AWS becomes the first cloud provider cleared for NATO Restricted work across the alliance
September 23, 2026 - 8:34 am
Credit: Amazon
Amazon Web Services (AWS) has become the first cloud service provider to gain approval to handle NATO-restricted information in all of the alliance’s member states. Surprisingly, this achievement wasn't directly facilitated by NATO but through Madrid.
AWS documented its compliance with D32, the NATO technical directive defining security requirements for handling NATO Restricted (NR) information in the public cloud. The Spanish National Cryptologic Center (CCN) assessed AWS services against this directive. Following the evaluation, NATO approved the findings and made them accessible to all allies.
AWS now offers cleared services in its 15 regions located within NATO countries, seven of which are in mainland Europe. A secondary clearance was obtained through the Spanish phase, as both the CCN and Spain’s National Security Office (ONS) approved AWS Europe (Spain) region for handling "Difusión Limitada" (DL) information, Spain's equivalent of NATO Restricted. Data centers for this region are based in Aragón.
This approval involved several certification stages. AWS already held the highest "High" level of the Spain National Security Scheme (ENS) certification and 28 of its security services were pre-approved within the CCN’s catalog. The company also satisfied specific DL requirements as per CCN-STIC-004 policy and ONS guidelines, which required a security audit of data centers.
While this clearance applies to AWS's services, public-sector and defense organizations accredited in Spain can now run DL and NR workloads on the Spanish infrastructure, provided they have their own systems adhering to the CCN-STIC-004 policy and ONS standards.
Since NATO grants NR accreditation to both member countries and its Communications and Information Agency (NCIA), each government maintains its unique national accreditation process. AWS highlights that this alliance-wide approval offers a common, pre-evaluated security baseline, streamlining the compliance process for reduced time and cost.
"Strengthening NATO’s ability to securely leverage commercial technology is key to building a more resilient and agile Alliance. The availability of commercial products meeting NATO’s security requirements expands the technology options available for the Alliance and supports our ability to adopt modern technologies while maintaining the security and resilience on which our operations depend," said Dylan Browne, general manager of the NCIA.
This clearance extends across the entire alliance, with each government retaining ownership of its own accreditation paperwork.