| Subject | Measure | State |
1 | Managing Data Security | Making security a shared concern and a priority for the management team | Validated |
Regularly assessing the effectiveness of implemented security measures and adopting a continuous improvement approach | Validated |
2 | Defining a framework for users | Drafting an IT charter including the terms of use of IT systems, security rules, and existing administrative measures | Validated |
Giving the charter binding force and reminding of the sanctions incurred in case of non-compliance | Validated |
3 | Engaging and training users | Raising awareness among individuals handling data | Validated |
Adapting the content of awareness sessions to the targeted audience and their tasks | Validated |
4 | Authenticating users | Assigning a unique identifier ("login") to each user | Validated |
Adopting a password policy compliant with CNIL recommendations | Validated |
Requiring users to change their automatically assigned or administrator-assigned password | Enhancement |
5 | Managing authorizations | Defining authorization profiles | Validated |
Removing outdated access permissions | Validated |
Conducting an annual review of authorizations | Validated |
6 | Securing workstations | Implementing an automatic session lock procedure | Validated |
Installing and configuring a software firewall | Validated |
Regularly using updated antivirus software | Validated |
Obtaining user consent before any intervention on their workstation | Validated |
7 | Securing mobile computing | Raising awareness among users about specific risks related to nomadism | Validated |
Implementing encryption methods for mobile devices | Validated |
Requiring a password for unlocking smartphones | Validated |
8 | Protecting the computer network | Limiting network traffic to what is strictly necessary | Validated |
Securing Wi-Fi networks, especially by implementing the WPA3 protocol | Validated |
Securing remote access to mobile computing devices through VPN | Validated |
Segmenting the network, including by setting up a DMZ (demilitarized zone) | Enhancement |
9 | Securing servers | Uninstalling or disabling unnecessary services and interfaces | Validated |
Limiting access to tools and administrative interfaces to authorized personnel only | Validated |
Promptly installing critical updates after testing, if necessary | Validated |
10 | Securing websites | Securing data exchange flows | Validated |
Ensuring that no confidential or personal data passes through URLs | Validated |
Verifying that user inputs match what is expected | Validated |
11 | Supervising IT developments | Taking data protection into account from the design stage | Validated |
Offering privacy-respecting settings by default | Validated |
Conducting thorough tests before making a product available or updating it | Enhancement |
Using fictitious or anonymized data for development and testing | Validated |
12 | Protecting premises | Restricting access to premises using locked doors | Validated |
Installing intrusion detection alarms and periodically checking them | Validated |
13 | Securing external exchanges | Encrypting data before transmission | Validated |
Ensuring that the correct recipient is targeted | Validated |
Transmitting the password separately and through a different channel | Validated |
14 | Managing subcontracting | Including specific clauses in subcontractor contracts | Validated |
Providing conditions for the return and destruction of data | Validated |
Ensuring the effectiveness of the planned guarantees (e.g., security audits, visits) | Validated |
15 | Supervising hardware and software maintenance and end-of-life | Recording maintenance interventions in a log | Validated |
Supervising third-party interventions by an organization's representative | Validated |
Erasing data from any equipment before disposal | Validated |
16 | Tracking operations | Planning a logging system | Validated |
Informing users about the implementation of the logging system | Validated |
Protecting logging equipment and logged information | Validated |
Regularly analyzing traces to detect incidents | Validated |
17 | Backing up | Performing regular backups | Validated |
Protecting backups, both during storage and transportation | Validated |
Regularly testing the restoration of backups and their integrity | In progress |
18 | Planning for business continuity and recovery | Planning for business continuity and recovery | Validated |
Conducting regular exercises | In progress |
19 | Managing incidents and breaches | Handling alerts raised by the logging system | Validated |
Providing
internal procedures and responsibilities for incident management,
including the procedure for notifying regulators of personal data
breaches | Validated |
20 | Risk analysis | Conducting a risk analysis, even minimal, on the envisaged data processing | Enhancement |
Monitoring the progress of the action plan decided after the risk analysis over time | Enhancement |
Regularly reviewing the risk analysis | Enhancement |
21 | Encryption, hashing, signing | Using recognized and secure algorithms, software, and libraries | Validated |
Securely storing secrets and cryptographic keys | Validated |
22 | Cloud: Cloud computing | Including cloud services in the risk analysis | Validated |
Evaluating the security provided by the supplier | Validated |
Ensuring the distribution of security responsibilities in the contract | Validated |
Ensuring the same level of security in the cloud as on-premises | Validated |
23 | Mobile applications: Design and development | Taking
into account the specificities of the mobile environment to reduce
collected personal data and limit requested permissions | |
Encapsulating communications in a TLS channel | |
Using the cryptographic suites of the operating system and hardware protections for secrets | |
24 | Artificial intelligence: Design and learning | Adopting applicable security best practices for software development | In progress |
Ensuring the quality and integrity of data used for learning and inference | In progress |
Documenting the operation and limitations of the system | In progress |
25 | API: Application programming interfaces | Organizing and documenting access security to APIs and data | Validated |
Limiting data sharing only to intended individuals and purposes | Validated |