Summary
As EU governments accelerate cloud migration, cloud security has emerged as a critical and fast-growing procurement category. The EU Cloud Certification Scheme (EUCS), cloud-first policies across all 27 member states, and heightened concerns about data sovereignty and US extraterritorial law are reshaping what governments buy and from whom. Procurement spans CASB and CSPM tooling, cloud security posture consulting, data residency compliance audits, and multi-cloud security architecture services. This guide explains the regulatory landscape, what is being procured, the key CPV codes, and the qualification requirements that vendors must meet.
The EU Cloud Security Market Context
European governments have committed to cloud-first digital transformation strategies, but procurement of cloud services has been complicated by persistent concerns around data sovereignty — particularly following the invalidation of the EU-US Privacy Shield (Schrems II ruling) and ongoing exposure of European data to the US Cloud Act and FISA Section 702. In response, the EU has developed a complex regulatory architecture around cloud procurement that every cloud security vendor must understand.
Key regulatory developments shaping cloud security procurement in 2026:
- EUCS (EU Cloud Services Certification Scheme): ENISA's scheme defines three assurance levels — Basic, Substantial, and High — with "High" requiring EU ownership and operational control of the cloud provider. The scheme is being referenced in an increasing number of government tenders, particularly for contracts involving sensitive or classified data.
- DORA (Digital Operational Resilience Act): Mandates cloud risk management for financial sector entities, driving cloud security procurement across banks, insurers, and payment institutions regulated by EU member states.
- NIS2 cloud provisions: Cloud providers are classified as essential entities under NIS2, and their public sector clients must assess and manage cloud supply chain risks.
- Gaia-X: The European cloud infrastructure initiative, though slower to deploy commercially than originally envisioned, continues to shape procurement language around data spaces and federated cloud security.
What Governments Are Procuring
Cloud security procurement in the EU public sector covers a range of products and services:
- Cloud Security Posture Management (CSPM): Tools and services to continuously assess cloud configurations against security benchmarks (CIS, NIST). High demand as multi-cloud estates grow in complexity.
- Cloud Access Security Brokers (CASB): Visibility and control layer between users and cloud services. Particularly relevant for authorities managing shadow IT and SaaS sprawl.
- Cloud security architecture consulting: Design and review of secure cloud architectures, zero-trust network implementations, and identity and access management in cloud environments.
- Data residency compliance audits: Verification that data remains within EU borders and that cloud provider sub-processors meet GDPR and national law requirements.
- Cloud migration security assessment: Security review integrated into migration projects, ensuring controls are not degraded during transition from on-premise to cloud.
- Container and Kubernetes security: Specialist security for government workloads running in containerised environments — a rapidly growing niche as DevOps practices penetrate government IT.
EUCS and Data Residency Requirements
The EUCS High level, designed for sensitive government data and critical infrastructure, requires that cloud services are operated exclusively by entities incorporated, headquartered, and operationally controlled within the EU — meaning no non-EU government can compel disclosure of data processed or stored within the service. This requirement effectively excludes AWS, Microsoft Azure, and Google Cloud from the highest-assurance category unless they operate through locally incorporated entities with genuine operational independence.
The practical procurement implications: tenders for high-sensitivity workloads increasingly include language requiring EUCS High alignment or equivalent national certification (e.g., France's SecNumCloud, Germany's C5). Cloud security vendors whose services run on non-EU hyperscalers may face disqualification for these contracts, while those on EU-origin infrastructure (OVHcloud, Hetzner, T-Systems Sovereign Cloud) gain a structural advantage.
Key CPV Codes
- 72222300 — Information technology services (cloud security consulting)
- 72212730 — Security software development services (CSPM/CASB tools)
- 72220000 — Systems and technical consultancy (cloud architecture review)
- 72315000 — Data network management (cloud network security)
- 72320000 — Database services (cloud data security)
- 79212000 — Auditing services (data residency compliance audits)
Note that the CPV taxonomy predates cloud computing and there is no dedicated cloud security code. Monitoring by keyword ("cloud security", "CASB", "CSPM", "data residency") alongside CPV codes produces better results.
Multi-Cloud Security Frameworks
Government cloud estates are increasingly multi-cloud, combining Microsoft 365 for productivity, AWS or Azure for compute workloads, and SaaS applications from multiple vendors. This complexity drives demand for platform-agnostic security management frameworks. Tenders in this space typically require:
- A unified security management console spanning multiple cloud environments
- Consistent policy enforcement across AWS, Azure, GCP, and private cloud
- Integration with on-premise identity providers (Active Directory, LDAP)
- Automated compliance reporting against EU GDPR, NIS2, and national frameworks
Qualification Requirements and Winning Strategy
Cloud security contracts typically require ISO 27001 company certification, cloud-specific certifications for key personnel (AWS Security Specialty, Microsoft Azure Security Engineer, Google Professional Cloud Security Engineer), GDPR compliance documentation, and for high-assurance contracts, the ability to demonstrate EU data residency of your own service infrastructure.
Winning bids emphasise regulatory fluency — demonstrating intimate knowledge of EUCS levels, GDPR Article 28 processor requirements, and NIS2 cloud supply chain obligations. Evaluators reward vendors who present security not as a technical checkbox but as a governance and compliance solution, making the contracting authority's regulatory obligations easier to meet and document. Price sensitivity is lower in cloud security than in commodity IT procurement — quality and credibility dominate.