AWS becomes first hyperscaler to win 'NATO Restricted' approval for the Alliance's cloud infrastructure

Amazon Web Services (AWS) has become the first hyperscale cloud provider to win approval to handle information under the 'NATO Restricted' (NR) designation, the classification level NATO applies to restricted, mission-critical data. According to the company, this allows Alliance member states and their defense industry partners to host NR workloads in any AWS Region located in a member country. AWS says it currently has 15 Regions in NATO nations, seven of them in continental Europe.

David Appel, interim vice president of worldwide public sector at AWS, described the achievement as 'the culmination of a sustained, multi-year effort' alongside defense partners, and said the move 'reflects the company's commitment to defense, public sector and NATO-affiliated customers and partners in achieving their critical missions'. Appel added that, in his view, governments and the citizens they serve deserve access to the same infrastructure and services that drive innovation in the private sector, and that AWS will keep working to give allied nations the interoperability they need to strengthen their resilience and protect their citizens.

As part of this approval, AWS will offer what it calls 'simplified access' to its cloud computing capabilities for NATO member states. Because it applies across the entire Alliance, the approval gives member countries and their defense partners access to a 'common, pre-assessed security baseline' intended to simplify security and compliance obligations. National security and defense customers will also be able to access AWS Trusted Secure Enclave – Sensitive Edition, a service the company mentions explicitly. In addition, NATO allies will have a 'fast track' to AWS accreditation through their respective national processes.

Dylan Browne, general manager of the NATO Communications and Information Agency (NCIA), said that the availability of commercial products meeting the Alliance's security requirements broadens the technology options available and supports NATO's ability to adopt modern technology without compromising the security and resilience its operations depend on. According to Browne, the move helps build a more 'resilient and agile' alliance by drawing on commercial technology.

On the technical process, AWS explains that obtaining NR approval required documenting its compliance with D32, a technical directive setting out the security requirements for handling restricted information in the public cloud. NATO delegates the assessment of this type of accreditation to a member nation or directly to the NCIA; in this particular case, it was the competent Spanish authorities that carried out the assessment. According to the AWS statement, the company's capabilities were evaluated by Spain's Centro Criptológico Nacional (CCN), after which NATO approved and published the results to all allied countries.

The article, published by IT Pro, offers no further detail on the timeline of the certification process, the cost of the program, or whether other hyperscalers (Microsoft Azure, Google Cloud) have NR accreditation processes under way; nor does it specify which particular AWS Regions are covered beyond citing the total of 15 in member countries. It is a brief news item focused on the announcement and on statements from AWS and the NCIA, so any assessment of the competitive impact against other cloud providers in the defense market should be treated with caution, since the text does not go into it.