ANSSI, the SecNumCloud framework is now available in version 3.2. This updated version includes stricter requirements for cloud service providers regarding the sovereignty and security of their solutions. In particular, the SecNumCloud 3.2 framework includes requirements regarding immunity from extraterritorial laws. Its goal: to ensure complete control over data within the European Union.

SecNumCloud 3.2: Enhanced Requirements for Data Sovereignty and Security

Issued by the National Cybersecurity Agency (ANSSI), the SecNumCloud certification is awarded to trusted cloud solutions that meet strict requirements for data security and sovereignty.

ANSSI recommends that organizations operating in sensitive and strategic sectors use SecNumCloud-certified solutions. This ensures that their data benefits from the highest level of security and protection.

The SecNumCloud 3.2 framework formalizes new requirements—technical, operational, and legal.

Enhanced Protection Against Non-European Laws

The SecNumCloud 3.2 framework thus requires cloud service providers to have their headquarters and capital located within the European Union. The goal of this measure is to ensure complete control over data, which cannot therefore be subject to non-European laws.

A broader and more structured approach to risk management

The SecNumCloud 3.2 framework requires a more structured risk management approach, incorporating complex technical scenarios such as virtualization, isolation failures, and outsourcing. Residual risks are expected to be formally validated by the service provider’s management, with a focus on enhanced accountability.

Strict Regulation of Remote Access

Remote access, particularly from outside the EU, must now be routed through secure and monitored systems. This framework aims to prevent any uncontrolled access to customer data—even in cases of legitimate intervention—and to ensure full traceability of all actions taken.

Enhanced security for administrative access and interfaces

Strong authentication is becoming essential for all access to user and administrative interfaces. A strict separation is maintained between the service provider’s administrative interfaces and those of the client, in order to ensure true segregation of duties and limit the risk of lateral compromise.

Our SecNumCloud 3.2-certified solutions

Oodrive was the first French company to have its SaaS offerings certified under the SecNumCloud standard, as early as 2019. The certification was subsequently renewed in 2022.

The Oodrive Work and Oodrive Board (formerly Oodrive Meet) solutions were certified under version 3.2 of the SecNumCloud framework in 2025, marking the third time they have received this certification. The renewal of this certification confirms the excellence of Oodrive’s SaaS solutions and their guarantees regarding data security, sovereignty, and compliance.