{
  "schemaVersion": "1.0.0",
  "appContext": {
    "orgName": "Chezlepro Inc.",
    "programName": "SOC 2 Type II Operational Cockpit",
    "observationWindow": {
      "start": "2026-01-01",
      "end": "2026-06-30",
      "targetReadiness": 85
    }
  },
  "evidence": [
    {
      "id": "ev-001",
      "title": "Politique de sécurité de l’information v1.4",
      "category": "Policy",
      "pillar": "security",
      "owner": "Direction",
      "freshness": "Valide",
      "updatedAt": "2026-04-09",
      "auditorReady": true,
      "visibility": "auditor",
      "source": "Wiki / Gouvernance",
      "tags": [
        "policy",
        "security",
        "governance"
      ],
      "linkedMilestones": [
        "sec-governance"
      ],
      "summary": "Politique cadre de sécurité approuvée et versionnée."
    },
    {
      "id": "ev-002",
      "title": "Export Keycloak – MFA et rôles administrateurs",
      "category": "Access",
      "pillar": "security",
      "owner": "Ops",
      "freshness": "À revoir",
      "updatedAt": "2026-03-29",
      "auditorReady": false,
      "visibility": "internal",
      "source": "Keycloak / Export CSV",
      "tags": [
        "iam",
        "mfa",
        "admin"
      ],
      "linkedMilestones": [
        "sec-iam",
        "con-access"
      ],
      "summary": "État courant des administrateurs, rôles et MFA; manque la revue signée."
    },
    {
      "id": "ev-003",
      "title": "Journal des changements Forgejo / Pull Requests",
      "category": "Change",
      "pillar": "security",
      "owner": "Ops",
      "freshness": "Valide",
      "updatedAt": "2026-04-15",
      "auditorReady": true,
      "visibility": "auditor",
      "source": "Forgejo / Repositories",
      "tags": [
        "change",
        "git",
        "approval"
      ],
      "linkedMilestones": [
        "sec-change",
        "pi-inputs"
      ],
      "summary": "Historique des changements, approbations et validations post-déploiement."
    },
    {
      "id": "ev-004",
      "title": "Rapport Icinga – disponibilité des services",
      "category": "Monitoring",
      "pillar": "availability",
      "owner": "Ops",
      "freshness": "Valide",
      "updatedAt": "2026-04-16",
      "auditorReady": true,
      "visibility": "auditor",
      "source": "Icinga2 / Monitoring",
      "tags": [
        "availability",
        "monitoring",
        "uptime"
      ],
      "linkedMilestones": [
        "ava-monitoring",
        "ava-incidents",
        "sec-logging"
      ],
      "summary": "Disponibilité, incidents et tendances de capacité sur la fenêtre d’observation."
    },
    {
      "id": "ev-005",
      "title": "Procédure de sauvegarde et test de restauration",
      "category": "Backup",
      "pillar": "availability",
      "owner": "Ops",
      "freshness": "Valide",
      "updatedAt": "2026-04-12",
      "auditorReady": true,
      "visibility": "auditor",
      "source": "Runbook / Restore test",
      "tags": [
        "backup",
        "restore",
        "dr"
      ],
      "linkedMilestones": [
        "ava-backup",
        "ava-resilience"
      ],
      "summary": "Procédure documentée et test de restauration horodaté."
    },
    {
      "id": "ev-006",
      "title": "Cartographie des flux critiques de traitement",
      "category": "Process",
      "pillar": "processing-integrity",
      "owner": "Architecture",
      "freshness": "Brouillon",
      "updatedAt": "2026-04-04",
      "auditorReady": false,
      "visibility": "internal",
      "source": "Architecture / Flux",
      "tags": [
        "flows",
        "processing",
        "integrity"
      ],
      "linkedMilestones": [
        "pi-flows",
        "pi-audit"
      ],
      "summary": "Cartographie initiale des flux critiques; consolidation encore en cours."
