arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-pssi-template.md

@@ -0,0 +1,270 @@
+# Information System Security Policy (PSSI)
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-pssi`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-pssi` | [PENDING] | [PENDING] |
+
+---
+
+## Foreword
+
+[Signed statement from the highest authority endorsing the PSSI — typically the Minister, Secretary General, or Director General. Explains why information system security is a strategic priority for the organisation and commits to providing the necessary resources.]
+
+---
+
+## 1. Purpose and Scope
+
+### 1.1 Purpose
+
+This Information System Security Policy (PSSI) defines the security objectives, principles, and organisational framework for protecting the information systems of [ORGANISATION NAME]. It constitutes the reference document for all security measures and serves as the basis for the security plans of all projects and systems within scope.
+
+This PSSI is established in accordance with:
+
+- The Référentiel Général de Sécurité (RGS v2.0), published by ANSSI
+- Circulaire du Premier Ministre n°5926/SG on information systems security
+- [Any sector-specific obligations — OIV arrêté sectoriel, OSE designation, etc.]
+
+### 1.2 Scope
+
+| Element | In Scope | Out of Scope |
+|---------|---------|--------------|
+| Information systems | [List IS covered] | [List IS explicitly excluded] |
+| Sites and locations | [Sites covered] | [Sites excluded] |
+| Users | [All staff / specific categories] | [External parties under their own PSSI] |
+| Partner systems | [Interconnected systems assessed via EBIOS] | [Partner-owned systems not connected] |
+
+### 1.3 Relationship with Other Documents
+
+| Document | Relationship |
+|----------|-------------|
+| EBIOS Risk Manager study | Provides the threat and risk analysis that this PSSI addresses |
+| System-specific security plans (PSSI-S) | Implement this PSSI at the level of individual systems |
+| ANSSI hygiene guide (42 measures) | Baseline measures referenced in Section 6 |
+| Incident response plan | Operational procedure referenced in Section 8 |
+
+---
+
+## 2. Security Context
+
+### 2.1 Organisation Profile
+
+| Field | Value |
+|-------|-------|
+| Organisation name | [Name] |
+| Organisation type | [Ministry / Agency / Public institution / Local authority] |
+| Sector | [Health / Finance / Transport / Education / Other] |
+| OIV / OSE designation | [OIV — sector: X / OSE — sector: X / Not designated] |
+| RGS target level | [* / ** / *** — or N/A] |
+| Data classification | [Unclassified / DR / Mixed] |
+| Number of users | [Approximate] |
+| Number of information systems | [Approximate] |
+
+### 2.2 Essential Values
+
+The following assets are the primary objects of protection for this organisation:
+
+| Asset | Type | Criticality | Owner |
+|-------|------|-------------|-------|
+| [e.g. Citizen personal data] | Data | Critical | [DPO] |
+| [e.g. Core mission application] | Service | Critical | [IS Director] |
+| [e.g. Payment processing] | Process | Critical | [Finance Director] |
+
+### 2.3 Main Threats
+
+Based on the EBIOS Risk Manager study [reference document], the main threats identified are:
+
+| Threat | Source | Potential Impact |
+|--------|--------|-----------------|
+| [e.g. Ransomware attack] | Cybercriminals | Availability, data confidentiality |
+| [e.g. Data exfiltration] | Nation-state actors | Confidentiality of sensitive data |
+| [e.g. Insider threat] | Malicious or negligent staff | Integrity, availability |
+
+---
+
+## 3. Security Objectives
+
+### 3.1 Security Principles
+
+This PSSI is founded on the following principles:
+
+| # | Principle | Description |
+|---|-----------|------------|
+| P-01 | Need-to-know | Access to information is granted only when there is a demonstrated operational need |
+| P-02 | Least privilege | Users and systems operate with the minimum privileges required for their function |
