787 lines
25 KiB
JSON
787 lines
25 KiB
JSON
|
{
|
|||
|
|
"schemaVersion": "1.0.0",
|
|||
|
|
"appContext": {
|
|||
|
|
"orgName": "Chezlepro Inc.",
|
|||
|
|
"programName": "SOC 2 Type II Operational Cockpit",
|
|||
|
|
"observationWindow": {
|
|||
|
|
"start": "2026-01-01",
|
|||
|
|
"end": "2026-06-30",
|
|||
|
|
"targetReadiness": 85
|
|||
|
|
}
|
|||
|
|
},
|
|||
|
|
"evidence": [
|
|||
|
|
{
|
|||
|
|
"id": "ev-001",
|
|||
|
|
"title": "Politique de sécurité de l’information v1.4",
|
|||
|
|
"category": "Policy",
|
|||
|
|
"pillar": "security",
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"freshness": "Valide",
|
|||
|
|
"updatedAt": "2026-04-09",
|
|||
|
|
"auditorReady": true,
|
|||
|
|
"visibility": "auditor",
|
|||
|
|
"source": "Wiki / Gouvernance",
|
|||
|
|
"tags": [
|
|||
|
|
"policy",
|
|||
|
|
"security",
|
|||
|
|
"governance"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"sec-governance"
|
|||
|
|
],
|
|||
|
|
"summary": "Politique cadre de sécurité approuvée et versionnée."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-002",
|
|||
|
|
"title": "Export Keycloak – MFA et rôles administrateurs",
|
|||
|
|
"category": "Access",
|
|||
|
|
"pillar": "security",
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"freshness": "À revoir",
|
|||
|
|
"updatedAt": "2026-03-29",
|
|||
|
|
"auditorReady": false,
|
|||
|
|
"visibility": "internal",
|
|||
|
|
"source": "Keycloak / Export CSV",
|
|||
|
|
"tags": [
|
|||
|
|
"iam",
|
|||
|
|
"mfa",
|
|||
|
|
"admin"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"sec-iam",
|
|||
|
|
"con-access"
|
|||
|
|
],
|
|||
|
|
"summary": "État courant des administrateurs, rôles et MFA; manque la revue signée."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-003",
|
|||
|
|
"title": "Journal des changements Forgejo / Pull Requests",
|
|||
|
|
"category": "Change",
|
|||
|
|
"pillar": "security",
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"freshness": "Valide",
|
|||
|
|
"updatedAt": "2026-04-15",
|
|||
|
|
"auditorReady": true,
|
|||
|
|
"visibility": "auditor",
|
|||
|
|
"source": "Forgejo / Repositories",
|
|||
|
|
"tags": [
|
|||
|
|
"change",
|
|||
|
|
"git",
|
|||
|
|
"approval"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"sec-change",
|
|||
|
|
"pi-inputs"
|
|||
|
|
],
|
|||
|
|
"summary": "Historique des changements, approbations et validations post-déploiement."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-004",
|
|||
|
|
"title": "Rapport Icinga – disponibilité des services",
|
|||
|
|
"category": "Monitoring",
|
|||
|
|
"pillar": "availability",
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"freshness": "Valide",
|
|||
|
|
"updatedAt": "2026-04-16",
|
|||
|
|
"auditorReady": true,
|
|||
|
|
"visibility": "auditor",
|
|||
|
|
"source": "Icinga2 / Monitoring",
|
|||
|
|
"tags": [
|
|||
|
|
"availability",
|
|||
|
|
"monitoring",
|
|||
|
|
"uptime"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"ava-monitoring",
|
|||
|
|
"ava-incidents",
|
|||
|
|
"sec-logging"
|
|||
|
|
],
|
|||
|
|
"summary": "Disponibilité, incidents et tendances de capacité sur la fenêtre d’observation."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-005",
|
|||
|
|
"title": "Procédure de sauvegarde et test de restauration",
|
|||
|
|
"category": "Backup",
|
|||
|
|
"pillar": "availability",
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"freshness": "Valide",
|
|||
|
|
"updatedAt": "2026-04-12",
|
|||
|
|
"auditorReady": true,
|
|||
|
|
"visibility": "auditor",
|
|||
|
|
"source": "Runbook / Restore test",
|
|||
|
|
"tags": [
|
|||
|
|
"backup",
|
|||
|
|
"restore",
|
|||
|
|
"dr"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"ava-backup",
|
|||
|
|
"ava-resilience"
|
|||
|
|
],
|
|||
|
|
"summary": "Procédure documentée et test de restauration horodaté."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-006",
|
|||
|
|
"title": "Cartographie des flux critiques de traitement",
|
|||
|
|
"category": "Process",
|
|||
|
|
"pillar": "processing-integrity",
|
|||
|
|
"owner": "Architecture",
