arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-code-reuse-template.md

@@ -0,0 +1,190 @@
+# Public Code Reuse Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-code-reuse`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-code-reuse` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Component Need | code.gouv.fr Match | SILL Match | Decision | Effort Saved |
+|---------------|-------------------|-----------|----------|-------------|
+| [Component 1] | [Yes / Partial / No] | [Yes / No] | [Reuse / Fork / Build] | [estimate] |
+| [Component 2] | | | | |
+
+**Build vs Reuse verdict**: [Reuse existing code for X% of components / Partial reuse for Y components / Build from scratch — justification]
+
+---
+
+## Legal Framework
+
+### Obligation to Reuse and Publish
+
+French public administrations are subject to two complementary obligations:
+
+**1. Reuse before build** (Circulaire PM n°6264-SG, 27 April 2021)
+Public administrations must search for and reuse existing public code before commissioning new development. This applies to all software developed or commissioned by the State.
+
+**2. Publish custom code** (Loi République Numérique, Art. 16; DINUM mission logiciels libres)
+Software developed by or for the administration must be published as open source, except where national security, trade secrets, or third-party rights prevent publication.
+
+| Obligation | Applicable | Rationale |
+|-----------|-----------|-----------|
+| Search for existing public code before building | [Yes / No] | [Rationale] |
+| Publish code developed for this project | [Yes / No / Partially] | [Rationale — exceptions if any] |
+| Use SILL-recommended software where available | [Yes — best practice] | |
+| Contribute improvements back upstream | [Yes — recommended] | |
+
+---
+
+## 1. Project Requirements Summary
+
+Features and components being assessed for reuse:
+
+| ID | Component / Feature | Technical Domain | Complexity | Priority |
+|----|--------------------|-----------------|-----------|---------|
+| COMP-01 | [e.g. Identity and authentication] | [IAM] | [High / Medium / Low] | [Must-have] |
+| COMP-02 | [e.g. Document management] | [ECM] | | |
+| COMP-03 | [e.g. API gateway] | [Integration] | | |
+
+---
+
+## 2. code.gouv.fr Assessment
+
+[code.gouv.fr](https://code.gouv.fr/sources/) lists open source code published by French public administrations. Search by keyword, domain, or technology.]
+
+### 2.1 Search Results
+
+| Component | Search Terms Used | Results Found | Best Match | Licence | Actively Maintained | Notes |
+|-----------|-----------------|---------------|-----------|---------|-------------------|-------|
+| COMP-01 | [keywords] | [N] | [Repo name or "None"] | [MIT / EUPL / LGPL] | [Yes / No / Unknown] | |
+| COMP-02 | | | | | | |
+
+### 2.2 Candidate Repository Assessment
+
+For each promising match from code.gouv.fr:
+
+| Field | COMP-01 Candidate | COMP-02 Candidate |
+|-------|------------------|------------------|
+| Repository | [URL] | [URL] |
+| Publishing entity | [Ministry / Agency] | |
+| Last commit | [YYYY-MM-DD] | |
+| Stars / forks | [N / N] | |
+| Open issues | [N] | |
+| Documentation quality | [Good / Partial / Poor] | |
+| Test coverage | [Stated %] | |
+| Community / contributors | [Active / Dormant] | |
+| Deployment complexity | [Docker / k8s / Manual] | |
+| Compatibility with project stack | [High / Medium / Low] | |
+| **Reuse recommendation** | [✅ Reuse / ⚠️ Fork / ❌ Build] | |
+
+---
+
+## 3. SILL Assessment (Socle Interministériel de Logiciels Libres)
+
+The [SILL](https://code.gouv.fr/sill/) is the recommended free and open source software list for French public administrations. Software on the SILL has been assessed by an interministerial working group and has a named referent in the French administration.
