arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-ebios-template.md

@@ -0,0 +1,209 @@
+# EBIOS Risk Manager — Risk Analysis Study
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-ebios`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-ebios` | [PENDING] | [PENDING] |
+
+## Study Summary
+
+| Workshop | Status | Key Outputs |
+|---------|--------|------------|
+| Workshop 1 — Study Framing | [Complete / In progress] | Scope, values, feared events |
+| Workshop 2 — Risk Sources | [Complete / In progress] | Risk source profiles, target pairs |
+| Workshop 3 — Strategic Scenarios | [Complete / In progress] | Attack paths, ecosystem threats |
+| Workshop 4 — Operational Scenarios | [Complete / In progress] | Technical attack scenarios |
+| Workshop 5 — Risk Treatment | [Complete / In progress] | Security measures, residual risks |
+
+| Overall Risk Level | [Acceptable / Acceptable under conditions / Not acceptable] |
+|---|---|
+| Residual Risks Accepted | [Pending / Accepted by Homologation Authority] |
+| Homologation Recommendation | [Proceed / Proceed with conditions / Do not proceed] |
+
+---
+
+## Workshop 1 — Study Framing (Cadrage de l'étude)
+
+### 1.1 Study Scope
+
+| Element | Description |
+|---------|------------|
+| System studied | [Name and brief description] |
+| Study boundary | [What is included / excluded] |
+| Interacting systems | [Connected external systems] |
+| Technical architecture summary | [Key components] |
+| Deployment environment | [Cloud / On-premise / Hybrid] |
+
+### 1.2 Essential Values (Valeurs métier)
+
+Values are business assets whose protection is the primary objective of the study.
+
+| ID | Value | Description | Owner |
+|----|-------|-------------|-------|
+| VM-01 | [Value name] | [Description] | [Owner] |
+| VM-02 | [Value name] | [Description] | [Owner] |
+
+### 1.3 Feared Events (Événements redoutés)
+
+For each essential value, identify feared events with severity.
+
+| ID | Feared Event | Affected Value | Severity | Justification |
+|----|-------------|---------------|---------|--------------|
+| ER-01 | [Event description] | VM-01 | 🔴 Critical / 🟠 Major / 🟡 Significant / 🟢 Negligible | [Justification] |
+
+**Severity scale** (ANSSI EBIOS RM): 1 Negligible / 2 Significant / 3 Major / 4 Critical
+
+### 1.4 Security Baseline
+
+| Measure | Reference | Status |
+|---------|-----------|--------|
+| ANSSI IT hygiene (42 measures) | Guide ANSSI | ☐ |
+| RGS v2.0 | ANSSI | ☐ |
+| ISO 27001 / 27002 | ISO | ☐ |
+| [Sector-specific measures] | [Reference] | ☐ |
+
+---
+
+## Workshop 2 — Risk Sources (Sources de risque)
+
+### 2.1 Risk Source Profiles
+
+A risk source is an entity (human, group, state, etc.) that can cause a feared event.
+
+| ID | Risk Source | Type | Motivation | Capability | Pertinence |
+|----|------------|------|-----------|-----------|-----------|
+| SR-01 | [e.g. State-sponsored attacker] | [External / Internal] | [Geopolitical, financial, ideological] | [High / Medium / Low] | ☐ Retained / ☐ Excluded |
+| SR-02 | [e.g. Organised cybercriminal] | [External] | [Financial] | [High] | ☐ Retained / ☐ Excluded |
+| SR-03 | [e.g. Malicious insider] | [Internal] | [Personal, ideological] | [Medium] | ☐ Retained / ☐ Excluded |
+| SR-04 | [e.g. Script kiddie / opportunist] | [External] | [Notoriety] | [Low] | ☐ Retained / ☐ Excluded |
+
+### 2.2 Risk Source — Target Pairs
+
+For each retained risk source, identify the most likely target within the system.
+
+| Pair ID | Risk Source | Target | Pertinence |
+|---------|------------|--------|-----------|
+| CO-01 | SR-01 | [Target in ecosystem or system] | ☐ Retained |
+| CO-02 | SR-02 | [Target] | ☐ Retained |
+
+---
+
+## Workshop 3 — Strategic Scenarios (Scénarios stratégiques)
+
+Strategic scenarios describe how a risk source reaches its target via the ecosystem (supply chain, third parties, trusted partners).