|
|||
|
|
"freshness": "Brouillon",
|
|||
|
|
"updatedAt": "2026-04-04",
|
|||
|
|
"auditorReady": false,
|
|||
|
|
"visibility": "internal",
|
|||
|
|
"source": "Architecture / Flux",
|
|||
|
|
"tags": [
|
|||
|
|
"flows",
|
|||
|
|
"processing",
|
|||
|
|
"integrity"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"pi-flows",
|
|||
|
|
"pi-audit"
|
|||
|
|
],
|
|||
|
|
"summary": "Cartographie initiale des flux critiques; consolidation encore en cours."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-007",
|
|||
|
|
"title": "Registre de classification des données",
|
|||
|
|
"category": "Data",
|
|||
|
|
"pillar": "confidentiality",
|
|||
|
|
"owner": "Architecture",
|
|||
|
|
"freshness": "À revoir",
|
|||
|
|
"updatedAt": "2026-03-18",
|
|||
|
|
"auditorReady": false,
|
|||
|
|
"visibility": "internal",
|
|||
|
|
"source": "Registre data",
|
|||
|
|
"tags": [
|
|||
|
|
"classification",
|
|||
|
|
"data",
|
|||
|
|
"confidentiality"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"con-classification",
|
|||
|
|
"con-lifecycle"
|
|||
|
|
],
|
|||
|
|
"summary": "Inventaire de classification existant mais incomplet pour certaines charges hébergées."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-008",
|
|||
|
|
"title": "Registre des renseignements personnels",
|
|||
|
|
"category": "Privacy",
|
|||
|
|
"pillar": "privacy",
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"freshness": "Brouillon",
|
|||
|
|
"updatedAt": "2026-04-02",
|
|||
|
|
"auditorReady": false,
|
|||
|
|
"visibility": "internal",
|
|||
|
|
"source": "Registre privacy",
|
|||
|
|
"tags": [
|
|||
|
|
"privacy",
|
|||
|
|
"pii",
|
|||
|
|
"register"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"pri-mapping",
|
|||
|
|
"pri-rules",
|
|||
|
|
"pri-retention"
|
|||
|
|
],
|
|||
|
|
"summary": "Première version du registre des renseignements personnels et de leurs finalités."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-009",
|
|||
|
|
"title": "Journal des incidents et post-mortems",
|
|||
|
|
"category": "Incident",
|
|||
|
|
"pillar": "security",
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"freshness": "Valide",
|
|||
|
|
"updatedAt": "2026-04-10",
|
|||
|
|
"auditorReady": true,
|
|||
|
|
"visibility": "auditor",
|
|||
|
|
"source": "Incident register",
|
|||
|
|
"tags": [
|
|||
|
|
"incident",
|
|||
|
|
"rca",
|
|||
|
|
"security"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"sec-ir",
|
|||
|
|
"ava-incidents"
|
|||
|
|
],
|
|||
|
|
"summary": "Historique des incidents, causes racines et actions correctives."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-010",
|
|||
|
|
"title": "Registre des fournisseurs critiques",
|
|||
|
|
"category": "Vendor",
|
|||
|
|
"pillar": "confidentiality",
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"freshness": "À revoir",
|
|||
|
|
"updatedAt": "2026-03-27",
|
|||
|
|
"auditorReady": false,
|
|||
|
|
"visibility": "internal",
|
|||
|
|
"source": "Vendor register",
|
|||
|
|
"tags": [
|
|||
|
|
"vendors",
|
|||
|
|
"third-party",
|
|||
|
|
"contracts"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"con-thirdparty",
|
|||
|
|
"pri-incidents"
|
|||
|
|
],
|
|||
|
|
"summary": "Liste des tiers, contrats et dépendances; classement critique à finaliser."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-011",
|
|||
|
|
"title": "Inventaire des services in-scope",
|
|||
|
|
"category": "Inventory",
|
|||
|
|
"pillar": "availability",
|
|||
|
|
"owner": "Architecture",
|
|||
|
|
"freshness": "Valide",
|
|||
|
|
"updatedAt": "2026-04-11",
|
|||
|
|
"auditorReady": true,
|
|||
|
|
"visibility": "auditor",
|
|||
|
|
"source": "CMDB / Architecture",
|
|||
|
|
"tags": [
|
|||
|
|
"inventory",
|
|||
|
|
"scope",
|
|||
|
|
"services"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"ava-inventory",
|
|||
|
|
"sec-governance"
|
|||
|
|
],
|
|||
|
|
"summary": "Liste des services critiques, dépendances et responsables d’exploitation."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ev-012",
|
|||
|
|