    },
    {
      "id": "ev-007",
      "title": "Registre de classification des données",
      "category": "Data",
      "pillar": "confidentiality",
      "owner": "Architecture",
      "freshness": "À revoir",
      "updatedAt": "2026-03-18",
      "auditorReady": false,
      "visibility": "internal",
      "source": "Registre data",
      "tags": [
        "classification",
        "data",
        "confidentiality"
      ],
      "linkedMilestones": [
        "con-classification",
        "con-lifecycle"
      ],
      "summary": "Inventaire de classification existant mais incomplet pour certaines charges hébergées."
    },
    {
      "id": "ev-008",
      "title": "Registre des renseignements personnels",
      "category": "Privacy",
      "pillar": "privacy",
      "owner": "Direction",
      "freshness": "Brouillon",
      "updatedAt": "2026-04-02",
      "auditorReady": false,
      "visibility": "internal",
      "source": "Registre privacy",
      "tags": [
        "privacy",
        "pii",
        "register"
      ],
      "linkedMilestones": [
        "pri-mapping",
        "pri-rules",
        "pri-retention"
      ],
      "summary": "Première version du registre des renseignements personnels et de leurs finalités."
    },
    {
      "id": "ev-009",
      "title": "Journal des incidents et post-mortems",
      "category": "Incident",
      "pillar": "security",
      "owner": "Ops",
      "freshness": "Valide",
      "updatedAt": "2026-04-10",
      "auditorReady": true,
      "visibility": "auditor",
      "source": "Incident register",
      "tags": [
        "incident",
        "rca",
        "security"
      ],
      "linkedMilestones": [
        "sec-ir",
        "ava-incidents"
      ],
      "summary": "Historique des incidents, causes racines et actions correctives."
    },
    {
      "id": "ev-010",
      "title": "Registre des fournisseurs critiques",
      "category": "Vendor",
      "pillar": "confidentiality",
      "owner": "Direction",
      "freshness": "À revoir",
      "updatedAt": "2026-03-27",
      "auditorReady": false,
      "visibility": "internal",
      "source": "Vendor register",
      "tags": [
        "vendors",
        "third-party",
        "contracts"
      ],
      "linkedMilestones": [
        "con-thirdparty",
        "pri-incidents"
      ],
      "summary": "Liste des tiers, contrats et dépendances; classement critique à finaliser."
    },
    {
      "id": "ev-011",
      "title": "Inventaire des services in-scope",
      "category": "Inventory",
      "pillar": "availability",
      "owner": "Architecture",
      "freshness": "Valide",
      "updatedAt": "2026-04-11",
      "auditorReady": true,
      "visibility": "auditor",
      "source": "CMDB / Architecture",
      "tags": [
        "inventory",
        "scope",
        "services"
      ],
      "linkedMilestones": [
        "ava-inventory",
        "sec-governance"
      ],
      "summary": "Liste des services critiques, dépendances et responsables d’exploitation."
    },
    {
      "id": "ev-012",
      "title": "Matrice contrôles ↔ preuves",
      "category": "Matrix",
      "pillar": "security",
      "owner": "Direction",
      "freshness": "Valide",
      "updatedAt": "2026-04-16",
      "auditorReady": true,
      "visibility": "auditor",
      "source": "Compliance register",
      "tags": [
        "matrix",
        "controls",
        "evidence"
      ],
      "linkedMilestones": [
        "sec-governance",
        "sec-change",
        "con-review",
        "pri-review",
        "pi-audit"
      ],
      "summary": "Matrice de rapprochement entre critères, contrôles, jalons et éléments probants."
    }
  ],
  "pillars": [
    {
      "id": "security",
      "name": "Security",
      "globalWeight": 32,
      "objective": "Protéger les systèmes, les accès, les changements et la capacité de détection/réaction.",
      "description": "Protection globale des systèmes, identités, journaux, changements et incidents.",
      "milestones": [
        {
          "id": "sec-governance",
          "title": "Gouvernance sécurité de base",
          "weight": 10,
          "owner": "Direction",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-25",
          "stage": "proved",
          "evidenceRefs": [
            "ev-001",
            "ev-011",
            "ev-012"
          ],
          "notes": "Périmètre et rôles définis; maintenir l’actualisation du registre des risques.",
          "nextAction": "Ajouter la revue mensuelle du registre des risques à la fenêtre Type II."