+| P-03 | Defence in depth | Security controls are layered — no single control is relied upon exclusively |
+| P-04 | Separation of duties | Critical functions require involvement of multiple independent actors |
+| P-05 | Traceability | All access to sensitive information is logged and attributable to an individual |
+| P-06 | Proportionality | Security measures are proportionate to the value of assets and level of risk |
+| P-07 | Continuity | Security measures are designed to maintain mission continuity under degraded conditions |
+| P-08 | Resilience | Systems are designed to detect, resist, and recover from security incidents |
+
+### 3.2 Security Objectives by Property
+
+| Security Property | Objective | RGS Level |
+|------------------|-----------|-----------|
+| Confidentiality | Ensure that information is accessible only to authorised persons | [★ / ★★ / ★★★] |
+| Integrity | Ensure that information is accurate and has not been tampered with | [★ / ★★ / ★★★] |
+| Availability | Ensure that information systems are available when needed | [★ / ★★ / ★★★] |
+| Traceability | Ensure that all operations on information can be traced and attributed | [★ / ★★ / ★★★] |
+| Authentication | Ensure that the identity of users and systems is verified | [★ / ★★ / ★★★] |
+
+---
+
+## 4. Organisational Structure
+
+### 4.1 Roles and Responsibilities
+
+| Role | Title | Responsibilities |
+|------|-------|----------------|
+| Highest Authority (AA) | [Minister / DG / Secretary General] | Approves PSSI, accepts residual risks, grants homologation |
+| RSSI | Responsable de la Sécurité des SI | Defines and monitors security policy; reports to AA |
+| FSSI | Fonctionnaire de Sécurité des SI | Handles classified and DR information security |
+| CSSI | Correspondant SSI | IS security point of contact at operational level |
+| DPO | Data Protection Officer | Data protection compliance, GDPR / CNIL obligations |
+| IS Director | DSI / DNUM | Implements security measures in information systems |
+| Data owners | [Department heads] | Define sensitivity of their data assets |
+| Users | All staff | Comply with PSSI; report security incidents |
+
+### 4.2 Security Committee
+
+| Committee | Frequency | Attendees | Purpose |
+|-----------|-----------|-----------|---------|
+| Security Steering Committee | Quarterly | AA, RSSI, DSI | Review security posture, validate budget |
+| RSSI Operational Committee | Monthly | RSSI, CSSI, DSI teams | Review incidents, vulnerabilities, measure progress |
+| Homologation Board | On demand | AA, RSSI, system owner | Review and grant system homologation |
+
+---
+
+## 5. Applicable Standards and References
+
+| Standard / Guide | Applicability | Status |
+|-----------------|--------------|--------|
+| RGS v2.0 (ANSSI) | Mandatory for public IS | [Target level stated] |
+| Guide d'hygiène informatique ANSSI (42 measures) | Strongly recommended | [Compliance level — see ANSSI assessment] |
+| EBIOS Risk Manager | Risk analysis methodology | [Study reference] |
+| ISO 27001 / 27002 | International reference (optional) | [Certified / Applied / Not applied] |
+| [Sectoral arrêté (OIV)] | Mandatory if OIV | [Applicable sector] |
+| NIS2 / French transposition | Mandatory if OSE | [Status] |
+| RGPD / CNIL guidance | Mandatory | [CNIL assessment reference] |
+
+---
+
+## 6. Security Domains
+
+### 6.1 Access Management and Authentication
+
+- All access to information systems requires individual authentication
+- Administrative accounts use multi-factor authentication
+- Privileged access is managed through a Privileged Access Management (PAM) solution
+- Access rights are reviewed at least annually and on role change
+- RGS target level for authentication: [★ / ★★ / ★★★]
+
+### 6.2 Network Security
+
+- Network segmentation separates production, administration, and user zones