+
+### 3.1 SILL Matches
+
+| Component | SILL Software | Category | Status | Referent Ministry | Version | Notes |
+|-----------|-------------|---------|--------|------------------|---------|-------|
+| COMP-01 | [e.g. Keycloak] | [Identity] | [In use / Recommended] | [DINUM] | [v24] | |
+| COMP-02 | [e.g. Nextcloud] | [Collaboration] | | | | |
+
+### 3.2 SILL Compliance
+
+| SILL Requirement | Status | Notes |
+|-----------------|--------|-------|
+| SILL consulted before vendor selection | ☐ | |
+| SILL-listed alternatives documented where not chosen | ☐ | |
+| Rationale for not using SILL software documented | ☐ | |
+
+---
+
+## 4. European and International Public Code
+
+Beyond French public code, the following sources should be consulted:
+
+| Source | URL | Purpose |
+|--------|-----|---------|
+| Joinup (EU) | joinup.ec.europa.eu | EU institutions and member state public code |
+| GitHub government organisations | github.com/[ministry-slug] | Other nation government repositories |
+| eGovernment Core Vocabularies | data.europa.eu | EU semantic interoperability components |
+
+### 4.1 Joinup / EU Public Code Results
+
+| Component | EU Match | Publisher | Licence | Notes |
+|-----------|---------|---------|---------|-------|
+| COMP-01 | [Name or "None"] | [EU institution / Member state] | | |
+
+---
+
+## 5. Open Source Licence Compatibility
+
+For all reused components, verify licence compatibility with the project's intended licence.
+
+| Component | Candidate Licence | Project Licence | Compatible | Constraint |
+|-----------|-----------------|----------------|-----------|-----------|
+| COMP-01 | [MIT / EUPL / GPL v3] | [EUPL-1.2] | [Yes / No / Conditional] | [e.g. Copyleft requires publishing modifications] |
+
+**EUPL-1.2 note**: The European Union Public Licence is the recommended licence for public code in France (Circulaire 2021). It is compatible with GPL, LGPL, AGPL, and several other major open source licences.
+
+| Licence Type | Compatible with EUPL-1.2 | Notes |
+|-------------|--------------------------|-------|
+| MIT | Yes | Permissive |
+| Apache 2.0 | Yes | Permissive |
+| GPL v2 | Yes | Copyleft — project code becomes GPL |
+| GPL v3 | Yes | Copyleft |
+| LGPL | Yes | Weak copyleft |
+| AGPL | Yes | Strong copyleft — network use triggers obligation |
+| EUPL | Yes | Same licence |
+| Proprietary | No | Cannot integrate into open source project |
+
+---
+
+## 6. Contribution-Back Plan
+
+Where the project uses or forks existing public code, the Circulaire 2021 and DINUM mission logiciels libres encourage contributing improvements back upstream.
+
+| Component | Planned Contributions | Contribution Timeline | Upstream Repository |
+|-----------|---------------------|----------------------|---------------------|
+| COMP-01 | [Bug fixes / New feature / Documentation] | [Within project delivery] | [URL] |
+| COMP-02 | | | |
+
+---
+
+## 7. Decision Matrix
+
+| Component | Option | Total Effort | Risk | Recommendation | Justification |
+|-----------|--------|-------------|------|----------------|---------------|
+| COMP-01 | Reuse as-is | Low | Low | ✅ **Reuse** | Meets 90% of requirements, active community |
+| COMP-02 | Fork and adapt | Medium | Medium | ⚠️ **Fork** | Meets 60% of needs, requires 2 months adaptation |
+| COMP-03 | Build from scratch | High | High | ❌ **Build** | No existing solution matches — document justification |
+
+---
+
+## 8. Reused Components Register
+
+Final register of components selected for reuse. This feeds into procurement documentation and the software bill of materials (SBOM).