        },
        {
          "id": "sec-iam",
          "title": "Gestion des accès et des identités",
          "weight": 20,
          "owner": "Ops",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-22",
          "stage": "operating",
          "evidenceRefs": [
            "ev-002"
          ],
          "notes": "MFA déployé mais la revue périodique signée et la révocation démontrée restent à consolider.",
          "nextAction": "Capturer la revue d’accès du mois et la rattacher à ce jalon."
        },
        {
          "id": "sec-hardening",
          "title": "Durcissement et gestion des vulnérabilités",
          "weight": 20,
          "owner": "Ops",
          "cadence": "Hebdomadaire",
          "dueAt": "2026-04-21",
          "stage": "operating",
          "evidenceRefs": [],
          "notes": "Le standard technique existe mais la chaîne de preuve automatisée doit être branchée.",
          "nextAction": "Importer le dernier rapport de scan et lier la remédiation en cours."
        },
        {
          "id": "sec-logging",
          "title": "Journalisation, surveillance et alertes",
          "weight": 20,
          "owner": "Ops",
          "cadence": "Hebdomadaire",
          "dueAt": "2026-04-19",
          "stage": "proved",
          "evidenceRefs": [
            "ev-004"
          ],
          "notes": "Bonne maturité opérationnelle, surveillance déjà exploitable côté auditeur.",
          "nextAction": "Ajouter un sommaire de rétention des journaux à la salle auditeur."
        },
        {
          "id": "sec-change",
          "title": "Gestion des changements",
          "weight": 15,
          "owner": "Ops",
          "cadence": "Continue",
          "dueAt": "2026-04-20",
          "stage": "operating",
          "evidenceRefs": [
            "ev-003",
            "ev-012"
          ],
          "notes": "Les PR existent; il reste à standardiser la preuve des validations post-changement.",
          "nextAction": "Ajouter le champ “validation post-déploiement” dans le flux de changement."
        },
        {
          "id": "sec-ir",
          "title": "Réponse aux incidents",
          "weight": 15,
          "owner": "Ops",
          "cadence": "Trimestrielle",
          "dueAt": "2026-05-05",
          "stage": "operating",
          "evidenceRefs": [
            "ev-009"
          ],
          "notes": "Registre en place; exercice formel tabletop à programmer.",
          "nextAction": "Planifier un exercice et produire le compte rendu auditable."
        }
      ]
    },
    {
      "id": "availability",
      "name": "Availability",
      "globalWeight": 22,
      "objective": "Maintenir la disponibilité promise, démontrer la résilience et la restaurabilité.",
      "description": "Disponibilité des services, dépendances, capacité, sauvegardes et reprise.",
      "milestones": [
        {
          "id": "ava-inventory",
          "title": "Inventaire des services critiques et dépendances",
          "weight": 15,
          "owner": "Architecture",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-24",
          "stage": "proved",
          "evidenceRefs": [
            "ev-011"
          ],
          "notes": "Inventaire déjà formalisé, à garder vivant.",
          "nextAction": "Ajouter les dépendances de monitoring externe dans l’inventaire."
        },
        {
          "id": "ava-slo",
          "title": "Objectifs de service définis",
          "weight": 10,
          "owner": "Direction",
          "cadence": "Trimestrielle",
          "dueAt": "2026-05-10",
          "stage": "designed",
          "evidenceRefs": [],
          "notes": "Le langage de promesse client existe, pas encore uniformisé en SLO/SLA.",
          "nextAction": "Formaliser les cibles internes et externes par service in-scope."