"title": "Matrice contrôles ↔ preuves",
|
|||
|
|
"category": "Matrix",
|
|||
|
|
"pillar": "security",
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"freshness": "Valide",
|
|||
|
|
"updatedAt": "2026-04-16",
|
|||
|
|
"auditorReady": true,
|
|||
|
|
"visibility": "auditor",
|
|||
|
|
"source": "Compliance register",
|
|||
|
|
"tags": [
|
|||
|
|
"matrix",
|
|||
|
|
"controls",
|
|||
|
|
"evidence"
|
|||
|
|
],
|
|||
|
|
"linkedMilestones": [
|
|||
|
|
"sec-governance",
|
|||
|
|
"sec-change",
|
|||
|
|
"con-review",
|
|||
|
|
"pri-review",
|
|||
|
|
"pi-audit"
|
|||
|
|
],
|
|||
|
|
"summary": "Matrice de rapprochement entre critères, contrôles, jalons et éléments probants."
|
|||
|
|
}
|
|||
|
|
],
|
|||
|
|
"pillars": [
|
|||
|
|
{
|
|||
|
|
"id": "security",
|
|||
|
|
"name": "Security",
|
|||
|
|
"globalWeight": 32,
|
|||
|
|
"objective": "Protéger les systèmes, les accès, les changements et la capacité de détection/réaction.",
|
|||
|
|
"description": "Protection globale des systèmes, identités, journaux, changements et incidents.",
|
|||
|
|
"milestones": [
|
|||
|
|
{
|
|||
|
|
"id": "sec-governance",
|
|||
|
|
"title": "Gouvernance sécurité de base",
|
|||
|
|
"weight": 10,
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-25",
|
|||
|
|
"stage": "proved",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-001",
|
|||
|
|
"ev-011",
|
|||
|
|
"ev-012"
|
|||
|
|
],
|
|||
|
|
"notes": "Périmètre et rôles définis; maintenir l’actualisation du registre des risques.",
|
|||
|
|
"nextAction": "Ajouter la revue mensuelle du registre des risques à la fenêtre Type II."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "sec-iam",
|
|||
|
|
"title": "Gestion des accès et des identités",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-22",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-002"
|
|||
|
|
],
|
|||
|
|
"notes": "MFA déployé mais la revue périodique signée et la révocation démontrée restent à consolider.",
|
|||
|
|
"nextAction": "Capturer la revue d’accès du mois et la rattacher à ce jalon."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "sec-hardening",
|
|||
|
|
"title": "Durcissement et gestion des vulnérabilités",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Hebdomadaire",
|
|||
|
|
"dueAt": "2026-04-21",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [],
|
|||
|
|
"notes": "Le standard technique existe mais la chaîne de preuve automatisée doit être branchée.",
|
|||
|
|
"nextAction": "Importer le dernier rapport de scan et lier la remédiation en cours."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "sec-logging",
|
|||
|
|
"title": "Journalisation, surveillance et alertes",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Hebdomadaire",
|
|||
|
|
"dueAt": "2026-04-19",
|
|||
|
|
"stage": "proved",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-004"
|
|||
|
|
],
|
|||
|
|
"notes": "Bonne maturité opérationnelle, surveillance déjà exploitable côté auditeur.",
|
|||
|
|
"nextAction": "Ajouter un sommaire de rétention des journaux à la salle auditeur."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "sec-change",
|
|||
|
|
"title": "Gestion des changements",
|
|||
|
|
"weight": 15,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Continue",
|
|||
|
|
"dueAt": "2026-04-20",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-003",
|
|||
|
|
"ev-012"
|
|||
|
|
],
|
|||
|
|
"notes": "Les PR existent; il reste à standardiser la preuve des validations post-changement.",
|
|||
|
|
"nextAction": "Ajouter le champ “validation post-déploiement” dans le flux de changement."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "sec-ir",
|
|||
|
|
"title": "Réponse aux incidents",
|
|||
|
|
"weight": 15,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Trimestrielle",
|
|||
|
|
"dueAt": "2026-05-05",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-009"
|
|||
|
|
],
|
|||
|
|
"notes": "Registre en place; exercice formel tabletop à programmer.",
|
|||
|
|
"nextAction": "Planifier un exercice et produire le compte rendu auditable."
