SecNumCloud, C5, ENS and HDS, vendor by vendor

France, Germany and Spain each have their own security scheme for cloud services, and public buyers there often require one. For two of them the authority publishes a register, and we read it. For the other two there is no register we can read, so all there is to record is what the vendor says about itself. The two kinds of evidence are never mixed below.

"—" means the vendor's own pages we read name no such certification, and, for SecNumCloud and ENS, that the register has no entry under the names we searched (the vendor's brand and its recorded legal entities; each vendor page lists them). Vendors with nothing in any column are left out of the table.

SecNumCloud (France)

SecNumCloud is the qualification ANSSI, France's national cybersecurity agency, gives cloud services. Its current version, 3.2, adds requirements meant to keep the service out of reach of non-EU law, including limits on how much of the provider non-EU entities may own. ANSSI publishes the qualified services in its catalogue, with the decision number and dates.

S3NS is a Thales subsidiary that operates Google Cloud technology; its qualification covers its own service, not Google Cloud.

Every qualified service on ANSSI's list, with its decision, the edition it cites and the changes we have recorded

ENS (Spain)

The Esquema Nacional de Seguridad (Royal Decree 311/2022) applies to the Spanish public sector and to the suppliers whose systems serve it. A system is certified in one of three categories, BÁSICA, MEDIA or ALTA, by an accredited body, and the CCN (Centro Criptológico Nacional) publishes every certificate of conformity in its register. A certificate covers the information systems it names, not the whole company, so each row below is one certificate and its scope.

• In the register, not mentioned on the vendor's pages we read: Cisco Webex, Google Cloud, Google Workspace, SAP, Salesforce and T Cloud Public. Our reading of their compliance pages recorded no ENS claim; the certificate is in the register all the same.
• Claimed, but no certificate under the names we searched: CrowdStrike and OneTrust. A certificate may be held by a group company under another name; the vendor page lists the names we searched.
• Slack's certificate is issued to its parent, Salesforce, Inc., and names the Slack services.

C5 (Germany)

C5 is the BSI's Cloud Computing Compliance Criteria Catalogue. A cloud provider is audited against it by an independent auditor and receives an attestation report, not a certificate. The BSI does not oversee the audits and says in its FAQ that it keeps no list of attestations. So for C5 the only evidence is the vendor's word, and the report itself, which it is usually in the provider's interest to share with customers. 20 vendors in the registry claim one: AWS European Sovereign Cloud, Adobe, Atlassian, Box, Cloudflare, CrowdStrike, Databricks, DeepL, Figma, Google Workspace, IONOS Cloud, Microsoft, Notion, OVHcloud, Okta, Oracle Cloud, STACKIT, Slack, T Cloud Public and Zoom.

Each claim, with the report type and edition the vendor gives and where we read it, is on the BSI C5 page.

HDS (France, health data)

In France, a provider hosting personal health data on behalf of others, such as hospitals or care providers, needs an HDS certificate (Hébergeur de Données de Santé). The French digital health agency publishes the list of certified hosts, but its site answers automated readers with a CAPTCHA, and we do not solve those, so we cannot check it. 16 vendors claim HDS on their own pages: 3DS Outscale, Amazon Web Services, Bleu, Box, ElevenLabs, Microsoft, MongoDB, OVHcloud, Oracle Cloud, S3NS, Salesforce, Scaleway, Snowflake, Zendesk, Zoho and Zoom. Check the official list before relying on any of them.

Expiring within four months

A register entry carries an end date; renewal is the vendor's to arrange. These end soonest:

ISO standards, SOC 2 and TISAX

Which vendors list the international standards, with status, scope and source: ISO/IEC 42001, ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, TISAX, SOC 2.

Which ISO/IEC 27001 edition vendors name

123 vendors list ISO/IEC 27001 on the pages we read; 55 of them name an edition. 52 name the 2022 edition, and 2 name the 2013 edition: Cisco Webex and OVHcloud. The rest name the standard without a year.

ISO published ISO/IEC 27001:2022 on 25 October 2022. The International Accreditation Forum's transition document, IAF MD 26:2023, set 31 October 2025 as the date by which certification bodies were to complete their certified clients' transitions. A vendor's page naming 2013 says which edition the page names, not which edition the current certificate carries; that is printed on the certificate, and the vendor's other pages may show a newer one.

Security questionnaires: CAIQ, SIG and CSA STAR

40 of the 148 vendors whose certification pages we read say they have answered a standard security questionnaire, the Cloud Security Alliance's CAIQ or Shared Assessments' SIG, or name CSA STAR, its assurance programme and registry. Where the vendor's page says so, the table shows whether you can see a copy without asking, or must request one. Each vendor links to its own page, where its copy or request route is.

"Public copy": the vendor's page links the completed questionnaire or its STAR Registry entry. "On request": the vendor offers it to customers or under NDA. "Stated": the vendor names it and links nothing behind it. A dash means the vendor's page does not mention it, not that the vendor has never answered one. Names are as each vendor writes them; where a page writes only "CSA", that is what the cell shows.

The CAIQ

The Consensus Assessments Initiative Questionnaire is the Cloud Security Alliance's set of yes/no questions over its Cloud Controls Matrix. A cloud provider uses it to document which security controls exist in its services, and can submit it to the STAR Registry, a public database (CSA). The answers are the provider's own. The version CSA takes for the registry is CAIQ v4.1.

CSA STAR

STAR is the Cloud Security Alliance's assurance programme, at two levels. Level 1 is a self-assessment. Level 2 is an independent assessment by a certified STAR auditor, as either a STAR Attestation or a STAR Certification (CSA). The STAR Registry is public, so a vendor's entry can be checked in the registry before you ask. The level, where a vendor gives one, is in the table as the vendor writes it.

The SIG

Shared Assessments' Standardized Information Gathering questionnaire standardises the first assessment of a vendor, over 19 risk domains. It comes as SIG Lite (126 questions in the 2023 edition) for a basic level of due diligence and SIG Core (855) for vendors that hold highly sensitive or regulated data. It is not free: it is used under a Shared Assessments membership or subscription (Shared Assessments). Of the 5 vendors here that name one, 3 offer it on request and 2 state it.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “CAIQ, SIG and CSA STAR: what SaaS vendors state”, https://eucsoft.com/en/certifications/, data read up to 2026-11-09.

How this was read

ANSSI's catalogue and the CCN's register are read as their owners publish them, with no model in between, and re-read every week. Matching an entry to a vendor is done on the vendor's brand, its recorded legal entities and its website, and reviewed before it is published; a group company's certificate for another service is not filed under the vendor. Claims come from the vendor's own trust and compliance pages, as on every vendor page. Latest reading 2026-11-09. The full method is on the methodology page.