        },
        {
          "id": "ava-monitoring",
          "title": "Monitoring et capacité",
          "weight": 25,
          "owner": "Ops",
          "cadence": "Hebdomadaire",
          "dueAt": "2026-04-19",
          "stage": "proved",
          "evidenceRefs": [
            "ev-004"
          ],
          "notes": "Surveillance solide et historique disponible.",
          "nextAction": "Ajouter un résumé tendance capacité par trimestre."
        },
        {
          "id": "ava-backup",
          "title": "Sauvegardes et restauration testée",
          "weight": 25,
          "owner": "Ops",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-23",
          "stage": "operating",
          "evidenceRefs": [
            "ev-005"
          ],
          "notes": "Test de restauration existant; cadence et couverture des jeux de données à élargir.",
          "nextAction": "Ajouter un deuxième scénario de restauration ciblant la chaîne complète applicative."
        },
        {
          "id": "ava-resilience",
          "title": "Résilience opérationnelle",
          "weight": 15,
          "owner": "Architecture",
          "cadence": "Trimestrielle",
          "dueAt": "2026-05-12",
          "stage": "operating",
          "evidenceRefs": [
            "ev-005"
          ],
          "notes": "Les mécanismes existent mais le récit auditeur n’est pas encore assez structuré.",
          "nextAction": "Rédiger une fiche de reprise courte et exposable."
        },
        {
          "id": "ava-incidents",
          "title": "Gestion des incidents de disponibilité",
          "weight": 10,
          "owner": "Ops",
          "cadence": "Continue",
          "dueAt": "2026-04-20",
          "stage": "proved",
          "evidenceRefs": [
            "ev-004",
            "ev-009"
          ],
          "notes": "Bonne base; il faut lier plus clairement l’incident à l’action corrective.",
          "nextAction": "Relier chaque incident clos à une décision corrective explicite."
        }
      ]
    },
    {
      "id": "processing-integrity",
      "name": "Processing Integrity",
      "globalWeight": 16,
      "objective": "Démontrer que les traitements critiques sont exacts, complets, traçables et revus.",
      "description": "Intégrité des traitements, qualité des flux, détection d’erreurs et validation.",
      "milestones": [
        {
          "id": "pi-flows",
          "title": "Flux critiques identifiés",
          "weight": 15,
          "owner": "Architecture",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-28",
          "stage": "operating",
          "evidenceRefs": [
            "ev-006"
          ],
          "notes": "La cartographie existe mais pas encore sur tout le périmètre Type II.",
          "nextAction": "Terminer la cartographie des flux administratifs et de preuve."
        },
        {
          "id": "pi-inputs",
          "title": "Contrôles d’entrée et de changement",
          "weight": 20,
          "owner": "Ops",
          "cadence": "Continue",
          "dueAt": "2026-04-22",
          "stage": "operating",
          "evidenceRefs": [
            "ev-003"
          ],
          "notes": "Le lien entre changements techniques et impact métier doit être explicité.",
          "nextAction": "Ajouter un champ “impact traitement” dans les changements sensibles."
        },
        {
          "id": "pi-audit",
          "title": "Traçabilité et auditabilité des traitements",
          "weight": 20,
          "owner": "Ops",
          "cadence": "Hebdomadaire",
          "dueAt": "2026-04-20",
          "stage": "proved",
          "evidenceRefs": [
            "ev-006",
            "ev-012"
          ],
          "notes": "Base structurante en place.",
          "nextAction": "Mieux exposer la traçabilité pour les auditeurs non techniques."
        },
        {
          "id": "pi-errors",
          "title": "Détection et gestion des erreurs",
          "weight": 20,
          "owner": "Ops",
          "cadence": "Hebdomadaire",
          "dueAt": "2026-04-21",
          "stage": "operating",
          "evidenceRefs": [],
          "notes": "Le processus existe de façon implicite; il faut le rendre explicite et prouvable.",
          "nextAction": "Créer un registre simple d’anomalies de traitement."
        },
        {
          "id": "pi-validation",
          "title": "Validation / tests / réconciliation",
          "weight": 15,
          "owner": "Ops",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-26",
          "stage": "operating",
          "evidenceRefs": [],
          "notes": "Présent dans la pratique, mais pas encore uniformisé dans la preuve.",
          "nextAction": "Définir trois contrôles de réconciliation standard."