+
+| Component | Source | Repository | Version Pinned | Licence | Integration Method | Maintenance Owner |
+|-----------|--------|-----------|---------------|---------|-------------------|------------------|
+| [Name] | code.gouv.fr / SILL / Joinup / GitHub | [URL] | [v1.2.3] | [MIT] | [Dependency / Fork / API] | [Team] |
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-code-reuse` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-dinum-template.md

@@ -0,0 +1,195 @@
+# DINUM Standards Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-dinum`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-dinum` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Referential | Compliance Level | Critical Gaps | Next Review |
+|-------------|----------------|--------------|-------------|
+| State Cloud Doctrine | [Full / Partial / Non-compliant] | [Count] | [Date] |
+| RGI v2.0 | [Full / Partial / Non-compliant] | [Count] | [Date] |
+| RGAA 4.1 | [X%] | [Count] | [Date] |
+| RGESN | [X%] | [Count] | [Date] |
+| RGS v2.0 | [Full / Partial / Non-compliant] | [Count] | [Date] |
+
+---
+
+## 1. State Cloud Doctrine (Doctrine cloud de l'État — Circular 6264/SG)
+
+The French cloud-first policy mandates evaluation in order:
+
+1. Internal government cloud (cloud de l'État — Trusted Digital Space)
+2. Trusted commercial cloud (SecNumCloud-qualified offers)
+3. Standard commercial cloud (justified exception only)
+
+| Step | Assessment | Decision |
+|------|-----------|---------|
+| Internal government cloud evaluated? | ☐ Yes ☐ No | [Available / Not available] |
+| SecNumCloud offer evaluated? | ☐ Yes ☐ No | [Available / Not available / Selected] |
+| Standard cloud justified? | ☐ Yes ☐ No | [Justification if applicable] |
+| Data sensitivity classification | [Non-sensitive / Sensitive / Highly sensitive] | [Drives cloud tier] |
+
+## 2. RGI v2.0 — Interoperability
+
+### 2.1 Formats and Standards
+
+| Category | Recommended Standard (RGI) | Compliant |
+|---------|--------------------------|---------|
+| Document exchange | ODF, PDF/A | ☐ |
+| Structured data | XML, JSON, CSV | ☐ |
+| APIs | REST/JSON, OpenAPI 3.x | ☐ |
+| Geographic data | GML, GeoJSON, WMS/WFS | ☐ |
+| Identity federation | OpenID Connect, SAML 2.0 | ☐ |
+| Electronic signature | XAdES, PAdES, CAdES | ☐ |
+| Messaging | Standard email (SMTP/IMAP), MIME | ☐ |
+
+### 2.2 Interoperability Principles
+
+- [ ] Open standards preferred over proprietary formats
+- [ ] Published API documentation
+- [ ] Semantic interoperability (reference data aligned with national referentiels)
+- [ ] Technical interoperability tested across browsers/OS
+- [ ] Reversibility guaranteed (no vendor lock-in for public data)
+
+## 3. RGAA 4.1 — Digital Accessibility
+
+### 3.1 Legal Obligations
+
+| Entity | Legal Basis | Obligation |
+|--------|-----------|-----------|
+| State, EPAs, EICs > 250 agents | Loi 2005-102 + Décret 2019-768 | RGAA compliance mandatory |
+| Large private companies (> 250 employees + > €250M revenue) | Loi 2005-102 amended 2016 | RGAA compliance mandatory |
+| Others | — | Recommended |
+
+### 3.2 RGAA 4.1 Assessment Areas (106 criteria, 13 themes)
+
+| Theme | Criteria Count | Status | Critical Gaps |
+|-------|--------------|--------|--------------|
+| 1. Images | 9 | ☐ | |
+| 2. Frames | 4 | ☐ | |
+| 3. Colour | 9 | ☐ | |
+| 4. Multimedia | 13 | ☐ | |
+| 5. Tables | 11 | ☐ | |
+| 6. Links | 13 | ☐ | |
+| 7. Scripts | 8 | ☐ | |
+| 8. Mandatory elements | 8 | ☐ | |
+| 9. Information structure | 12 | ☐ | |
+| 10. Presentation of information | 12 | ☐ | |
+| 11. Forms | 15 | ☐ | |
+| 12. Navigation | 6 | ☐ | |
+| 13. Consultation | 9 | ☐ | |
+
+**Compliance rate**: [X]% — [Full / Partial / Non-compliant]
+
+### 3.3 Mandatory Publication Requirements
+
+- [ ] Accessibility statement (Déclaration d'accessibilité) published on service
+- [ ] Compliance rate declared (full / partial / non-compliant)