|
|||
|
|
}
|
|||
|
|
]
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "availability",
|
|||
|
|
"name": "Availability",
|
|||
|
|
"globalWeight": 22,
|
|||
|
|
"objective": "Maintenir la disponibilité promise, démontrer la résilience et la restaurabilité.",
|
|||
|
|
"description": "Disponibilité des services, dépendances, capacité, sauvegardes et reprise.",
|
|||
|
|
"milestones": [
|
|||
|
|
{
|
|||
|
|
"id": "ava-inventory",
|
|||
|
|
"title": "Inventaire des services critiques et dépendances",
|
|||
|
|
"weight": 15,
|
|||
|
|
"owner": "Architecture",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-24",
|
|||
|
|
"stage": "proved",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-011"
|
|||
|
|
],
|
|||
|
|
"notes": "Inventaire déjà formalisé, à garder vivant.",
|
|||
|
|
"nextAction": "Ajouter les dépendances de monitoring externe dans l’inventaire."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ava-slo",
|
|||
|
|
"title": "Objectifs de service définis",
|
|||
|
|
"weight": 10,
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"cadence": "Trimestrielle",
|
|||
|
|
"dueAt": "2026-05-10",
|
|||
|
|
"stage": "designed",
|
|||
|
|
"evidenceRefs": [],
|
|||
|
|
"notes": "Le langage de promesse client existe, pas encore uniformisé en SLO/SLA.",
|
|||
|
|
"nextAction": "Formaliser les cibles internes et externes par service in-scope."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ava-monitoring",
|
|||
|
|
"title": "Monitoring et capacité",
|
|||
|
|
"weight": 25,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Hebdomadaire",
|
|||
|
|
"dueAt": "2026-04-19",
|
|||
|
|
"stage": "proved",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-004"
|
|||
|
|
],
|
|||
|
|
"notes": "Surveillance solide et historique disponible.",
|
|||
|
|
"nextAction": "Ajouter un résumé tendance capacité par trimestre."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ava-backup",
|
|||
|
|
"title": "Sauvegardes et restauration testée",
|
|||
|
|
"weight": 25,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-23",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-005"
|
|||
|
|
],
|
|||
|
|
"notes": "Test de restauration existant; cadence et couverture des jeux de données à élargir.",
|
|||
|
|
"nextAction": "Ajouter un deuxième scénario de restauration ciblant la chaîne complète applicative."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ava-resilience",
|
|||
|
|
"title": "Résilience opérationnelle",
|
|||
|
|
"weight": 15,
|
|||
|
|
"owner": "Architecture",
|
|||
|
|
"cadence": "Trimestrielle",
|
|||
|
|
"dueAt": "2026-05-12",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-005"
|
|||
|
|
],
|
|||
|
|
"notes": "Les mécanismes existent mais le récit auditeur n’est pas encore assez structuré.",
|
|||
|
|
"nextAction": "Rédiger une fiche de reprise courte et exposable."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "ava-incidents",
|
|||
|
|
"title": "Gestion des incidents de disponibilité",
|
|||
|
|
"weight": 10,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Continue",
|
|||
|
|
"dueAt": "2026-04-20",
|
|||
|
|
"stage": "proved",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-004",
|
|||
|
|
"ev-009"
|
|||
|
|
],
|
|||
|
|
"notes": "Bonne base; il faut lier plus clairement l’incident à l’action corrective.",
|
|||
|
|
"nextAction": "Relier chaque incident clos à une décision corrective explicite."
