DEEP-DIVE TOPIC
Cloud security
A useful cloud audit explains what was observed, in which scope, under which assumptions and why a finding deserves priority. A finding count or global score does not answer those questions.
Sources verified on August 25, 2026
KEY POINT
Provider assurance and workload security are related but distinct. Qualification or certification of a cloud service does not remove the customer’s responsibility to secure identities, configurations, data, applications and usage.
01
Start with scope and responsibilities
Before reading a score, establish which accounts, subscriptions, projects, regions, services and identities were included. Responsibility varies with the consumed service and architecture. A professional audit should distinguish provider responsibilities, customer responsibilities and controls that depend on service configuration.
02
SecNumCloud provides assurance about the offering, not your application
SecNumCloud sets requirements for providers seeking qualification and can also be used as a good-practice baseline. ANSSI nevertheless states that qualification provides assurance about the cloud offering and its operating practices without determining the security level of customer digital services hosted on it. This distinction avoids the common but incorrect shortcut “qualified cloud = secure application”.
03
Prioritise by risk scenario, not isolated severity
A finding becomes a priority when it can be connected to an important asset, powerful identity, reachable exposure or sensitive data and when a plausible exploitation path exists. Remediation should combine technical severity, business context, exploitability, dependencies and compensating controls. This makes decisions more defensible than mechanical score sorting.
RECOMMENDED PATH
Understand → assess → go deeper
FRAMING REFERENCES
2 official sources
- 2022-03-08ANSSI — SecNumCloud requirements baseline v3.2 ↗
Cloud-provider qualification baseline covering technical, organisational and provider requirements; it can also be used as a good-practice reference.
- 2024-08-14ANSSI — Cloud hosting recommendations and SecNumCloud focus ↗
ANSSI notes that qualification provides assurance about the cloud offering and its operation, but does not determine the security level of the customer services deployed on it.
These references support verification of the topic framing. Editorial conclusions remain Cybercoria’s and do not constitute legal advice or compliance certification.