+- [ ] Exemptions documented
+- [ ] Feedback mechanism for accessibility issues
+- [ ] Multi-year accessibility scheme (schéma pluriannuel) published
+
+## 4. RGESN — Digital Service Ecodesign
+
+### 4.1 RGESN 2024 — 79 Criteria across 8 Categories
+
+| Category | Criteria Count | Status | Key Gaps |
+|---------|--------------|--------|---------|
+| 1. Strategy | 9 | ☐ | |
+| 2. Specifications | 19 | ☐ | |
+| 3. Architecture | 8 | ☐ | |
+| 4. UX/UI | 12 | ☐ | |
+| 5. Content | 9 | ☐ | |
+| 6. Frontend | 11 | ☐ | |
+| 7. Backend | 8 | ☐ | |
+| 8. Hosting | 3 | ☐ | |
+
+### 4.2 Hosting Sustainability
+
+| Requirement | Status |
+|-------------|--------|
+| Hosting provider PUE declared | ☐ |
+| Renewable energy share declared | ☐ |
+| French Green Cloud label considered | ☐ |
+| Hardware lifecycle (refurbished servers considered) | ☐ |
+
+## 5. RGS v2.0 — Information Systems Security
+
+### 5.1 RGS Security Levels
+
+| Level | Description | Applicable To |
+|-------|-------------|--------------|
+| RGS * | Basic — standard public service | Most citizen-facing services |
+| RGS ** | Enhanced — sensitive data | Health, justice, benefits |
+| RGS *** | Strong — very sensitive | Revenue, defence adjacents |
+
+**Target level for this service**: [RGS * / ** / ***]
+
+### 5.2 Key RGS Requirements
+
+| Requirement | RGS Level | Status |
+|-------------|----------|--------|
+| Security accreditation (Homologation) before go-live | All | ☐ |
+| State IS Security Policy (PSSIE) alignment | All | ☐ |
+| Cryptographic algorithm compliance (RGS Annex B) | All | ☐ |
+| Authentication strength (RGS Annex A) | Level-dependent | ☐ |
+| Electronic certificate from qualified TSP | Level-dependent | ☐ |
+
+### 5.3 Security Accreditation Process
+
+1. Risk analysis (ISO 27005 or EBIOS Risk Manager)
+2. Security architecture review
+3. Technical security testing
+4. Security accreditation file (Homologation dossier) submitted to Accreditation Authority (Autorité d'Homologation)
+5. Accreditation decision (with or without residual risks)
+6. Annual review or after significant change
+
+## 6. FranceConnect / ProConnect Integration
+
+[Complete if applicable — identity federation for public services]
+
+| Requirement | Status |
+|-------------|--------|
+| FranceConnect integration for citizen authentication | ☐ |
+| ProConnect for agent (civil servant) authentication | ☐ |
+| eIDAS Level of Assurance (LoA) required | [Low / Substantial / High] |
+| ANSSI eIDAS notification status of IDP verified | ☐ |
+
+## 7. DSFR — French State Design System
+
+[Complete if citizen-facing digital service]
+
+| Requirement | Status |
+|-------------|--------|
+| DSFR components used | ☐ |
+| Marianne font applied | ☐ |
+| République Française branding guidelines followed | ☐ |
+| Colour palette from DSFR | ☐ |
+| Accessibility already integrated in DSFR components leveraged | ☐ |
+
+## 8. Gap Analysis and Action Plan
+
+| Gap | Referential | Priority | Owner | Deadline |
+|-----|------------|---------|-------|---------|
+| [Gap description] | [RGI/RGAA/RGESN/RGS] | 🔴 High | [Role] | [Date] |
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-dinum` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-dr-template.md

@@ -0,0 +1,187 @@
+# Diffusion Restreinte Handling Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-dr`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-dr` | [PENDING] | [PENDING] |
+
+## Scope Statement
+
+> **Important distinction**: This assessment covers the **Diffusion Restreinte (DR)** mention only. DR is an administrative protection mention governed by II 901/SGDSN/ANSSI for electronic systems. It is **not** a classification level under IGI 1300 (which covers Confidentiel Défense and above). Systems handling IGI 1300 classified information require a separate defence security framework beyond the scope of this assessment.
