The Council of the European Union has approved the French cryptographic product STORMSHIELD Network Security UTM/NG-Firewall Software Suite, version 4.3.x (x ≥ 12), for protecting EU classified information at the RESTREINT UE/EU RESTRICTED level. The approval, granted under Article 10(6) of the Council Security Rules (Council Decision 2013/488/EU of 23 September 2013), was communicated via an information note from the General Secretariat of the Council to delegations on 7 August 2026. The decision, taken by the Secretary-General on 6 August 2026, allows EU institutions to deploy this specific firewall version for RESTREINT UE/EU RESTRICTED data, provided they follow the evaluator’s recommendations, which must be incorporated into the corresponding Security Operating Procedures.
The approval is limited to the RESTREINT UE/EU RESTRICTED level and does not extend to higher classification levels. This means that the product cannot be used for CONFIDENTIEL UE/EU CONFIDENTIAL, SECRET UE/EU SECRET, or TRES SECRET UE/EU TRES SECRET information. The decision follows the standard procedure for approving cryptographic products under the Council Security Rules, which requires a thorough evaluation by the competent authorities before a product can be used for protecting EU classified information.
This approval is part of the ongoing effort to ensure that EU institutions have access to certified cryptographic solutions for protecting sensitive information. The STORMSHIELD firewall, developed by the French company Stormshield, is widely used in European public and private sectors. The approval is expected to facilitate secure communications and data handling within EU institutions, particularly for administrative and operational purposes that require RESTREINT UE/EU RESTRICTED protection.
The decision impacts several stakeholders. EU institutions and bodies, including the European Commission, the European Parliament, and EU agencies, will be able to use the approved firewall for their internal communications and data storage at the RESTREINT level, enhancing their security posture. National authorities of EU member states, which often collaborate with EU institutions on classified matters, may also benefit from the interoperability and trust in the approved product. The manufacturer, Stormshield, gains a formal endorsement from the Council, which could boost its credibility and market position in the EU security sector. However, the restriction to RESTREINT UE/EU RESTRICTED means that the product cannot be used for higher classification levels, which may limit its applicability for certain sensitive operations.
The approval is a procedural step under the Council Security Rules, and no further institutional follow-up is required for the product to be used. However, EU institutions must update their Security Operating Procedures to incorporate the evaluator’s recommendations before deploying the firewall. The Council’s decision does not affect the ongoing evaluation of other cryptographic products, which continue to be assessed under the same framework.