AWS has announced that it is the first cloud services provider whose capabilities are approved to process NATO RESTRICTED (NR) information by all NATO member states.
The approval covers AWS services usable in any region located within a country that is a member of NATO.
The accreditation journey did not take place directly within alliance institutions but rather through Spain.
AWS has documented its compliance with the D32 technical directive, which establishes the security requirements applicable to NR information processing in the public cloud. The Spanish National Cryptologic Center (Centro Criptológico Nacional, CCN) subsequently evaluated its services, before NATO approved them and published the results to all Allies.
In Spain, the hyperscaler specifies that the relevant data centers are located in Aragon, a region that holds the ENS “Alto” certification—the highest level on the Spanish framework.
Approval Routed Through Spain
The operational challenge is to reduce the time, effort and cost associated with national accreditations.
NATO delegates NR accreditation to a host member state or to the NATO Communications and Information Agency (NCIA). Each government thus remains responsible for the final authorization to use on its territory.
“Strengthening NATO’s ability to securely leverage commercial technology is essential to building a more resilient and agile Alliance,” declares Dylan Browne, general manager of the NCIA, in AWS’s press release.
AWS notes that it operates 15 regions in NATO member countries, including seven in continental Europe. The approved services can be leveraged to build NR-compatible systems in any of these regions.
In Spain, the hyperscaler reiterates that its data centers are located in Aragon, a region that benefits from the ENS “Alto” certification—the highest level of the Spanish framework.
According to NATO, the agreement expands the technological offering available for handling sensitive data, but it does not imply an automatic generalization to all uses or all systems. The accreditation of client systems remains a separate and mandatory step.