+
+| Element | Value |
+|---------|-------|
+| System assessed | [System name and description] |
+| DR assets identified | [N document types / data categories] |
+| Production entity | [Ministry / Directorate / Agency] |
+| Receiving entities | [List of authorised recipients] |
+| Electronic systems in scope | [IS name(s) hosting DR documents] |
+
+---
+
+## 1. DR Asset Inventory
+
+Identify all information assets produced, processed, or transmitted by the system that carry or should carry the DR mention.
+
+| ID | Asset / Document Type | Origin | Volume (est.) | Current Classification | Should Be DR |
+|----|----------------------|--------|--------------|----------------------|--------------|
+| DR-DOC-01 | [e.g. Internal security reports] | [Directorate X] | [~N/month] | [Unclassified / DR] | [Yes / No] |
+| DR-DOC-02 | [e.g. Audit findings] | | | | |
+
+**DR marking criteria**: Apply DR when unauthorised disclosure would harm the interests of the French State or a third party, without reaching the level requiring formal classification under IGI 1300.
+
+---
+
+## 2. DR Marking and Labelling Rules
+
+### 2.1 Electronic Documents
+
+| Requirement | Rule | Status |
+|-------------|------|--------|
+| Header marking | "DIFFUSION RESTREINTE" centred at top of every page | ☐ |
+| Footer marking | "DIFFUSION RESTREINTE" centred at bottom of every page | ☐ |
+| Document metadata | DR mention in file properties / metadata | ☐ |
+| Watermark | Diagonal "DIFFUSION RESTREINTE" watermark on each page | ☐ |
+| Filename convention | File names must not reveal classified content | ☐ |
+| Version control | DR documents versioned and registered in DR registry | ☐ |
+
+### 2.2 DR Registry
+
+| Requirement | Status | Gap |
+|-------------|--------|-----|
+| Central DR document registry maintained | ☐ | |
+| Each DR document assigned a unique reference number | ☐ | |
+| Copies tracked (who holds which copy) | ☐ | |
+| Registry accessible only to authorised personnel | ☐ | |
+
+---
+
+## 3. Access Control
+
+| Requirement | Rule | Status |
+|-------------|------|--------|
+| Need-to-know principle | Access granted only to personnel with a demonstrable need | ☐ |
+| Individual authorisation | Explicit authorisation by the originating authority | ☐ |
+| No third-party sharing without authorisation | DR cannot be shared with external parties without explicit approval | ☐ |
+| Visitor and contractor access | DR documents not accessible to unauthorised visitors or contractors | ☐ |
+| Access revocation on role change | DR access revoked promptly on departure or role change | ☐ |
+
+### 3.1 Authorised Recipients
+
+| Recipient Entity | Authorised Role | Access Granted By | Date | Review Date |
+|-----------------|-----------------|-------------------|------|-------------|
+| [Directorate / Unit] | [Role description] | [Authority] | | |
+
+---
+
+## 4. Electronic Storage Requirements
+
+| Requirement | Rule | Status | Gap |
+|-------------|------|--------|-----|
+| Storage system qualification | DR must be stored on a system approved or qualified by ANSSI | ☐ | |
+| Encryption at rest | DR data encrypted with ANSSI-approved solution (minimum AES-256) | ☐ | |
+| Encryption key management | Keys managed separately from data, access restricted | ☐ | |
+| Logical access control | DR storage area access controlled by individual authentication | ☐ | |
+| Audit logging | All access to DR storage logged and retained minimum 1 year | ☐ | |
+| Backup encryption | Backups of DR data encrypted to same standard | ☐ | |
+| Cloud storage | Only on ANSSI-approved or SecNumCloud-qualified infrastructure | ☐ | |
+
+---
+
+## 5. Electronic Transmission Rules
+
+| Requirement | Rule | Status | Gap |
+|-------------|------|--------|-----|
+| Approved transmission channels | DR transmitted only on approved networks (RIE, VPN ANSSI-approved, or equivalent) | ☐ | |