+
+### 3.1 Ecosystem Map
+
+| Stakeholder | Role | Trust Level | Dependency |
+|------------|------|-------------|-----------|
+| [Third-party provider] | [SaaS / Cloud / Integrator] | [High / Medium / Low] | [Critical / Important / Minor] |
+| [Partner / interconnected system] | [Description] | [Trust level] | [Dependency] |
+
+### 3.2 Strategic Scenarios
+
+| ID | Scenario | Risk Source Pair | Attack Path | Gravity | Likelihood | Risk Level |
+|----|---------|-----------------|------------|---------|-----------|-----------|
+| SS-01 | [e.g. Supply chain compromise via cloud provider] | CO-01 | [Cloud provider → API → Core system] | 🔴 4 | 🟠 3 | 🔴 Critical |
+| SS-02 | [e.g. Spear-phishing targeting administrator] | CO-02 | [External → Email → Privileged access] | 🟠 3 | 🔴 4 | 🔴 Critical |
+
+**Risk level** = max(Gravity, Likelihood) or matrix per ANSSI guide.
+
+### 3.3 Ecosystem Threats Summary
+
+| Stakeholder | Identified Threat | Existing Security Measures | Residual Level |
+|------------|------------------|--------------------------|---------------|
+| [Provider] | [Threat] | [Measures] | [Level] |
+
+---
+
+## Workshop 4 — Operational Scenarios (Scénarios opérationnels)
+
+Operational scenarios break down strategic scenarios into technical attack sequences.
+
+### 4.1 Operational Scenarios
+
+| ID | Scenario | Parent Strategic Scenario | Attack Sequence | Likelihood |
+|----|---------|--------------------------|----------------|-----------|
+| SO-01 | [Technical scenario description] | SS-01 | [1. Reconnaissance → 2. Initial access → 3. Lateral movement → 4. Impact] | 🟠 Probable |
+| SO-02 | [Technical scenario] | SS-02 | [Attack sequence] | 🔴 Very probable |
+
+**Likelihood scale**: 1 Unlikely / 2 Possible / 3 Probable / 4 Very probable
+
+### 4.2 Attack Pattern Mapping (MITRE ATT&CK)
+
+| Operational Scenario | MITRE Tactics | MITRE Techniques |
+|--------------------|--------------|-----------------|
+| SO-01 | [Initial Access, Execution] | [T1566 Phishing, T1059 Command Scripting] |
+| SO-02 | [Credential Access, Lateral Movement] | [T1078, T1021] |
+
+---
+
+## Workshop 5 — Risk Treatment (Traitement du risque)
+
+### 5.1 Risk Treatment Options
+
+For each significant risk (strategic + operational scenarios):
+
+| Risk | Treatment Option | Justification |
+|------|-----------------|--------------|
+| SS-01 / SO-01 | ☐ Reduce / ☐ Avoid / ☐ Transfer / ☐ Accept | [Rationale] |
+| SS-02 / SO-02 | ☐ Reduce / ☐ Avoid / ☐ Transfer / ☐ Accept | [Rationale] |
+
+### 5.2 Security Measures (Mesures de sécurité)
+
+| ID | Security Measure | Addresses Scenario | Type | Owner | Priority | Status |
+|----|----------------|------------------|------|-------|---------|--------|
+| MS-01 | [e.g. Multi-factor authentication for all admin access] | SO-02 | Technical | [Role] | 🔴 High | ☐ |
+| MS-02 | [e.g. Supply chain security clause in cloud contract] | SO-01 | Organisational | [Role] | 🔴 High | ☐ |
+| MS-03 | [e.g. Network segmentation for critical systems] | SO-01 | Technical | [Role] | 🟠 Medium | ☐ |
+
+### 5.3 Residual Risk Assessment
+
+After proposed security measures, reassess remaining risks.