+- Inbound and outbound traffic filtered at network perimeter
+- Remote access only via approved VPN with strong authentication
+- Administration interfaces not exposed to the internet
+
+### 6.3 Workstation and Endpoint Security
+
+- All workstations managed and configured against an approved baseline
+- Endpoint detection and response (EDR) deployed on all workstations
+- Full-disk encryption on all laptops
+- Software installation restricted to approved applications
+
+### 6.4 Application Security
+
+- Applications developed following ANSSI secure development guidelines
+- Third-party applications approved before deployment
+- Patch management: critical patches applied within [30 days]; medium within [90 days]
+- Web applications protected by WAF where internet-exposed
+
+### 6.5 Data Protection
+
+- Data classified and handled according to sensitivity (public / internal / confidential / DR)
+- Sensitive data encrypted at rest and in transit
+- Data minimisation applied — only data necessary for the purpose is collected
+- Personal data subject to CNIL / GDPR requirements (see CNIL assessment [reference])
+
+### 6.6 Physical Security
+
+- Server rooms and data centres access controlled by badge
+- Screen lock activated after [15 minutes] of inactivity
+- Clear desk policy — sensitive documents secured when not in use
+- Visitor access to secure areas supervised and logged
+
+### 6.7 Business Continuity and Recovery
+
+- Business continuity plan (PCA) defined for critical systems
+- Recovery time objective (RTO): [X hours] for critical systems
+- Recovery point objective (RPO): [X hours] for critical systems
+- Backup and recovery tests conducted at least annually
+
+### 6.8 Vulnerability Management and Updates
+
+- Vulnerability scanning performed at least monthly on internet-exposed systems
+- CERT-FR advisories monitored and acted upon within [timeframe]
+- Penetration testing by PASSI-qualified provider at least every [2 years]
+
+---
+
+## 7. User Obligations
+
+All users of the organisation's information systems must:
+
+| Obligation | Detail |
+|-----------|--------|
+| Protect credentials | Never share passwords or authentication tokens |
+| Report incidents | Report any suspected security incident to [contact] immediately |
+| Follow acceptable use policy | Use IS only for professional purposes |
+| Protect sensitive information | Not share DR or confidential information with unauthorised parties |
+| Complete security training | Complete annual mandatory security awareness training |
+| Device security | Lock screen when leaving workstation; not use unmanaged devices for work |
+
+---
+
+## 8. Security Incident Management
+
+| Phase | Action | Responsible | Timeframe |
+|-------|--------|-------------|-----------|
+| Detection | Identify and confirm incident | All users / SOC | Immediate |
+| Declaration | Report to RSSI via [channel] | Discoverer | Within 1 hour |
+| Qualification | Assess severity and impact | RSSI + SOC | Within 4 hours |
+| Containment | Isolate affected systems | DSI / SOC | As soon as qualified |
+| Notification (NIS2 / ANSSI) | Notify ANSSI / CERT-FR if significant | RSSI | Within 24 hours |
+| Eradication and recovery | Remove threat, restore service | DSI | Per RTO |
+| Post-incident review | Root cause analysis, lessons learned | RSSI + DSI | Within 30 days |
+
+---
+
+## 9. PSSI Lifecycle
+
+| Trigger | Action |
+|---------|--------|
+| Annual review | RSSI assesses PSSI against current threat landscape and updates if needed |
+| Major architectural change | PSSI reviewed and updated if scope changes |
+| Security incident of significance | Post-incident review may trigger PSSI update |
+| New regulatory obligation | PSSI updated to reflect new requirements |
+| Homologation renewal | PSSI reviewed as part of homologation dossier |
+
+This PSSI is approved by the Highest Authority [NAME] on [DATE] and comes into force immediately.
