doc-pol.yaml

urn: urn:intuitem:risk:library:doc-pol
locale: en
ref_id: doc-pol
name: Documents and policies
description: Typical documents and policies recommended by intuitem
copyright: "\xA9 intuitem - 2024"
version: 2
provider: intuitem
packager: intuitem
translations:
  fr:
    name: Documents et politiques
    description: "Documents et politiques typiques recommand\xE9s par intuitem"
objects:
  reference_controls:
  - urn: urn:intuitem:risk:function:doc-pol:doc.overview
    ref_id: DOC.OVERVIEW
    name: Organization overview document
    category: process
    description: 'Objectives of the organization

      Organigram

      ISMS objectives

      CISO responsibilities

      ISMS Management review'
    annotation: '5.1.a

      5.1.c'
    translations:
      fr:
        name: "Pr\xE9sentation de l\u2019organisation"
        description: "Objectifs organisationnels\nOrganigramme\nObjectifs de l\u2019\
          ISMS\nResponsabilit\xE9s du RSSI\nExamen de la direction du SMSI"
  - urn: urn:intuitem:risk:function:doc-pol:doc.context
    ref_id: DOC.CONTEXT
    name: Context of organization document
    category: process
    description: 'Stakeholders

      Authorities

      Special interest groups'
    annotation: '4.1, 4.2

      5.1.a

      A.5.6

      A.5.5'
    translations:
      fr:
        name: Contexte de l'organisation
        description: "Parties prenantes\nAutorit\xE9s\nGroupes d\u2019int\xE9r\xEA\
          ts"
  - urn: urn:intuitem:risk:function:doc-pol:doc.scope
    ref_id: DOC.SCOPE
    name: ISMS Scope document
    category: process
    description: 'Products and services

      Products and services requiring certification

      Locations

      Organization view

      Business architecture view

      Data architecture view

      Application architecture view

      Technology architecture view

      Network view

      Scope statement'
    annotation: '4.3'
    translations:
      fr:
        name: "P\xE9rim\xE8tre du SMSI"
        description: "Produits et services\nProduits et services n\xE9cessitant une\
          \ certification\nLocaux\nVue de l\u2019organisation\nVue de l\u2019architecture\
          \ d\u2019entreprise\nVue de l\u2019architecture des donn\xE9es\nVue de l\u2019\
          architecture d\u2019application\nVue de l\u2019architecture technologique\n\
          Vue r\xE9seau\n\xC9nonc\xE9 du champ d\u2019application"
  - urn: urn:intuitem:risk:function:doc-pol:doc.legal
    ref_id: DOC.LEGAL
    name: legal register
    category: process
    description: "Legal requirements \nStatutory requirements \nRegulatory  requirements\
      \ \nContractual requirements \nIntellectual property rights\nEmployment contracts\n\
      NDAs"
    annotation: 'A.5.31

      A.5.32

      A.6.5

      A.6.6'
    translations:
      fr:
        name: "Registre l\xE9gal"
        description: "Exigences l\xE9gales \nExigences l\xE9gales \nExigences r\xE9\
          glementaires \nExigences contractuelles \nDroits de propri\xE9t\xE9 intellectuelle\n\
          Contrats de travail\nNDA"
  - urn: urn:intuitem:risk:function:doc-pol:doc.soa
    ref_id: DOC.SOA
    name: Statement of Applicabilty document
    category: process
    translations:
      fr:
        name: "D\xE9claration d'applicabilit\xE9"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:doc.controls
    ref_id: DOC.CONTROLS
    name: Controls accountability matrix
    category: process
    annotation: 5.1.c
    translations:
      fr:
        name: "Matrice de responsabilit\xE9 des mesures"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:doc.audit_plan
    ref_id: DOC.AUDIT_PLAN
    name: Audit plan document
    category: process
    description: 'Context of the organization