+
+| Risk | Initial Level | Residual Level | Accepted? | Acceptance Authority |
+|------|-------------|--------------|-----------|---------------------|
+| SS-01 | 🔴 Critical | 🟠 Moderate | ☐ | [Autorité d'Homologation] |
+| SS-02 | 🔴 Critical | 🟡 Low | ☐ | [Autorité d'Homologation] |
+
+### 5.4 Risk Summary Dashboard
+
+| Level | Count | Risks |
+|-------|-------|-------|
+| 🔴 Critical residual risks | [N] | [List risk IDs] |
+| 🟠 Moderate residual risks | [N] | [List risk IDs] |
+| 🟡 Low residual risks | [N] | [List risk IDs] |
+
+### 5.5 Homologation Recommendation
+
+Based on the risk treatment analysis:
+
+- **Total security measures identified**: [N] (Technical: [N], Organisational: [N], Legal: [N])
+- **Residual risks submitted for acceptance**: [N]
+- **Critical residual risks**: [N]
+
+**Recommendation to Autorité d'Homologation**:
+
+> ☐ **Proceed with homologation** — All risks treated or accepted; residual risks are within acceptable tolerance.
+>
+> ☐ **Proceed with conditions** — Homologation can proceed if measures MS-[xxx] are implemented before go-live.
+>
+> ☐ **Do not proceed** — [N] critical residual risks remain unacceptable. Study must be repeated after additional measures.
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-ebios` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-irn-template.md

@@ -0,0 +1,311 @@
+# IRN — Indice de Résilience Numérique — Self-Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-irn`
+>
+> ⚠️ **Community-contributed** — not part of the officially-maintained ArcKit baseline.
+
+> **Note on methodology**: This document structures your IRN self-assessment but does not reproduce the aDRI scoring criteria for two explicit reasons:
+>
+> 1. **Living repository** — the IRN framework evolves actively at [gitlab.com/digitalresilienceinitiative/adri-irn](https://gitlab.com/digitalresilienceinitiative/adri-irn). Embedding a copy would create a frozen snapshot that diverges from the official methodology.
+>
+> 2. **Licence incompatibility** — the IRN is published under CC BY-NC-ND 4.0 (non-commercial, no derivatives). ArcKit is MIT (commercial use permitted). These licences are incompatible for derived content.
+>
+> **To score this document**: download the official aDRI evaluation grid at [gitlab.com/digitalresilienceinitiative/adri-irn](https://gitlab.com/digitalresilienceinitiative/adri-irn), apply R/NR criteria per pillar and layer, then report your scores below.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial scaffold from `/arckit:fr-irn` | PENDING | PENDING |
+
+## Executive Summary
+
+| Pillar | Score (0–100) | Trend | Priority Actions |
+|--------|--------------|-------|-----------------|
+| RES-1 Résilience Stratégique | [Score or TBD] | [↑ / → / ↓] | [Key actions] |
+| RES-2 Résilience Économique et Juridique | [Score or TBD] | | |
+| RES-3 Résilience Data & IA | [Score or TBD] | | |
+| RES-4 Résilience Opérationnelle | [Score or TBD] | | |
+| RES-5 Résilience Supply-Chain | [Score or TBD] | | |
+| RES-6 Résilience Technologique | [Score or TBD] | | |
+| RES-7 Résilience Sécurité | [Score or TBD] | | |
+| RES-8 Résilience Environnementale | [Score or TBD] | | |
+| **IRN Global Score** | **[Score or TBD]** | | |
+
+> **Scoring**: Apply the official aDRI R/NR criteria (available at the official repository) per pillar and organisational layer to derive the 0–100 score for each pillar. The global IRN score is a weighted aggregate — weights and thresholds are defined in the official evaluation grid.
+
+---
+
+## Scope
+
+### Organisational Layers in Scope
+
+| Layer | In Scope | Justification |
+|-------|----------|---------------|
+| **Applicative** — Applications, SaaS, business logic, AI models | ☐ | [Justification] |
+| **Data** — Data collection, quality, traceability, AI datasets | ☐ | [Justification] |
+| **Platform** — Dev/deploy/orchestration environments | ☐ | [Justification] |
+| **Infrastructure** — Cloud, compute, storage, network | ☐ | [Justification] |
+| **Compétences** — Human expertise, outsourcing level, change management | ☐ | [Justification] |
+
+---
+
+## RES-1 — Résilience Stratégique
+
+*Thematic areas: strategic technology vision & roadmap, independence strategy, IT governance*
+
+> **Scoring**: consult the official aDRI evaluation grid for the R/NR criteria for this pillar.