+| No public internet | DR must not transit unencrypted public internet | ☐ | |
+| Email restrictions | DR must not be sent via standard email without ANSSI-approved encryption | ☐ | |
+| End-to-end encryption | Encryption applied before transmission, keys not shared with provider | ☐ | |
+| Recipient verification | Recipient identity and authorisation verified before transmission | ☐ | |
+| Transmission logging | All DR transmissions logged (sender, recipient, timestamp, document reference) | ☐ | |
+| Mobile devices | DR not transmitted to or stored on unmanaged personal mobile devices | ☐ | |
+
+### 5.1 Approved Transmission Channels
+
+| Channel | Type | ANSSI Status | Authorised For DR |
+|---------|------|-------------|------------------|
+| RIE (Réseau Interministériel de l'État) | Government network | Approved | Yes |
+| [VPN solution] | VPN | [ANSSI-qualified / Approved] | [Yes / No] |
+| [Secure messaging platform] | Messaging | [Status] | [Yes / No] |
+| Standard email (unencrypted) | Email | Not approved | No |
+| Consumer cloud (Google Drive, etc.) | Cloud storage | Not approved | No |
+
+---
+
+## 6. Physical Handling Rules
+
+| Requirement | Rule | Status |
+|-------------|------|--------|
+| Physical medium marking | All physical DR documents marked on cover and every page | ☐ |
+| Secure storage | DR documents stored in locked cabinet when not in use | ☐ |
+| Clear desk policy | DR documents not left unattended on desks | ☐ |
+| Printing restrictions | DR documents printed only on approved, supervised printers | ☐ |
+| Transport in sealed envelope | DR documents transported in opaque sealed envelopes marked DR | ☐ |
+| Registered mail or secure courier | Physical DR transmitted by registered post or secure courier | ☐ |
+
+---
+
+## 7. Destruction Requirements
+
+| Medium | Approved Method | Status |
+|--------|----------------|--------|
+| Paper documents | Cross-cut shredding (DIN 66399 P-4 or higher) or incineration | ☐ |
+| Electronic storage media (HDD, SSD) | ANSSI-approved degaussing + physical destruction or certified wiping (DoD 5220.22-M or equivalent) | ☐ |
+| USB drives / removable media | Physical destruction after ANSSI-approved wiping | ☐ |
+| Optical media | Physical destruction (shredding) | ☐ |
+| Destruction log | All DR destruction recorded in DR registry | ☐ |
+
+---
+
+## 8. Incident Reporting
+
+| Incident Type | Reporting Obligation | Deadline | Contact |
+|--------------|---------------------|---------|---------|
+| DR document loss or theft | Report to FSSI and hierarchy | Immediately | [FSSI contact] |
+| Unauthorised DR disclosure | Report to FSSI and SGDSN/ANSSI | Within 24 hours | [Contact] |
+| Suspected compromise of DR system | Report to FSSI and ANSSI CERT-FR | Within 4 hours | cert@ssi.gouv.fr |
+| Physical intrusion to DR storage area | Report to FSSI and security officer | Immediately | [Contact] |
+
+---
+
+## 9. System Compliance Checklist
+
+### 9.1 Information System Requirements for DR Processing
+
+| Requirement | Governing Text | Status | Gap |
+|-------------|---------------|--------|-----|
+| IS registered as DR-capable with FSSI | II 901 | ☐ | |
+| IS homologated for DR data | RGS / EBIOS study | ☐ | |
+| User accounts individual and authenticated | II 901 | ☐ | |
+| Session lock after inactivity (max 15 min) | II 901 | ☐ | |
+| Antivirus and endpoint protection active | II 901 | ☐ | |
+| Security patches applied within 30 days | II 901 | ☐ | |
+| Security event logs retained 1 year | II 901 | ☐ | |
+
+### 9.2 Gap Summary
+
+| Gap | Priority | Owner | Target Date |
+|-----|---------|-------|-------------|
+| [Gap description] | 🔴 High | [Role] | [Date] |
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-dr` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]