ANSSI qualifications

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-02-14 PACS requirements version 2.0 dated
2. 2025-10-07 PRIS requirements version 3.2 dated
3. 2024-08-01 PASSI requirements version 2.2 dated
4. 2022-03-08 SecNumCloud requirements version 3.2 published

1. 2026-02-14
   PACS requirements v2.0 (most recently revised document) Major versionCurrent

   Version 2.0 of the requirements for cyber security support and consulting providers, covering advice on security accreditation, risk management, architecture security and cyber crisis preparation; it replaces v1.1. source

2. 2025-10-07
   PRIS requirements v3.2 Revision

   Version 3.2 of the requirements for security incident response providers; ANSSI lists v3.0 as obsolete. source

3. 2024-08-01
   PASSI requirements v2.2 Revision

   Version 2.2 of the requirements for information system security audit providers, cited as the reference in ANSSI's 2025 PASSI qualification decisions. source

4. 2022-03-08
   SecNumCloud v3.2 Revision

   Mainly added criteria protecting against non-European law, with changes to many chapters and Annexes 1 and 2. source

   More

   • On request, the provider must give the client the elements for assessing risks from the client's data being subject to the law of a non-EU state.
5. 2016-12-08
   SecNumCloud v3.0 Major version

   First applicable version of the cloud provider requirements, with a référentiel per qualification level and closer integration of the PASSI, PRIS and PDIS labels. source

Qualification is something providers apply for; it then lets them deliver qualified services, including audits of operators of vital importance.

Audit providers

PASSI-qualified providers can be qualified for organisational and physical audits, architecture, configuration and source code audits, and penetration tests. source

Vital operators

A PASSI decision can qualify the provider to audit the critical information systems of operators of vital importance (OIV) under Article L1332-6-3 of the Defence Code. source

Cloud providers

SecNumCloud sets requirements for cloud service providers, including protection of client data against non-European law since v3.2. source

Choice of level

Unless a legal, regulatory or contractual obligation applies, the client chooses the qualification level of the service it buys. source

State cloud

Not confirmed by an official source yet.

An evaluation of conformity to the référentiel leads to an ANSSI qualification decision for a fixed period, conditional on the provider's commitments.

Evaluation

The decision is based on the qualification request file and evaluation reports on the service's conformity with the applicable référentiel. source

Validity

Decisions are time-limited; one 2025 PASSI decision is valid from 1 January 2026 to 26 December 2028. source

Conditions

The decision is conditional on the provider respecting its commitments under the service qualification process. source

Qualification is a decision ANSSI grants and conditions, not a law with fines; a qualified service does not replace the client's own security clearance checks.

Conditional decision

A qualification decision is conditional on the provider respecting its commitments under the qualification process. source

Classified information

A decision does not certify the provider's ability to access classified information, and a qualified service does not replace the client's duty to check clearance rules. source

1. Standard Prestataires de services d'informatique en nuage (SecNumCloud) - référentiel d'exigences, v3.2
2. Standard Prestataires d'audit de la sécurité des systèmes d'information - référentiel d'exigences, v2.0 (2013)
3. Guidance Example PASSI qualification decision (ANSSI, 2025)
4. Standard Prestataires d'accompagnement et de conseil en sécurité (PACS) - référentiel d'exigences, v2.0 (2026)
5. Standard Prestataires de réponse aux incidents de sécurité (PRIS) - référentiel d'exigences, v3.2 (2025)

1. EUCC

   The EU Common Criteria certification scheme for ICT products under the Cybersecurity Act, rather than French national qualification of services.

2. ISO 27001

   An international management system certification issued by accredited certification bodies, not a state qualification decision.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to ANSSI qualifications (RSS)