      Leadership

      Planning

      Support

      Operation

      Performance evaluation

      Improvement

      Organizational controls

      People controls

      Physical controls

      Technological controls'
    annotation: 5.1.e
    translations:
      fr:
        name: Plan d'audit
        description: "Contexte de l\u2019organisation\nLeadership\nPlanification\n\
          Soutien\nOp\xE9ration\n\xC9valuation des performances\nAm\xE9lioration\n\
          Contr\xF4les organisationnels\nContr\xF4les du personnel\nContr\xF4les physiques\n\
          Contr\xF4les technologiques"
  - urn: urn:intuitem:risk:function:doc-pol:doc.competency
    ref_id: DOC.COMPETENCY
    name: Competency matrix
    category: process
    annotation: 5.1.f
    translations:
      fr:
        name: "Matrice de comp\xE9tence"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:doc.raci
    ref_id: DOC.RACI
    name: Responsibility matrix
    category: process
    description: RACI for ISMS
    translations:
      fr:
        name: "Matrice de responsabilit\xE9"
        description: RACI du SMSI
  - urn: urn:intuitem:risk:function:doc-pol:doc.com
    ref_id: DOC.COM
    name: Communication plan document
    category: process
    annotation: '7.4'
    translations:
      fr:
        name: Plan de communication
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:doc.risk_register
    ref_id: DOC.RISK_REGISTER
    name: Risk register
    category: process
    description: 'Risk owner

      Impact

      Likelihood

      Risk level

      Evaluation

      Priority

      Treatment option

      Mitigations - recommended security measures'
    annotation: "6.1\n6.1.2.c.2 \n6.1.2.d.1 \n6.1.2.d.2\n6.1.2.d.3 \n6.1.2.e.1 \n\
      6.1.2.e.2 \n6.1.3.a \n6.1.3.b "
    translations:
      fr:
        name: Registre des risques
        description: "Propri\xE9taire du risque\nImpact\nVraisemblance\nNiveau de\
          \ risque\n\xC9valuation\nPriorit\xE9\nOption de traitement\nMesures d\u2019\
          att\xE9nuation - mesures de s\xE9curit\xE9 recommand\xE9es"
  - urn: urn:intuitem:risk:function:doc-pol:doc.so_register
    ref_id: DOC.SO_REGISTER
    name: Security objectives register
    category: process
    annotation: '6.2'
    translations:
      fr:
        name: "registre des objectifs de s\xE9curit\xE9"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:doc.mgmt_review
    ref_id: DOC.MGMT_REVIEW
    name: Management review plan document
    category: process
    description: 'Review of risks

      Review of security objectives

      Review of security incidents

      Review of vulnerability management

      Review of non-conformities'
    annotation: "9.3\n6.1.1.e.1 \n6.2.e"
    translations:
      fr:
        name: Plan de la revue de management
        description: "Examen des risques\nExamen des objectifs de s\xE9curit\xE9\n\
          Examen des incidents de s\xE9curit\xE9\nExamen de la gestion des vuln\xE9\
          rabilit\xE9s\nExamen des non-conformit\xE9s"
  - urn: urn:intuitem:risk:function:doc-pol:doc.educ_register
    ref_id: DOC.EDUC_REGISTER
    name: Training and awareness register
    category: process
    annotation: '7.2'
    translations:
      fr:
        name: Registre de formation et sensibilisation
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:doc.doc_register
    ref_id: DOC.DOC_REGISTER
    name: Document register
    category: process
    description: 'Rules for edition and maintenance

      Version control

      Register

      Continual improvement'
    annotation: '7.5'
    translations:
      fr:
        name: Registre des documents
        description: "R\xE8gles d\u2019\xE9dition et de maintenance\nContr\xF4le de\
          \ version\nRegistre\nAm\xE9lioration continue"
  - urn: urn:intuitem:risk:function:doc-pol:doc.proc_register
    ref_id: DOC.PROC_REGISTER
    name: Operational procedures register
    category: process
    description: 'Risk management procdure

      Incident management procedure

      Problem management procedure

      Vulnerability management procedure

      HR procedures

      Change management procedure

      Procedure for externalization

      Physical security procedures

      Privileged access procedure'
    annotation: '8.1

      A.6.1

      8.1

      8.1.