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-pssi` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-rgpd-template.md

@@ -0,0 +1,195 @@
+# French GDPR / CNIL Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-rgpd`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-rgpd` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Area | Status | Key Findings |
+|------|--------|-------------|
+| CNIL Cookie Guidelines | [Compliant / Non-compliant / Partial] | [Summary] |
+| HDS Certification | [Required / Not required / In progress] | [Summary] |
+| DPO Registration | [Registered / Pending / N/A] | [Summary] |
+| DPIA Requirement | [Required / Not required] | [Summary] |
+| Breach Notification | [Process in place / Gap] | [Summary] |
+
+---
+
+## 1. CNIL Regulatory Framework
+
+### 1.1 Applicable Texts
+
+| Text | Reference | Applicability |
+|------|-----------|--------------|
+| GDPR | Regulation (EU) 2016/679 | [Yes / Partial] |
+| French Data Protection Act (Loi Informatique et Libertés) | Loi 78-17 amended 2018 | [Yes / No] |
+| CNIL Reference Frameworks (Référentiels) | CNIL website | [List applicable] |
+| CNIL Cookie Guidelines | Délibération 2020-091 | [Yes / No] |
+| Age of digital consent (15 years in France) | Art. 45 Loi 78-17 | [Yes / No — children in scope?] |
+
+### 1.2 CNIL Reference Frameworks
+
+| Framework | Sector / Use Case | Applicable | Status |
+|-----------|------------------|-----------|--------|
+| Référentiel Santé | Health data processing | ☐ | |
+| Référentiel RH | HR/employee data | ☐ | |
+| Référentiel Éducation | Education sector | ☐ | |
+| Référentiel Assurance | Insurance sector | ☐ | |
+| Référentiel Banque | Banking / financial | ☐ | |
+| Référentiel IA | AI systems processing personal data | ☐ | |
+
+## 2. Cookies and Trackers
+
+### 2.1 CNIL Cookie Guidelines (Délibération 2020-091)
+
+| Requirement | Status | Notes |
+|-------------|--------|-------|
+| Consent collected before any non-essential cookies | ☐ | |
+| Cookie banner clearly distinguishes Accept / Reject | ☐ | |
+| Reject option as prominent as Accept | ☐ | |
+| No pre-ticked consent boxes | ☐ | |
+| Consent withdrawal as easy as consent giving | ☐ | |
+| Consent valid for 6 months maximum | ☐ | |
+| List of cookies and their purposes disclosed | ☐ | |
+| Consent proof stored and auditable | ☐ | |
+| Strictly necessary cookies do not require consent | ☐ | |
+
+### 2.2 Cookie Categories
+
+| Category | Examples | Consent Required | Status |
+|----------|---------|-----------------|--------|
+| Strictly necessary | Session management, security | No | |
+| Analytics/audience measurement | Matomo (exempt if properly configured), Google Analytics | Yes (or exemption conditions) | |
+| Social media | Share buttons, embedded content | Yes | |
+| Advertising | Targeting, retargeting | Yes | |
+| Functional | Preferences, language | Depends | |
+
+> **Note**: Matomo Analytics is exempt from consent if configured per CNIL conditions (no cross-site tracking, anonymised IPs, opt-out available).
+
+## 3. Health Data (Données de Santé)
+
+### 3.1 HDS Certification Requirements
+
+[Complete if health data is processed]
+
+| Requirement | Reference | Status |
+|-------------|-----------|--------|
+| HDS certification required for hosting | ANS / Loi 2016-41 | ☐ |
+| Certified HDS host identified | ANS HDS list | ☐ |
+| HDS certification scope covers the service | Hébergeur agreement | ☐ |
+| ANSSI SecNumCloud alignment (if sensitive health data) | CNIL / ANS joint guidance | ☐ |
+
+### 3.2 ANS Security Framework
+
+| Requirement | Status |
+|-------------|--------|
+| ANS health IS security framework reviewed | ☐ |
+| Health data access audit trail in place | ☐ |
+| Health data breach notification to CNIL within 72h | ☐ |
+| Data Processing Agreement with HDS host in place | ☐ |
+
+## 4. Data Protection Officer (DPO)
+
+### 4.1 DPO Requirement Assessment
+
+| Entity Type | DPO Mandatory? |
+|-------------|---------------|
+| Public authority or public body | Yes (GDPR Art. 37(1)(a)) |
+| Large-scale systematic monitoring | Yes (GDPR Art. 37(1)(b)) |
+| Large-scale special category data | Yes (GDPR Art. 37(1)(c)) |
+| Other | Recommended |
+
+**DPO Mandatory for this project**: ☐ Yes ☐ No
+
+### 4.2 DPO Registration (CNIL)
+
+| Requirement | Status |
+|-------------|--------|
+| DPO designated | ☐ |
+| DPO registered with CNIL | ☐ |
+| CNIL registration number obtained | [Registration number] |
+| DPO contact details published on service | ☐ |
+
+## 5. Data Subject Rights (French Context)
+
+| Right | GDPR Article | French Specifics | Implementation Status |
+|-------|-------------|-----------------|----------------------|
+| Right of access (SAR) | Art. 15 | 30-day response deadline | ☐ |
+| Right to rectification | Art. 16 | — | ☐ |
+| Right to erasure | Art. 17 | — | ☐ |
+| Right to restriction | Art. 18 | — | ☐ |
+| Right to portability | Art. 20 | — | ☐ |
+| Right to object | Art. 21 | — | ☐ |
+| Rights re: automated decisions | Art. 22 | — | ☐ |
+| Right re: death (post-mortem) | Art. 85 Loi 78-17 | **French specificity** — digital legacy rights | ☐ |
+
+> **French specificity**: France's Loi Informatique et Libertés (Art. 85) grants specific rights over personal data after death (directives numériques posthumes) — not covered by GDPR itself.
