On 14 August 2026, the order of 12 August was published in the Journal officiel de la République française. It approves version 3.2 of the requirements framework for cloud computing service providers: the new SecNumCloud qualification baseline. For entities subject to NIS2 that host all or part of their essential systems with a cloud provider, this text is not an internal update by ANSSI: it redefines what a qualified provider is, and what your subcontracting chain must document.
What SecNumCloud qualifies, and why it concerns you
The SecNumCloud framework is the qualification scheme for cloud service providers run by ANSSI. It covers three service categories: Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). A SecNumCloud-qualified provider has had its security, operational, incident management and reversibility practices audited by an accredited certification body. The qualification is valid for three years, renewable.
For a NIS2 entity, the link with SecNumCloud is not always direct in the directive itself. It runs through Article 21 and its requirements for managing supply chain risks, as well as through Article 6 of the French NIS2 decree being transposed. The French data protection authority (CNIL) and ANSSI have indicated in their practical guides that using a SecNumCloud-qualified provider is the presumed compliance route for hosting sensitive data or high-risk systems.
The main changes in version 3.2
Version 3.2 introduces several substantial changes compared with version 3.1, which had been in force since 2022. Three of them have direct consequences for cloud buyers.
The first concerns data sovereignty. Version 3.2 strengthens requirements on immunity from extra-European legislation. A qualified provider must now demonstrate that no entity subject to non-European legislation, in particular Section 702 of the US FISA or Chinese national security laws, has technical or legal access to the hosted data. This requirement applies not only to the provider itself, but also to its technical subcontractors.
The second change concerns vulnerability management. Version 3.2 aligns correction deadlines with the requirements of the Cyber Resilience Act: critical vulnerabilities (CVSS ≥ 9.0) must be corrected within 24 hours of the availability of a vendor patch, or be subject to a documented mitigation measure within that period. For high vulnerabilities (CVSS 7.0-8.9), the deadline is extended to 72 hours. These deadlines are contractually enforceable against the qualified provider.
The third change concerns reversibility. Version 3.2 requires the provider to document and test annually the procedure for data portability and migration to an alternative provider. This documentation must be made available to the customer on request. The aim is to make reversibility verifiable, not just declared.
What your contract must verify now
If your organisation uses a cloud provider that was qualified SecNumCloud under version 3.1, you must check two points before your contract's next deadline. The first is the qualification renewal date: providers have a transition period to obtain qualification under version 3.2. This period is set at eighteen months from the date of publication of the order, that is, until 14 February 2028. During this transition period, a 3.1 qualification remains valid.
The second point is the compliance of the contractual security annexes. The SLAs relating to vulnerability correction deadlines, portability clauses and sovereignty commitments must be brought into line with version 3.2 at the next renewal or contractual review. A contract that explicitly references SecNumCloud without specifying the version may create ambiguity about the requirements that apply.
The link with NIS2 and DORA
The order of 12 August fits into a regulatory context where the management of cloud providers is subject to converging obligations. Under NIS2, Article 21 requires entities to manage the risks linked to their essential service providers. Under DORA, Article 28 and its mandatory ICT contractual clauses apply to providers considered critical ICT third-party service providers. SecNumCloud qualification does not replace these obligations: it complements them by providing a previously verified audit baseline.
For dual entities, subject to both NIS2 and DORA, typically financial institutions using cloud services for critical functions, SecNumCloud 3.2 qualification can serve as partial evidence to satisfy the pre-contractual due diligence requirements of DORA Article 28. It does not cover all DORA requirements, in particular contractual audit rights and specific continuity plans. The article on mandatory ICT contractual clauses under DORA details the additional elements to negotiate.
The case of non-qualified providers
SecNumCloud remains a voluntary qualification. No text prohibits a NIS2 entity from using a non-qualified cloud provider. However, using a non-qualified provider to host essential systems or sensitive data requires the entity to document the compensatory measures that justify this choice with regard to its risk management obligations. This documentation is part of the body of evidence that competent authorities, ANSSI for French entities, may request during an inspection.
In practice, for entities that do not use a SecNumCloud-qualified provider, version 3.2 serves as a useful reference for building your own supplier assessment questionnaires. The framework's requirements on sovereignty, vulnerability management and reversibility are legitimate questions to ask any cloud provider as part of a TPRM approach. The article on the pitfalls of third-party mapping in 2026 addresses how to structure these assessments.
Three actions for compliance directors
Publication of the order opens a useful working window before the end of the year.
First action: map your critical cloud providers and check their qualification status. ANSSI's website maintains the list of SecNumCloud-qualified providers, with their qualification version and expiry date. For each provider hosting essential systems or sensitive data, check whether its qualification covers version 3.2 or whether it is still within the transition period.
Second action: anticipate contractual revisions. If your contract with a cloud provider references SecNumCloud without specifying the version, or if the vulnerability correction SLAs do not match the version 3.2 deadlines, include an update of the security annex in the next annual review cycle. Do not wait for the full contract renewal.
Third action: use version 3.2 as an assessment grid for your non-qualified providers. Extracting the requirements on sovereignty, vulnerability management and reversibility from the framework to create a supplier questionnaire is a limited investment that strengthens your due diligence documentation.
The order of 14 August 2026 is in force. The eighteen-month transition period leaves time to put your contractual documentation in order, but it does not defer the obligation to know now whether your current providers are on a trajectory towards compliance with version 3.2.