      A.7.1

      A.8.2'
    translations:
      fr:
        name: "Registre des proc\xE9dures op\xE9rationnelles"
        description: "Processus de gestion des risques\nProc\xE9dure de gestion des\
          \ incidents\nProc\xE9dure de gestion des probl\xE8mes\nProc\xE9dure de gestion\
          \ des vuln\xE9rabilit\xE9s\nProc\xE9dures RH\nProc\xE9dure de gestion du\
          \ changement\nProc\xE9dure d\u2019externalisation\nProc\xE9dures de s\xE9\
          curit\xE9 physique\nProc\xE9dure d\u2019acc\xE8s privil\xE9gi\xE9"
  - urn: urn:intuitem:risk:function:doc-pol:doc.nc_log
    ref_id: DOC.NC_LOG
    name: Log of non-conformities
    category: process
    description: "List of non-conformities (incident, problems, \u2026)\nCorrective\
      \ action taken"
    annotation: '10.1'
    translations:
      fr:
        name: "Registre des non-conformit\xE9s"
        description: "Liste des non-conformit\xE9s (incident, probl\xE8mes, ...)\n\
          Mesures correctives prises"
  - urn: urn:intuitem:risk:function:doc-pol:doc.internal_rules
    ref_id: DOC.INTERNAL_RULES
    name: Rules of procedure document
    category: process
    annotation: A.5.4, A.6.2
    translations:
      fr:
        name: "R\xE8glement int\xE9rieur"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:doc.asset_register
    ref_id: DOC.ASSET_REGISTER
    name: Registry of assets
    category: process
    annotation: A.5.9
    translations:
      fr:
        name: Registre des biens
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:doc.supplier_register
    ref_id: DOC.SUPPLIER_REGISTER
    name: Registry of suppliers
    category: process
    description: Risk management
    translations:
      fr:
        name: Registre des fournisseurs
        description: Gestion des risques
  - urn: urn:intuitem:risk:function:doc-pol:pol.main
    ref_id: POL.MAIN
    name: Main policy
    category: policy
    description: 'information security objectives

      commitment

      Management review

      Applicable policies

      Management of non conformities

      Continual improvement'
    annotation: '5.2.b

      5.2.c

      9.3.1

      5.1.g'
    translations:
      fr:
        name: Politique principale
        description: "Objectifs de s\xE9curit\xE9 de l\u2019information\nengagement\n\
          Revue de direction\nPolitiques applicables\nGestion des non-conformit\xE9\
          s\nAm\xE9lioration continue"
  - urn: urn:intuitem:risk:function:doc-pol:pol.educ
    ref_id: POL.EDUC
    name: Information security awareness and traning policy
    category: policy
    description: 'implications of not respecting

      Security event reporting

      Continual improvement'
    annotation: '7.3.c

      A.6.8

      5.1.g'
    translations:
      fr:
        name: "Politique de sensibilisation et de formation \xE0 la s\xE9curit\xE9\
          \ de l\u2019information"
        description: "cons\xE9quences du non-respect\nRapports sur les \xE9v\xE9nements\
          \ de s\xE9curit\xE9\nAm\xE9lioration continue"
  - urn: urn:intuitem:risk:function:doc-pol:pol.work
    ref_id: POL.WORK
    name: Workstations and teleworking policy
    category: policy
    description: 'Workstations

      Mobile devices

      Teleworkding

      Password handling

      Returning of assets

      Continual improvement'
    annotation: 'A.6.2.1

      A.6.2.2

      A.5.11

      5.1.g'
    translations:
      fr:
        name: "Politique des postes de travail et de t\xE9l\xE9travail"
        description: "Postes\nAppareils mobiles\nT\xE9l\xE9travail\nGestion des mots\
          \ de passe\nRestitution des avoirs\nAm\xE9lioration continue"
  - urn: urn:intuitem:risk:function:doc-pol:pol.crypto
    ref_id: POL.CRYPTO
    name: Cryptographic policy
    category: policy
    description: 'Key management

      Encryption

      Continual improvement'
    annotation: 5.1.g
    translations:
      fr:
        name: Politique cryptographique
        description: "Gestion des cl\xE9s\nChiffrement\nAm\xE9lioration continue"
  - urn: urn:intuitem:risk:function:doc-pol:pol.classif
    ref_id: POL.CLASSIF
    name: Information classification and handling policy
    category: policy
    description: 'classification