        },
        {
          "id": "pi-review",
          "title": "Revue périodique des écarts",
          "weight": 10,
          "owner": "Direction",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-30",
          "stage": "absent",
          "evidenceRefs": [],
          "notes": "C’est un vrai trou de gouvernance pour ce pilier.",
          "nextAction": "Instaurer une revue mensuelle d’écarts avec décision consignée."
        }
      ]
    },
    {
      "id": "confidentiality",
      "name": "Confidentiality",
      "globalWeight": 18,
      "objective": "Encadrer l’accès, les secrets, la classification, les tiers et le cycle de vie des données confidentielles.",
      "description": "Protection des données confidentielles, accès, secrets, conservation et tiers.",
      "milestones": [
        {
          "id": "con-classification",
          "title": "Classification des données",
          "weight": 15,
          "owner": "Architecture",
          "cadence": "Trimestrielle",
          "dueAt": "2026-05-15",
          "stage": "operating",
          "evidenceRefs": [
            "ev-007"
          ],
          "notes": "Une base existe, mais elle n’est pas encore assez normalisée pour l’audit.",
          "nextAction": "Uniformiser les niveaux de classification et leurs exigences associées."
        },
        {
          "id": "con-access",
          "title": "Restriction d’accès",
          "weight": 25,
          "owner": "Ops",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-22",
          "stage": "proved",
          "evidenceRefs": [
            "ev-002"
          ],
          "notes": "Contrôle robuste, sous réserve d’une meilleure preuve de revue formelle.",
          "nextAction": "Ajouter l’attestation mensuelle du responsable sur les accès sensibles."
        },
        {
          "id": "con-tech",
          "title": "Protection technique",
          "weight": 20,
          "owner": "Ops",
          "cadence": "Hebdomadaire",
          "dueAt": "2026-04-20",
          "stage": "proved",
          "evidenceRefs": [],
          "notes": "Bonne maîtrise technique, chaîne de preuve encore dispersée.",
          "nextAction": "Centraliser les preuves chiffrement/TLS/secrets dans un seul dossier."
        },
        {
          "id": "con-lifecycle",
          "title": "Cycle de vie des données",
          "weight": 15,
          "owner": "Architecture",
          "cadence": "Trimestrielle",
          "dueAt": "2026-05-08",
          "stage": "operating",
          "evidenceRefs": [
            "ev-007"
          ],
          "notes": "Règles de conservation à préciser selon type de données.",
          "nextAction": "Créer une matrice conservation / archivage / destruction."
        },
        {
          "id": "con-thirdparty",
          "title": "Tiers et obligations contractuelles",
          "weight": 10,
          "owner": "Direction",
          "cadence": "Trimestrielle",
          "dueAt": "2026-05-02",
          "stage": "operating",
          "evidenceRefs": [
            "ev-010"
          ],
          "notes": "Le registre existe, la criticité et le suivi restent à renforcer.",
          "nextAction": "Classer les fournisseurs par criticité et lier les clauses sécurité."
        },
        {
          "id": "con-review",
          "title": "Preuves de revue et exceptions",
          "weight": 15,
          "owner": "Direction",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-30",
          "stage": "operating",
          "evidenceRefs": [
            "ev-012"
          ],
          "notes": "Bonne structure, manque encore des revues exécutées sur la durée.",
          "nextAction": "Ajouter la dernière revue mensuelle avec décisions d’exception."
        }
      ]
    },
    {
      "id": "privacy",
      "name": "Privacy",
      "globalWeight": 12,
      "objective": "Encadrer les renseignements personnels, leurs finalités, leurs droits et leur suppression.",
      "description": "Renseignements personnels, finalités, droits, conservation et incidents.",
      "milestones": [
        {
          "id": "pri-mapping",
          "title": "Cartographie des renseignements personnels",
          "weight": 20,
          "owner": "Direction",
          "cadence": "Trimestrielle",
          "dueAt": "2026-05-16",
          "stage": "operating",
          "evidenceRefs": [
            "ev-008"
          ],
          "notes": "Démarré, mais encore incomplet sur certains fournisseurs et flux secondaires.",
          "nextAction": "Finaliser la source, la finalité et la localisation pour chaque catégorie de RP."
