FranceLoi n° 2024-449 (SREN), Security Criteria for State Use of Private Cloud Services Holding Sensitive Data
Article 31, Loi n° 2024-449 du 21 mai 2024 visant à sécuriser et à réguler l'espace numérique
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000049563368In force since .
A sector security regimes rule binding government bodies.
- Private right of action
- No
- Obligation class
- Security, Transfer
As of .
What it requires
- If you are a State administration, a State operator listed in the annex to the finance bill, or a public-interest grouping that includes them, and you use a cloud computing service supplied by a private provider to run IT systems or applications, observe Article 31 of Law 2024-449.
- Where the system or application processes data of particular sensitivity (data protected as secrets by law, or data needed for the State's essential missions) and a breach could harm public order, public security, health or life, or intellectual property protection, see that the cloud service applies security and data-protection criteria that protect the data against access by the public authorities of third States not authorized by Union or Member State law (Article 31, I and II).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Has the Conseil d'Etat decree that Article 31, V requires, setting the security and protection criteria and the derogation conditions, been made, and what criteria does it set for a cloud provider that sells to State bodies?
What this law does
State administrations, their operators listed in the annex to the finance bill and the public-interest groupings that include them must observe Article 31 when they use a cloud computing service supplied by a private provider to run IT systems or applications (Article 31, I).
Where the system or application processes data of particular sensitivity, which they must see is protected by a cloud service applying security and data-protection criteria that guard the data against access by the public authorities of third States not authorized by Union or Member State law (Article 31, I).
Data of particular sensitivity covers data protected as secrets by law and data needed for the State's essential missions, including national security, public order and the protection of health and life (Article 31, II). A decree in the Conseil d'Etat sets the rules for applying the Article, including the security and protection criteria (Article 31, V).