+
+## 6. Children's Data
+
+### 6.1 Age of Digital Consent
+
+| Jurisdiction | Age of Consent | Verification Mechanism |
+|-------------|---------------|----------------------|
+| France | **15 years** (Art. 45 Loi 78-17) | Parental consent below 15 required |
+| EU (GDPR default) | 16 years | Member states may lower to 13 |
+
+| Requirement | Status |
+|-------------|--------|
+| Age verification mechanism implemented | ☐ |
+| Parental consent flow for under-15s | ☐ |
+| Child-friendly privacy notice available | ☐ |
+| Data minimisation applied for children | ☐ |
+
+## 7. CNIL Prior Authorisation and Declarations
+
+### 7.1 Processing Requiring Prior CNIL Consultation (Pre-GDPR remnants)
+
+| Processing Type | Requirement | Status |
+|----------------|-------------|--------|
+| Biometric data processing | Prior DPIA + possible CNIL consultation | ☐ |
+| Genetic data processing | DPIA required | ☐ |
+| Large-scale criminal conviction data | DPIA + CNIL consultation | ☐ |
+| Surveillance / CCTV | DPIA if systematic monitoring | ☐ |
+
+## 8. Breach Notification
+
+| Requirement | Deadline | Recipient | Status |
+|-------------|---------|-----------|--------|
+| Breach notification to CNIL | **72 hours** from awareness | CNIL (via notifications.cnil.fr) | ☐ |
+| Notification to affected individuals | Without undue delay | Individuals (if high risk) | ☐ |
+| Breach documentation | Ongoing | Internal breach register | ☐ |
+
+## 9. International Transfers
+
+| Transfer | Destination | Safeguard | Status |
+|----------|------------|-----------|--------|
+| [Data type] | [Country] | [SCC / BCR / Adequacy / None] | ☐ |
+
+> **Post-Schrems II**: Standard Contractual Clauses (SCCs) must be supplemented by a Transfer Impact Assessment (TIA) when transferring to non-adequate countries. CNIL has issued guidance on TIAs aligned with EDPB Recommendations 01/2020.