+
+### Observable context (from project artifacts)
+
+[Description of strategic technology decisions, roadmap commitments, governance structure identified from REQ/STKE/PRIN artifacts]
+
+### Scoring grid
+
+| Layer | Pre-populated observations | R / NR | Source |
+|-------|--------------------------|--------|--------|
+| Applicative | [Context from artifacts] | ? | [Artifact reference or "To assess via aDRI grid"] |
+| Data | [Context from artifacts] | ? | |
+| Platform | [Context from artifacts] | ? | |
+| Infrastructure | [Context from artifacts] | ? | |
+| Compétences | [Context from artifacts] | ? | |
+
+### Preliminary risk observations
+
+[Flag any obvious strategic dependency risks visible from existing artifacts — e.g., single-vendor lock-in, no documented exit strategy, absent IT governance structure]
+
+---
+
+## RES-2 — Résilience Économique et Juridique
+
+*Thematic areas: regulatory compliance (RGPD, AI Act, DORA, NIS2…), legal sovereignty, audit & certification*
+
+> **Scoring**: consult the official aDRI evaluation grid for the R/NR criteria for this pillar.
+> **Linked assessments**: `/arckit:eu-rgpd`, `/arckit:eu-nis2`, `/arckit:eu-ai-act`, `/arckit:eu-dora`
+
+### Observable context (from project artifacts)
+
+[Summary of regulatory compliance status from RGPD/CNIL/NIS2/AIACT artifacts if they exist]
+
+### Scoring grid
+
+| Layer | Pre-populated observations | R / NR | Source |
+|-------|--------------------------|--------|--------|
+| Applicative | | ? | |
+| Data | | ? | |
+| Platform | | ? | |
+| Infrastructure | | ? | |
+| Compétences | | ? | |
+
+### Preliminary risk observations
+
+[Flag regulatory gaps, extraterritorial law exposure (Cloud Act, FISA-702), missing DPAs, unresolved compliance obligations]
+
+---
+
+## RES-3 — Résilience Data & IA
+
+*Thematic areas: data control, AI infrastructure, ethics & transparency*
+
+> **Scoring**: consult the official aDRI evaluation grid for the R/NR criteria for this pillar.
+
+### Observable context (from project artifacts)
+
+[Data sovereignty measures, AI model ownership, data localisation commitments from DATA/REQ artifacts]
+
+### Scoring grid
+
+| Layer | Pre-populated observations | R / NR | Source |
+|-------|--------------------------|--------|--------|
+| Applicative | | ? | |
+| Data | | ? | |
+| Platform | | ? | |
+| Infrastructure | | ? | |
+| Compétences | | ? | |
+
+### Preliminary risk observations
+
+[Flag data trapped in proprietary formats, AI model dependency on third-party APIs, absence of data portability mechanisms]
+
+---
+
+## RES-4 — Résilience Opérationnelle
+
+*Thematic areas: business continuity, incident management, recovery plans*
+
+> **Scoring**: consult the official aDRI evaluation grid for the R/NR criteria for this pillar.
+> **Linked assessments**: `/arckit:fr-ebios`
+
+### Observable context (from project artifacts)
+
+[BCP/DRP status, RTO/RPO targets, incident response readiness from EBIOS/RISK artifacts]
+
+### Scoring grid
+
+| Layer | Pre-populated observations | R / NR | Source |
+|-------|--------------------------|--------|--------|
+| Applicative | | ? | |
+| Data | | ? | |
+| Platform | | ? | |
+| Infrastructure | | ? | |
+| Compétences | | ? | |
+
+### Preliminary risk observations
+
+[Flag single points of failure, absence of tested recovery procedures, undocumented incident escalation paths]
+
+---
+
+## RES-5 — Résilience Supply-Chain
+
+*Thematic areas: critical suppliers, diversification, contracts & SLAs*
+
+> **Scoring**: consult the official aDRI evaluation grid for the R/NR criteria for this pillar.