|
|||
|
|
}
|
|||
|
|
]
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "processing-integrity",
|
|||
|
|
"name": "Processing Integrity",
|
|||
|
|
"globalWeight": 16,
|
|||
|
|
"objective": "Démontrer que les traitements critiques sont exacts, complets, traçables et revus.",
|
|||
|
|
"description": "Intégrité des traitements, qualité des flux, détection d’erreurs et validation.",
|
|||
|
|
"milestones": [
|
|||
|
|
{
|
|||
|
|
"id": "pi-flows",
|
|||
|
|
"title": "Flux critiques identifiés",
|
|||
|
|
"weight": 15,
|
|||
|
|
"owner": "Architecture",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-28",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-006"
|
|||
|
|
],
|
|||
|
|
"notes": "La cartographie existe mais pas encore sur tout le périmètre Type II.",
|
|||
|
|
"nextAction": "Terminer la cartographie des flux administratifs et de preuve."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pi-inputs",
|
|||
|
|
"title": "Contrôles d’entrée et de changement",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Continue",
|
|||
|
|
"dueAt": "2026-04-22",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-003"
|
|||
|
|
],
|
|||
|
|
"notes": "Le lien entre changements techniques et impact métier doit être explicité.",
|
|||
|
|
"nextAction": "Ajouter un champ “impact traitement” dans les changements sensibles."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pi-audit",
|
|||
|
|
"title": "Traçabilité et auditabilité des traitements",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Hebdomadaire",
|
|||
|
|
"dueAt": "2026-04-20",
|
|||
|
|
"stage": "proved",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-006",
|
|||
|
|
"ev-012"
|
|||
|
|
],
|
|||
|
|
"notes": "Base structurante en place.",
|
|||
|
|
"nextAction": "Mieux exposer la traçabilité pour les auditeurs non techniques."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pi-errors",
|
|||
|
|
"title": "Détection et gestion des erreurs",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Hebdomadaire",
|
|||
|
|
"dueAt": "2026-04-21",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [],
|
|||
|
|
"notes": "Le processus existe de façon implicite; il faut le rendre explicite et prouvable.",
|
|||
|
|
"nextAction": "Créer un registre simple d’anomalies de traitement."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pi-validation",
|
|||
|
|
"title": "Validation / tests / réconciliation",
|
|||
|
|
"weight": 15,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-26",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [],
|
|||
|
|
"notes": "Présent dans la pratique, mais pas encore uniformisé dans la preuve.",
|
|||
|
|
"nextAction": "Définir trois contrôles de réconciliation standard."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pi-review",
|
|||
|
|
"title": "Revue périodique des écarts",
|
|||
|
|
"weight": 10,
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-30",
|
|||
|
|
"stage": "absent",
|
|||
|
|
"evidenceRefs": [],
|
|||
|
|
"notes": "C’est un vrai trou de gouvernance pour ce pilier.",
|
|||
|
|
"nextAction": "Instaurer une revue mensuelle d’écarts avec décision consignée."
