-
Notifications
You must be signed in to change notification settings - Fork 181
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
separate Annex 2 in a dedicated document
- Loading branch information
1 parent
4abc004
commit b72fce7
Showing
4 changed files
with
138 additions
and
116 deletions.
There are no files selected for viewing
138 changes: 138 additions & 0 deletions
138
backend/library/libraries/secnumcloud-3.2-annexe-2.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,138 @@ | ||
| urn: urn:intuitem:risk:library:secnumcloud-3.2-annexe-2 | ||
| locale: fr | ||
| ref_id: SecNumCloud v3.2-A2 | ||
| name: 'SecNumCloud v3.2 Annexe 2 : recommandations aux commanditaires' | ||
| description: "Premier ministre\nAgence nationale de la s\xE9curit\xE9 des syst\xE8\ | ||
| mes d\u2019information\nPrestataires de services d\u2019informatique en nuage (SecNumCloud)\n\ | ||
| r\xE9f\xE9rentiel d\u2019exigences\nVersion 3.2 du 8 mars 2022\nAnnexe 2 : recommandations\ | ||
| \ aux commanditaires" | ||
| copyright: ANSSI | ||
| version: 1 | ||
| provider: ANSSI | ||
| packager: intuitem | ||
| objects: | ||
| framework: | ||
| urn: urn:intuitem:risk:framework:secnumcloud-3.2-annexe-2 | ||
| ref_id: SecNumCloud v3.2-A2 | ||
| name: 'SecNumCloud v3.2 Annexe 2 : recommandations aux commanditaires' | ||
| description: "Premier ministre\nAgence nationale de la s\xE9curit\xE9 des syst\xE8\ | ||
| mes d\u2019information\nPrestataires de services d\u2019informatique en nuage\ | ||
| \ (SecNumCloud)\nr\xE9f\xE9rentiel d\u2019exigences\nVersion 3.2 du 8 mars 2022\n\ | ||
| Annexe 2 : recommandations aux commanditaires" | ||
| requirement_nodes: | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| assessable: false | ||
| depth: 1 | ||
| ref_id: Annexe 2 | ||
| name: 'Recommandations aux commanditaires ' | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node3 | ||
| assessable: false | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "Cette annexe liste les recommandations de l\u2019ANSSI aux commanditaires\ | ||
| \ de prestations d\u2019informatique en nuage." | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node4 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "a)\_\_\_\_ Le commanditaire peut, lorsqu\u2019il est une autorit\xE9\ | ||
| \ administrative ou un op\xE9rateur d\u2019importance vitale, demander \xE0\ | ||
| \ l\u2019ANSSI de participer \xE0 la d\xE9finition du cahier des charges faisant\ | ||
| \ l\u2019objet d\u2019un appel d\u2019offres ou d\u2019un contrat." | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node5 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "b)\_\_\_ Il est recommand\xE9 que le commanditaire choisisse son\ | ||
| \ prestataire dans le catalogue des prestataires qualifi\xE9s publi\xE9 sur\ | ||
| \ le site de l\u2019ANSSI, la qualification d\u2019un prestataire d\u2019\ | ||
| informatique en nuage attestant de sa conformit\xE9 \xE0 l\u2019ensemble des\ | ||
| \ exigences du pr\xE9sent r\xE9f\xE9rentiel." | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node6 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "c)\_\_\_\_ Pour b\xE9n\xE9ficier d\u2019une prestation qualifi\xE9\ | ||
| e, c\u2019est-\xE0-dire conforme \xE0 l\u2019ensemble des exigences du pr\xE9\ | ||
| sent r\xE9f\xE9rentiel, le commanditaire doit :" | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node7 | ||
| assessable: true | ||
| depth: 3 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node6 | ||
| description: "-\_\_\_\_\_\_\_ choisir le prestataire dans le catalogue des prestataires\ | ||
| \ qualifi\xE9s publi\xE9 sur le site de l\u2019ANSSI ;" | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node8 | ||
| assessable: true | ||
| depth: 3 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node6 | ||