+
+### Observable context (from project artifacts)
+
+[Critical vendor list, SLA terms, exit clauses, concentration risks from RSCH/SOW/VEND artifacts]
+
+### Scoring grid
+
+| Layer | Pre-populated observations | R / NR | Source |
+|-------|--------------------------|--------|--------|
+| Applicative | | ? | |
+| Data | | ? | |
+| Platform | | ? | |
+| Infrastructure | | ? | |
+| Compétences | | ? | |
+
+### Preliminary risk observations
+
+[Flag critical single-vendor dependencies, absent exit clauses, SLAs below operational requirements, no secondary supplier]
+
+---
+
+## RES-6 — Résilience Technologique
+
+*Thematic areas: infrastructure & cloud, applications & SaaS, open source*
+
+> **Scoring**: consult the official aDRI evaluation grid for the R/NR criteria for this pillar.
+> **Linked assessments**: `/arckit:fr-secnumcloud`
+
+### Observable context (from project artifacts)
+
+[Cloud provider(s), qualification status (SecNumCloud/HDS/ISO 27001), open-source vs proprietary ratio from REQ/SECNUM artifacts]
+
+### Scoring grid
+
+| Layer | Pre-populated observations | R / NR | Source |
+|-------|--------------------------|--------|--------|
+| Applicative | | ? | |
+| Data | | ? | |
+| Platform | | ? | |
+| Infrastructure | | ? | |
+| Compétences | | ? | |
+
+### Preliminary risk observations
+
+[Flag non-EU cloud providers, unqualified hosting for sensitive data, proprietary format lock-in, missing open-source alternatives]
+
+---
+
+## RES-7 — Résilience Sécurité
+
+*Thematic areas: cybersecurity, data protection, risk management*
+
+> **Scoring**: consult the official aDRI evaluation grid for the R/NR criteria for this pillar.
+> **Linked assessments**: `/arckit:fr-anssi`, `/arckit:fr-ebios`, `/arckit:eu-nis2`
+
+### Observable context (from project artifacts)
+
+[Security posture from ANSSI/EBIOS/SECD artifacts — hygiene measures implemented, known gaps, NIS2 status]
+
+### Scoring grid
+
+| Layer | Pre-populated observations | R / NR | Source |
+|-------|--------------------------|--------|--------|
+| Applicative | | ? | |
+| Data | | ? | |
+| Platform | | ? | |
+| Infrastructure | | ? | |
+| Compétences | | ? | |
+
+### Preliminary risk observations
+
+[Flag missing security certifications, unresolved ANSSI hygiene gaps, absent CSIRT relationship, no penetration testing cadence]
+
+---
+
+## RES-8 — Résilience Environnementale
+
+*Thematic areas: carbon footprint, green IT, digital sustainability*
+
+> **Scoring**: consult the official aDRI evaluation grid for the R/NR criteria for this pillar.
+> **Linked assessments**: `/arckit:fr-dinum` (RGESN — Référentiel Général d'Écoconception des Services Numériques)
+
+### Observable context (from project artifacts)
+
+[Green IT commitments, RGESN compliance status, carbon measurement from DINUM/REQ artifacts]
+
+### Scoring grid
+
+| Layer | Pre-populated observations | R / NR | Source |
+|-------|--------------------------|--------|--------|
+| Applicative | | ? | |
+| Data | | ? | |
+| Platform | | ? | |
+| Infrastructure | | ? | |
+| Compétences | | ? | |
+
+### Preliminary risk observations
+
+[Flag absent carbon footprint measurement, non-RGESN-compliant services, no green cloud commitment, undocumented e-waste policy]
+
+---
+
+## Scoring Summary Matrix
+
+> Fill in after applying the official aDRI evaluation grid. R = Résilient | NR = Non Résilient | ? = Not yet assessed.