|
|||
|
|
}
|
|||
|
|
]
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "confidentiality",
|
|||
|
|
"name": "Confidentiality",
|
|||
|
|
"globalWeight": 18,
|
|||
|
|
"objective": "Encadrer l’accès, les secrets, la classification, les tiers et le cycle de vie des données confidentielles.",
|
|||
|
|
"description": "Protection des données confidentielles, accès, secrets, conservation et tiers.",
|
|||
|
|
"milestones": [
|
|||
|
|
{
|
|||
|
|
"id": "con-classification",
|
|||
|
|
"title": "Classification des données",
|
|||
|
|
"weight": 15,
|
|||
|
|
"owner": "Architecture",
|
|||
|
|
"cadence": "Trimestrielle",
|
|||
|
|
"dueAt": "2026-05-15",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-007"
|
|||
|
|
],
|
|||
|
|
"notes": "Une base existe, mais elle n’est pas encore assez normalisée pour l’audit.",
|
|||
|
|
"nextAction": "Uniformiser les niveaux de classification et leurs exigences associées."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "con-access",
|
|||
|
|
"title": "Restriction d’accès",
|
|||
|
|
"weight": 25,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-22",
|
|||
|
|
"stage": "proved",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-002"
|
|||
|
|
],
|
|||
|
|
"notes": "Contrôle robuste, sous réserve d’une meilleure preuve de revue formelle.",
|
|||
|
|
"nextAction": "Ajouter l’attestation mensuelle du responsable sur les accès sensibles."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "con-tech",
|
|||
|
|
"title": "Protection technique",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Ops",
|
|||
|
|
"cadence": "Hebdomadaire",
|
|||
|
|
"dueAt": "2026-04-20",
|
|||
|
|
"stage": "proved",
|
|||
|
|
"evidenceRefs": [],
|
|||
|
|
"notes": "Bonne maîtrise technique, chaîne de preuve encore dispersée.",
|
|||
|
|
"nextAction": "Centraliser les preuves chiffrement/TLS/secrets dans un seul dossier."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "con-lifecycle",
|
|||
|
|
"title": "Cycle de vie des données",
|
|||
|
|
"weight": 15,
|
|||
|
|
"owner": "Architecture",
|
|||
|
|
"cadence": "Trimestrielle",
|
|||
|
|
"dueAt": "2026-05-08",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-007"
|
|||
|
|
],
|
|||
|
|
"notes": "Règles de conservation à préciser selon type de données.",
|
|||
|
|
"nextAction": "Créer une matrice conservation / archivage / destruction."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "con-thirdparty",
|
|||
|
|
"title": "Tiers et obligations contractuelles",
|
|||
|
|
"weight": 10,
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"cadence": "Trimestrielle",
|
|||
|
|
"dueAt": "2026-05-02",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-010"
|
|||
|
|
],
|
|||
|
|
"notes": "Le registre existe, la criticité et le suivi restent à renforcer.",
|
|||
|
|
"nextAction": "Classer les fournisseurs par criticité et lier les clauses sécurité."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "con-review",
|
|||
|
|
"title": "Preuves de revue et exceptions",
|
|||
|
|
"weight": 15,
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-30",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-012"
|
|||
|
|
],
|
|||
|
|
"notes": "Bonne structure, manque encore des revues exécutées sur la durée.",
|
|||
|
|
"nextAction": "Ajouter la dernière revue mensuelle avec décisions d’exception."
|
|||
|
|
}
|
|||
|
|
]
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "privacy",
|
|||
|
|
"name": "Privacy",
|
|||
|
|
"globalWeight": 12,
|
|||
|
|
"objective": "Encadrer les renseignements personnels, leurs finalités, leurs droits et leur suppression.",
|
|||
|
|
"description": "Renseignements personnels, finalités, droits, conservation et incidents.",
|
|||
|
|
"milestones": [
|
|||
|
|
{
|
|||
|
|
"id": "pri-mapping",
|
|||
|
|
"title": "Cartographie des renseignements personnels",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"cadence": "Trimestrielle",
|
|||
|
|
"dueAt": "2026-05-16",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-008"
|
|||
|
|
],
|
|||
|
|
"notes": "Démarré, mais encore incomplet sur certains fournisseurs et flux secondaires.",
|
|||
|
|