| description: "-\_\_\_\_\_\_\_ exiger du prestataire de stipuler dans la convention\ | ||
| \ de service que la prestation r\xE9alis\xE9e est une prestation qualifi\xE9\ | ||
| e." | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node9 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "En effet, un prestataire qualifi\xE9 garde la facult\xE9 de r\xE9\ | ||
| aliser des prestations non qualifi\xE9es. Le recours \xE0 un prestataire issu\ | ||
| \ du catalogue des prestataires qualifi\xE9s est donc une condition n\xE9\ | ||
| cessaire mais pas suffisante pour b\xE9n\xE9ficier d\u2019une prestation qualifi\xE9\ | ||
| e, le commanditaire doit donc \xE9galement exiger une prestation qualifi\xE9\ | ||
| e." | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node10 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "d)\_\_\_ Il est recommand\xE9 que le commanditaire utilise le\ | ||
| \ guide d\u2019achat des produits de s\xE9curit\xE9 et des services de confiance\ | ||
| \ [GUIDE_ACHAT] qui a pour vocation \xE0 accompagner la fonction achat des\ | ||
| \ commanditaires lors des appels d\u2019offres." | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node11 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "e)\_\_\_\_ Le commanditaire peut, conform\xE9ment au processus\ | ||
| \ de qualification des prestataires de service de confiance [PROCESS_QUALIF],\ | ||
| \ d\xE9poser aupr\xE8s de l\u2019ANSSI une r\xE9clamation contre un prestataire\ | ||
| \ qualifi\xE9 pour lequel il estime que ce dernier n\u2019a pas respect\xE9\ | ||
| \ une ou plusieurs exigences du pr\xE9sent r\xE9f\xE9rentiel dans le cadre\ | ||
| \ d\u2019une prestation qualifi\xE9e." | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node12 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "S\u2019il s\u2019av\xE8re apr\xE8s instruction de la r\xE9clamation\ | ||
| \ que le prestataire n\u2019a pas respect\xE9 une ou plusieurs exigences du\ | ||
| \ pr\xE9sent r\xE9f\xE9rentiel dans le cadre d\u2019une prestation qualifi\xE9\ | ||
| e, et selon la gravit\xE9, la qualification du prestataire peut \xEAtre suspendue,\ | ||
| \ retir\xE9e ou sa port\xE9e de qualification r\xE9duite." | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node13 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "f)\_\_\_\_\_ La qualification d\u2019un prestataire n\u2019atteste\ | ||
| \ pas de sa capacit\xE9 \xE0 acc\xE9der ou \xE0 d\xE9tenir des informations\ | ||
| \ classifi\xE9es de d\xE9fense [IGI_1300]" | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node14 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "g)\_\_\_\_ La qualification d\u2019un prestataire n\u2019atteste\ | ||
| \ pas de sa capacit\xE9 \xE0 acc\xE9der ou \xE0 d\xE9tenir des articles contr\xF4\ | ||
| l\xE9s de la s\xE9curit\xE9 des syst\xE8mes d\u2019information (ACSSI) [II_910]." | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node15 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "h)\_\_\_ La conformit\xE9 du service du prestataire au r\xE9f\xE9\ | ||
| rentiel SecNumCloud ne se substitue pas aux exigences l\xE9gales ou r\xE9\ | ||
| glementaires applicables \xE0 certaines donn\xE9es sp\xE9cifiques telles que\ | ||
| \ les donn\xE9es de niveau Diffusion Restreinte ou les donn\xE9es de sant\xE9\ | ||
| . " | ||
| - urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:node16 | ||
| assessable: true | ||
| depth: 2 | ||
| parent_urn: urn:intuitem:risk:req_node:secnumcloud-3.2-annexe-2:annexe-2 | ||
| description: "i)\_\_\_\_\_ Pour l\u2019acc\xE8s aux interfaces de gestion du\ | ||
| \ service, il est recommand\xE9 que le commanditaire utilise des moyens (terminaux,\ | ||
| \ serveurs) d\xE9di\xE9s aux t\xE2ches d\u2019administration et conformes\ | ||
| \ aux recommandations du guide [NT_ADMIN]." |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
Binary file not shown.