+
+| | Applicative | Data | Plateforme | Infrastructure | Compétences | Pillar Score |
+|---|------------|------|------------|---------------|------------|-------------|
+| **RES-1** Stratégique | ? | ? | ? | ? | ? | TBD |
+| **RES-2** Éco. & Juridique | ? | ? | ? | ? | ? | TBD |
+| **RES-3** Data & IA | ? | ? | ? | ? | ? | TBD |
+| **RES-4** Opérationnelle | ? | ? | ? | ? | ? | TBD |
+| **RES-5** Supply-Chain | ? | ? | ? | ? | ? | TBD |
+| **RES-6** Technologique | ? | ? | ? | ? | ? | TBD |
+| **RES-7** Sécurité | ? | ? | ? | ? | ? | TBD |
+| **RES-8** Environnementale | ? | ? | ? | ? | ? | TBD |
+| **IRN Global** | | | | | | **TBD / 100** |
+
+---
+
+## Gap Analysis and Action Plan
+
+| # | Gap | Pillar | Layer | Priority | Owner | Deadline |
+|---|-----|--------|-------|---------|-------|---------|
+| G-01 | [Gap description] | RES-[N] | [Layer] | 🔴 High | [Role] | [Date] |
+
+---
+
+## Certification Pathway
+
+The aDRI offers independent IRN labelling and certification for organisations wishing to formally validate and communicate their score:
+
+- **Self-assessment** (this document) — internal use, no certification
+- **Independent certification** — contact aDRI via [thedigitalresilience.org](https://thedigitalresilience.org/) — validation by accredited third party
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-irn` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]
+**IRN Framework**: aDRI IRN v0.4 — [gitlab.com/digitalresilienceinitiative/adri-irn](https://gitlab.com/digitalresilienceinitiative/adri-irn) — CC BY-NC-ND 4.0

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-marche-public-template.md

@@ -0,0 +1,178 @@
+# French Public Procurement File (Dossier de Consultation)
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-marche-public`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-marche-public` | [PENDING] | [PENDING] |
+
+---
+
+## 1. Threshold Analysis and Recommended Procedure
+
+| Parameter | Value |
+|-----------|-------|
+| Estimated total value (excl. VAT) | [Amount] |
+| Applicable threshold | [< €40k / < €215k / > €215k] |
+| Recommended procedure | [Below-threshold negotiated (MAPA) / Open tender / Restricted] |
+| Publication on BOAMP | [Yes / No] |
+| Publication on JOUE (EU Official Journal) | [Yes / No] |
+| Minimum consultation period | [X days] |
+
+### 1.1 State Cloud Doctrine (Doctrine cloud de l'État)
+
+[Complete if cloud services are involved — Circular 6264/SG of 5 July 2021]
+
+- [ ] Internal government cloud (cloud de l'État) evaluated
+- [ ] Trusted commercial cloud (SecNumCloud-qualified offer) evaluated
+- [ ] Justification for chosen option documented
+
+## 2. Requirements Statement
+
+### 2.1 Subject of the Contract
+
+[Concise description of the goods or services to be procured]
+
+### 2.2 Functional Requirements (from /arckit:requirements)
+
+[Extract FR-xxx requirements relevant to procurement scope]
+
+### 2.3 Technical Requirements
+
+| Requirement | Priority | Verification criterion |
+|-------------|----------|----------------------|
+| [NFR-xxx] [Description] | Mandatory / Desirable | [How verified] |
+
+### 2.4 Sovereignty and Security Requirements
+
+| Requirement | Reference framework | Mandatory |
+|-------------|--------------------|----|
+| Data hosting in France / EU | State Cloud Doctrine | Yes |
+| SecNumCloud qualification (if sensitive data) | ANSSI | Depends on classification |
+| HDS certification (if health data) | ANS | Yes |
+| RGS v2.0 compliance | ANSSI | Yes |
+| RGI v2.0 compliance (interoperability) | DINUM | Yes |
+| RGAA 4.1 accessibility | DINUM | Yes (public digital services) |
+| RGESN ecodesign | DINUM | Recommended |
+
+## 3. Award Criteria
+
+### 3.1 Weighting
+
+| Criterion | Weighting | Sub-criteria |
+|-----------|-----------|-------------|
+| Technical value | 60% | Functional fit (25%), Technical architecture (20%), Security/sovereignty (15%) |
+| Price | 30% | Total cost of ownership over [X] years |
+| Execution conditions | 10% | Timelines, reversibility, support |
+
+> Total must equal 100%. Adjust sub-criteria to match project priorities.