        },
        {
          "id": "pri-rules",
          "title": "Règles de collecte et d’usage",
          "weight": 20,
          "owner": "Direction",
          "cadence": "Trimestrielle",
          "dueAt": "2026-05-18",
          "stage": "operating",
          "evidenceRefs": [
            "ev-008"
          ],
          "notes": "La doctrine existe, la démonstration opérationnelle est incomplète.",
          "nextAction": "Documenter explicitement les finalités et la minimisation."
        },
        {
          "id": "pri-rights",
          "title": "Droits et demandes des personnes",
          "weight": 20,
          "owner": "Direction",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-29",
          "stage": "absent",
          "evidenceRefs": [],
          "notes": "Aucun mécanisme simple et démontrable n’est encore en place.",
          "nextAction": "Créer un registre de demandes et une procédure courte de traitement."
        },
        {
          "id": "pri-retention",
          "title": "Conservation et suppression",
          "weight": 20,
          "owner": "Architecture",
          "cadence": "Trimestrielle",
          "dueAt": "2026-05-11",
          "stage": "operating",
          "evidenceRefs": [
            "ev-008"
          ],
          "notes": "Les règles existent partiellement par système, pas encore au niveau programme.",
          "nextAction": "Formaliser la matrice de rétention et les méthodes de suppression."
        },
        {
          "id": "pri-incidents",
          "title": "Incidents vie privée et tiers",
          "weight": 10,
          "owner": "Direction",
          "cadence": "Trimestrielle",
          "dueAt": "2026-05-09",
          "stage": "operating",
          "evidenceRefs": [
            "ev-010"
          ],
          "notes": "La zone tiers est présente, mais l’angle privacy est sous-documenté.",
          "nextAction": "Ajouter le scénario “incident touchant des RP” au registre d’incidents."
        },
        {
          "id": "pri-review",
          "title": "Revue périodique de conformité vie privée",
          "weight": 10,
          "owner": "Direction",
          "cadence": "Mensuelle",
          "dueAt": "2026-04-30",
          "stage": "absent",
          "evidenceRefs": [],
          "notes": "Pas encore de cycle récurrent de revue privacy.",
          "nextAction": "Instaurer une revue mensuelle compacte de conformité privacy."
        }
      ]
    }
  ],
  "auditorPacks": [
    {
      "id": "pack-1",
      "title": "System Description",
      "status": "ready",
      "requiredEvidence": [
        "ev-001",
        "ev-011"
      ],
      "description": "Périmètre, architecture, dépendances, flux de données, rôles et responsabilités."
    },
    {
      "id": "pack-2",
      "title": "Management Assertion",
      "status": "draft",
      "requiredEvidence": [
        "ev-012"
      ],
      "description": "Déclaration de la direction sur la fidélité de la description et l’efficacité opérationnelle."
    },
    {
      "id": "pack-3",
      "title": "Controls ↔ Evidence Matrix",
      "status": "ready",
      "requiredEvidence": [
        "ev-012"
      ],
      "description": "Matrice de rapprochement entre critères, jalons, contrôles, propriétaires et preuves."
    },
    {
      "id": "pack-4",
      "title": "Exceptions & Remediation Register",
      "status": "draft",
      "requiredEvidence": [
        "ev-009",
        "ev-010"
      ],
      "description": "Écarts connus, compensating controls, décisions et plan de remédiation."
    },
    {
      "id": "pack-5",
      "title": "Access & Privileged Activity Pack",
      "status": "draft",
      "requiredEvidence": [
        "ev-002"
      ],
      "description": "Revue des accès, privilèges, MFA et preuves de révocation."
    }
  ]
}