+
+## 10. Gap Analysis and Action Plan
+
+| Gap | Reference | Priority | Owner | Deadline |
+|-----|-----------|---------|-------|---------|
+| [Gap description] | [CNIL / GDPR / Loi 78-17] | 🔴 High | [Role] | [Date] |
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-rgpd` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-secnumcloud-template.md

@@ -0,0 +1,188 @@
+# SecNumCloud 3.2 Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-secnumcloud`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-secnumcloud` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+**Assessment scope**: [Description of the cloud procurement or hosting scenario]
+
+**Overall recommendation**: [Proceed with / Do not proceed with / Proceed conditionally with] [Provider/Option]
+
+**Key findings**:
+
+- [Finding 1]
+- [Finding 2]
+- [Finding 3]
+
+---
+
+## 1. Context and Scope
+
+### 1.1 Project Sensitivity Level
+
+[Describe data types, classification level, regulatory obligations]
+
+### 1.2 Applicable Regulatory Framework
+
+| Framework | Applicability | Source |
+|-----------|--------------|--------|
+| SecNumCloud 3.2 | [Required / Recommended / N/A] | ANSSI |
+| LPM (OIV obligations) | [Yes / No] | SGDSN |
+| NIS2 / OSE designation | [Yes / No] | ANSSI |
+| IGI 1300 | [Applicable / N/A] | SGDSN |
+| GDPR / CNIL | [Data categories] | CNIL |
+| DORA | [Financial sector / N/A] | EBA |
+
+## 2. SecNumCloud 3.2 Qualification Matrix
+
+### 2.1 Current Qualification Status (as of assessment date)
+
+| Provider | Product | Status | Scope | Valid Until | Notes |
+|----------|---------|--------|-------|-------------|-------|
+| S3NS (Thales/Google) | PREMI3NS | Qualified | IaaS/PaaS | TBC | Full SNCloud 3.2 — residual FISA-702 risk |
+| Outscale (Dassault) | Outscale Cloud | Qualified | IaaS | TBC | Best fit for air-gap scenarios |
+| OVHcloud | SecNumCloud offer | In progress | IaaS | TBC | Provisional Visa — monitor status |
+| Bleu (CapGemini/Orange/Microsoft) | Bleu | In progress | IaaS/PaaS/SaaS | TBC | Residual FISA-702 risk — Azure lineage |
+| NumSpot | NumSpot | In progress | IaaS | TBC | Banque des Territoires / Docaposte |
+| Cloud Temple | Trusted Cloud | Visa only | IaaS | TBC | Visa ≠ Qualification — procurement risk |
+
+> ⚠️ **Critical distinction**: A SecNumCloud **Visa** (provisional) does NOT confer the same assurance level as a full **Qualification**. Procurement documents must specify which level is required.
+
+### 2.2 Criteria Assessment for Shortlisted Providers
+
+| Criterion | Requirement | [Provider A] | [Provider B] |
+|-----------|-------------|-------------|-------------|
+| Extraterritorial immunity | No non-EU law applicable | [Status] | [Status] |
+| Sovereign personnel | EU nationals only for privileged access | [Status] | [Status] |
+| Data in France/EU | Data residency EU only | [Status] | [Status] |
+| Sovereign encryption | Keys controlled by customer | [Status] | [Status] |
+| ANSSI audit | Passed full ANSSI audit | [Status] | [Status] |
+
+Legend: ✅ Confirmed | ⚠️ Residual risk | 🔄 In progress | ❌ Not met
+
+## 3. Extraterritorial Legal Risk Assessment
+
+### 3.1 Risk Framework
+
+| Legislation | Jurisdiction | Mechanism | Risk Level |
+|-------------|-------------|-----------|------------|
+| Cloud Act | USA | Compelled disclosure to US law enforcement | 🔴 High for US-lineage providers |
+| FISA Section 702 | USA | Intelligence collection on non-US persons | 🔴 High for US-lineage providers |
+| ITAR / EAR | USA | Export control on defence-related data | 🟠 Medium — context dependent |
+| UK Investigatory Powers Act | UK | Post-Brexit surveillance powers | 🟡 Low for FR-hosted |
+
+### 3.2 Provider Exposure Matrix
+
+[Map each shortlisted provider against the extraterritorial legislation above]
+
+> ⚠️ **ANSSI position**: SecNumCloud 3.2 requires providers to demonstrate that no foreign law can compel data access. Providers with US parent companies carry residual FISA-702 risk that qualification does not fully eliminate.