"nextAction": "Finaliser la source, la finalité et la localisation pour chaque catégorie de RP."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pri-rules",
|
|||
|
|
"title": "Règles de collecte et d’usage",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"cadence": "Trimestrielle",
|
|||
|
|
"dueAt": "2026-05-18",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-008"
|
|||
|
|
],
|
|||
|
|
"notes": "La doctrine existe, la démonstration opérationnelle est incomplète.",
|
|||
|
|
"nextAction": "Documenter explicitement les finalités et la minimisation."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pri-rights",
|
|||
|
|
"title": "Droits et demandes des personnes",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-29",
|
|||
|
|
"stage": "absent",
|
|||
|
|
"evidenceRefs": [],
|
|||
|
|
"notes": "Aucun mécanisme simple et démontrable n’est encore en place.",
|
|||
|
|
"nextAction": "Créer un registre de demandes et une procédure courte de traitement."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pri-retention",
|
|||
|
|
"title": "Conservation et suppression",
|
|||
|
|
"weight": 20,
|
|||
|
|
"owner": "Architecture",
|
|||
|
|
"cadence": "Trimestrielle",
|
|||
|
|
"dueAt": "2026-05-11",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-008"
|
|||
|
|
],
|
|||
|
|
"notes": "Les règles existent partiellement par système, pas encore au niveau programme.",
|
|||
|
|
"nextAction": "Formaliser la matrice de rétention et les méthodes de suppression."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pri-incidents",
|
|||
|
|
"title": "Incidents vie privée et tiers",
|
|||
|
|
"weight": 10,
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"cadence": "Trimestrielle",
|
|||
|
|
"dueAt": "2026-05-09",
|
|||
|
|
"stage": "operating",
|
|||
|
|
"evidenceRefs": [
|
|||
|
|
"ev-010"
|
|||
|
|
],
|
|||
|
|
"notes": "La zone tiers est présente, mais l’angle privacy est sous-documenté.",
|
|||
|
|
"nextAction": "Ajouter le scénario “incident touchant des RP” au registre d’incidents."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pri-review",
|
|||
|
|
"title": "Revue périodique de conformité vie privée",
|
|||
|
|
"weight": 10,
|
|||
|
|
"owner": "Direction",
|
|||
|
|
"cadence": "Mensuelle",
|
|||
|
|
"dueAt": "2026-04-30",
|
|||
|
|
"stage": "absent",
|
|||
|
|
"evidenceRefs": [],
|
|||
|
|
"notes": "Pas encore de cycle récurrent de revue privacy.",
|
|||
|
|
"nextAction": "Instaurer une revue mensuelle compacte de conformité privacy."
|
|||
|
|
}
|
|||
|
|
]
|
|||
|
|
}
|
|||
|
|
],
|
|||
|
|
"auditorPacks": [
|
|||
|
|
{
|
|||
|
|
"id": "pack-1",
|
|||
|
|
"title": "System Description",
|
|||
|
|
"status": "ready",
|
|||
|
|
"requiredEvidence": [
|
|||
|
|
"ev-001",
|
|||
|
|
"ev-011"
|
|||
|
|
],
|
|||
|
|
"description": "Périmètre, architecture, dépendances, flux de données, rôles et responsabilités."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pack-2",
|
|||
|
|
"title": "Management Assertion",
|
|||
|
|
"status": "draft",
|
|||
|
|
"requiredEvidence": [
|
|||
|
|
"ev-012"
|
|||
|
|
],
|
|||
|
|
"description": "Déclaration de la direction sur la fidélité de la description et l’efficacité opérationnelle."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pack-3",
|
|||
|
|
"title": "Controls ↔ Evidence Matrix",
|
|||
|
|
"status": "ready",
|
|||
|
|
"requiredEvidence": [
|
|||
|
|
"ev-012"
|
|||
|
|
],
|
|||
|
|
"description": "Matrice de rapprochement entre critères, jalons, contrôles, propriétaires et preuves."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pack-4",
|
|||
|
|
"title": "Exceptions & Remediation Register",
|
|||
|
|
"status": "draft",
|
|||
|
|
"requiredEvidence": [
|
|||
|
|
"ev-009",
|
|||
|
|
"ev-010"
|
|||
|
|
],
|
|||
|
|
"description": "Écarts connus, compensating controls, décisions et plan de remédiation."
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
"id": "pack-5",
|
|||
|
|
"title": "Access & Privileged Activity Pack",
|
|||
|
|
"status": "draft",
|
|||
|
|
"requiredEvidence": [
|
|||
|
|
"ev-002"
|
|||
|
|
],
|
|||
|
|
"description": "Revue des accès, privilèges, MFA et preuves de révocation."
|
|||
|
|
}
|
|||
|
|
]
|
|||
|
|
}
|