The Minister Delegate for Digital Jean-Noël Barrot announced Thursday at the National Assembly the signing of a circular aimed at protecting sensitive data of the State in certified operators and not subject to foreign laws, still very few. The circular, signed Wednesday by Prime Minister Elisabeth Borne, will allow administrations "to prepare for the migration of their sensitive data to the trusted cloud," said Jean-Noël Barrot during the examination in the hemicycle of measures of the Military Programming Law (LPM).
This circular, unveiled by the Contexte website, specifies that sensitive data includes data that fall under secrets protected by law, such as secrets related to government deliberations, national defense, the conduct of the France's foreign policy, state security, proceedings before the courts or the secrecy of private life, medical confidentiality, business secrecy. Also included are data necessary for the fulfilment of the essential tasks of the State, such as safeguarding national security, maintaining public order and protecting the health and life of persons.
The "Cloud at the Center" doctrine.
Administrations were already encouraged to host their sensitive data with certified operators since the formalization in the summer of 2021 of the "Cloud at the center" doctrine. But "sensitive data" was not defined, which the circular clarifies, explained the minister's office. The "migration" will take time, however, because only seven cloud service offers offered by five different companies, including the French flagship OVH Cloud, have won the SecNumCloud label awarded by Anssi, the state's IT security agency.
The circular "will allow to have a much clearer framework on the information to be protected," responded to AFP Sébastien Lescop, CEO of Cloud Temple, one of the lucky elected. It should thus give "a boost for actors who have agreed to investments" in security and qualification which takes about 2 years, he continued.
According to Anssi, six offers are being qualified, including the Wimi Enterprise collaborative platform, Index Education (developer of the Pronote software), the Whaller messaging and the Cloud Avenue d'Orange offer. The SecNumCloud security standard, in addition to technical security criteria, requires that the operator of the cloud service be European in order to avoid extra-territorial laws, including American, which affect the world leaders in the cloud Google, Amazon or Microsoft.
Read alsoData privacy: Amazon will pay more than $ 30 million to avoid lawsuits
However, two offers have been announced in partnership with these giants: the Blue consortium, made up of Microsoft's technological solution operated by Orange and CapGemini, and that of S3NS, which corresponds to Google's technology operated by Thales. Finally, the digital subsidiary of the La Poste group Docaposte has partnered with Dassault Systèmes, whose cloud subsidiary Outscale is SecNumCloud certified, the operator Bouygues Telecom and the Banque des territoires to develop a French cloud computing offer called "Numspot".
In the autumn, the government announced an envelope of 2.5 million euros "for small businesses and start-ups" who want to obtain the label but hesitate in the face of the financial effort.