+
+### 3.2 Technical Scoring Grid
+
+| Sub-criterion | Score 0 | Score 1 | Score 2 | Score 3 |
+|--------------|---------|---------|---------|---------|
+| Functional fit | No coverage | Partial | Substantial | Full coverage |
+| Security/sovereignty | No compliance | Partial | Substantial | Full SecNumCloud/RGS |
+
+## 4. Security and Sovereignty Clauses
+
+### 4.1 Security Annex (mandatory)
+
+The services must comply with:
+
+- RGS v2.0 (security accreditation of the information system before go-live)
+- State Information Systems Security Policy (PSSIE)
+- ANSSI IT hygiene guide (42 measures)
+- [If OIV/OSE] Applicable sector-specific orders under LPM/NIS
+
+### 4.2 Data Localisation Clause
+
+All data processed under this contract must be hosted and processed exclusively within the territory of the European Union. The contractor must guarantee that no extra-European law (Cloud Act, FISA, etc.) can allow access to the data without prior agreement from the French authorities.
+
+### 4.3 Reversibility Clause
+
+In accordance with the DINUM reversibility circular:
+
+- Reversibility plan provided before project start
+- Data export in open formats (RGI-compliant)
+- Migration period: [X] months
+- Exit costs: included in contract price
+
+### 4.4 Open Source Clause
+
+[If applicable per State Cloud Doctrine Point 3]
+Specific developments carried out under this contract must be published as open source under [MIT / EUPL] licence unless otherwise justified.
+
+### 4.5 GDPR / Data Processing Agreement
+
+The contractor must provide a Data Processing Agreement (DPA) compliant with GDPR Article 28 covering:
+
+- Processing purposes and data categories
+- Sub-processor authorisation and list
+- Security measures (Article 32)
+- Data subject rights assistance
+- Return/deletion of data on contract end
+
+## 5. UGAP Catalogue — Available Framework Agreements
+
+[Check current catalogue at ugap.fr before finalising — framework agreements are updated regularly]
+
+| Category | UGAP Framework | Relevant lot | Listed providers |
+|----------|---------------|-------------|-----------------|
+| Sovereign cloud IaaS | [UGAP ref] | [Lot] | Outscale, OVHcloud, NumSpot |
+| Application development | [UGAP ref] | [Lot] | [Listed IT service firms] |
+| Cybersecurity services | [UGAP ref] | [Lot] | [PRIS-qualified providers] |
+| Managed services | [UGAP ref] | [Lot] | [Providers] |
+
+## 6. Indicative Timeline
+
+```mermaid
+gantt
+    title Procurement Timeline
+    dateFormat  YYYY-MM-DD
+    section Preparation
+    Procurement file drafting    :a1, 2024-01-01, 20d
+    Legal validation             :a2, after a1, 5d
+    section Publication
+    BOAMP/JOUE publication       :b1, after a2, 1d
+    Consultation period          :b2, after b1, 40d
+    section Award
+    Tender evaluation            :c1, after b2, 15d
+    Award notification           :c2, after c1, 5d
+    section Contracting
+    Contract signature           :d1, after c2, 10d
+```
+
+## 7. Digital State Doctrine Compliance
+
+### 7.1 DINUM Checklist
+
+- [ ] Cloud-first policy applied (Circular 6264/SG)
+- [ ] RGI v2.0 interoperability — open formats specified
+- [ ] RGAA 4.1 accessibility — mandatory clause included for public services
+- [ ] RGESN ecodesign — criteria included
+- [ ] Open source — publication policy defined
+- [ ] Personal data — DPA/GDPR required from contractor
+
+### 7.2 PSSIE and RGS
+
+- Target security level: [RGS * / ** / ***]
+- Security accreditation planned before go-live: [Yes / No]
+- Accreditation authority: [Name / role]
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-marche-public` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]