+
+## 4. OIV/OSE Obligation Mapping
+
+### 4.1 OIV Obligations (LPM Article 22 + ANSSI sector orders)
+
+[Complete if project entity is designated OIV]
+
+| Obligation | Reference | Applicable | Status |
+|-----------|-----------|-----------|--------|
+| Critical Information System (SIIV) declaration | LPM Art. 22 | [Yes/No] | [Status] |
+| ANSSI sector-specific security rules | Sector order | [Yes/No] | [Status] |
+| Information system security accreditation (Homologation) | RGS v2.0 | [Yes/No] | [Status] |
+| ANSSI incident notification | LPM Art. 22 | [Yes/No] | [Status] |
+
+### 4.2 OSE Obligations (NIS2 transposition)
+
+[Complete if project entity is designated OSE under NIS2]
+
+| Obligation | Reference | Applicable |
+|-----------|-----------|-----------|
+| NIS security measures | ANSSI NIS guide | [Yes/No] |
+| Incident notification within 24h | NIS2 Art. 23 | [Yes/No] |
+| Security audit every 3 years | ANSSI | [Yes/No] |
+
+## 5. Architecture Recommendations
+
+### 5.1 Recommended Patterns for Sensitive Workloads
+
+**Pattern A — Full air-gap** (highly sensitive data, OIV/SIIV designation)
+
+- Dedicated infrastructure, no internet connectivity
+- Sovereign HSM for key management
+- Recommended provider: Outscale dedicated zones
+
+**Pattern B — Qualified sovereign cloud** (sensitive data, public administration)
+
+- SecNumCloud 3.2 qualified IaaS
+- Customer-managed encryption keys (BYOK/HYOK)
+- Recommended providers: Outscale, S3NS PREMI3NS (with FISA risk acceptance)
+
+**Pattern C — Sovereign hybrid cloud** (mixed-sensitivity data)
+
+- Sensitive workloads on qualified cloud
+- Non-sensitive on standard commercial cloud
+- Clear data classification and flow control required
+
+### 5.2 Key Management Requirements
+
+| Scenario | Recommendation |
+|---------|---------------|
+| Health data (HDS) | Sovereign HSM + HDS certification |
+| Classified data (DR level) | IGI 1300 compliant solution required |
+| Sensitive personal data | BYOK minimum, HYOK recommended |
+
+## 6. Procurement Guidance
+
+### 6.1 UGAP Catalogue Alignment
+
+[Identify available SecNumCloud-qualified services in the UGAP catalogue]
+
+| Category | UGAP Framework | Available Qualified Providers |
+|----------|---------------|------------------------------|
+| Sovereign IaaS | [UGAP ref] | [Providers] |
+| Encrypted storage | [UGAP ref] | [Providers] |
+
+### 6.2 Code de la Commande Publique Considerations
+
+- For lots above EU thresholds: JOUE publication required
+- Security clauses to include: data residency, sovereignty, right to audit, incident notification
+- Recommended contractual annexes: ANSSI security annex, GDPR data processing agreement, reversibility clause
+
+## 7. Residual Risk Register
+
+| Risk ID | Description | Likelihood | Impact | Mitigation |
+|---------|-------------|-----------|--------|------------|
+| SECNUM-R01 | No fully qualified provider for required SaaS category | Medium | High | Compensating controls + ANSSI consultation |
+| SECNUM-R02 | FISA-702 residual risk on US-lineage qualified provider | Low | High | Legal opinion + risk acceptance at appropriate level |
+| SECNUM-R03 | Qualification status changes during contract period | Low | Medium | Contractual clause requiring maintained qualification |
+
+## 8. Decision Matrix and Recommendation
+
+| Provider | SecNumCloud Status | Extraterritorial Risk | OIV Fit | Recommended |
+|---------|-------------------|----------------------|---------|-------------|
+| [Provider A] | [Status] | [Risk] | [Fit] | [Yes/No/Conditional] |
+| [Provider B] | [Status] | [Risk] | [Fit] | [Yes/No/Conditional] |
+
+**Recommendation**: [Shortlist with clear rationale]
+
+**Next steps**: Run `/arckit:fr-marche-public` for procurement procedure, `/arckit:eu-nis2` for NIS2 compliance mapping.
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-secnumcloud` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]