      protection and handling of information

      Poritection and handling of PII

      clear desk

      clear screen

      Protection of records

      Retention rules

      Use of test information

      Continual improvement'
    annotation: 'A.5.12, A.5.13

      A.5.34

      A.5.33

      A.8.33

      5.1.g'
    translations:
      fr:
        name: "Politique de classification et de traitement de l\u2019information"
        description: "classification\nProtection et traitement des informations\n\
          Conservation et traitement des PII\nbureau d\xE9gag\xE9\n\xE9cran clair\n\
          Protection des registres\nR\xE8gles de conservation\nUtilisation des informations\
          \ de test\nAm\xE9lioration continue"
  - urn: urn:intuitem:risk:function:doc-pol:pol.audit
    ref_id: POL.AUDIT
    name: Internal and external audit policy
    category: policy
    description: Protection of audit information
    annotation: A.8.34
    translations:
      fr:
        name: "Politique d\u2019audit interne et externe"
        description: "Protection des informations d\u2019audit"
  - urn: urn:intuitem:risk:function:doc-pol:pol.bcp
    ref_id: POL.BCP
    name: Business continuity policy
    category: policy
    translations:
      fr:
        name: "Politique de continuit\xE9 d\u2019activit\xE9"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:pol.seg_duty
    ref_id: POL.SEG_DUTY
    name: Segregation of duties policy
    category: policy
    translations:
      fr:
        name: "Politique sur la s\xE9paration des t\xE2ches"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:pol.access
    ref_id: POL.ACCESS
    name: Access control policy
    category: policy
    description: 'Identification

      authentication

      password management

      RBAC

      Review of access rights

      Provisioning

      Leavers

      Remote access

      Privileged access management

      Third party access

      Monitoring and reporting

      Continual improvement'
    annotation: 'A.5.15

      5.1.g'
    translations:
      fr:
        name: "Politique de contr\xF4le d\u2019acc\xE8s"
        description: "Identification\nauthentification\nGestion des mots de passe\n\
          RBAC\nR\xE9vision des droits d\u2019acc\xE8s\nFourniture\nSortants\nAcc\xE8\
          s \xE0 distance\nGestion des acc\xE8s \xE0 privil\xE8ges\nAcc\xE8s par des\
          \ tiers\nSurveillance et rapports\nAm\xE9lioration continue"
  - urn: urn:intuitem:risk:function:doc-pol:pol.malware
    ref_id: POL.MALWARE
    name: Malware protection policy
    category: policy
    description: 'antivirus

      EDR'
    translations:
      fr:
        name: Politique de protection contre les logiciels malveillants
        description: 'antivirus

          EDR'
  - urn: urn:intuitem:risk:function:doc-pol:pol.risk
    ref_id: POL.RISK
    name: Risk management policy
    category: policy
    description: 'Risk management definition

      Risk appetite

      Risk acceptance criteria

      Criteria for risk assessment

      Risk identification

      Risk assessment

      CIAP approach

      Risk reporting

      Risk review

      Risk treatment (mitigation acceptance, transfer)

      Risk evaluation

      Use of ISO27002 controls

      Management of access rights

      Continual improvement'
    annotation: "6.1.2.a.1 \n6.1.2.a.2 \n6.1.2.b \n6.1.2.c.1 \n6.1.3.c \nA.5.18\n\
      5.1.g"
    translations:
      fr:
        name: Politique de gestion des risques
        description: "D\xE9finition de la gestion des risques\nApp\xE9tit pour le\
          \ risque\nCrit\xE8res d\u2019acceptation des risques\nCrit\xE8res d\u2019\
          \xE9valuation des risques\nIdentification des risques\n\xC9valuation du\
          \ risque\nApproche CIAP\nRapports sur les risques\nExamen des risques\n\
          Traitement des risques (att\xE9nuation, acceptation, transfert)\n\xC9valuation\
          \ des risques\nUtilisation des commandes ISO27002\nGestion des droits d\u2019\
          acc\xE8s\nAm\xE9lioration continue"
  - urn: urn:intuitem:risk:function:doc-pol:pol.asset
    ref_id: POL.ASSET
    name: Asset management policy
    category: policy
    translations:
      fr:
        name: "Politique de gestion d\u2019actifs"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:pol.backup
    ref_id: POL.BACKUP
    name: Backup and restore policy
    category: policy
    translations:
      fr:
        name: Politique de sauvegarde et de restauration
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:pol.supplier
    ref_id: POL.SUPPLIER
    name: Third party supplier security policy
    category: policy
    annotation: A.5.19, A.5.20, A.5.21, A.5.22, A.5.23
    translations:
      fr:
        name: "Politique de s\xE9curit\xE9 des fournisseurs tiers"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:pol.monitor
    ref_id: POL.MONITOR
    name: Logging and monitoring policy
    category: policy
    description: Logging
    annotation: A.8.15
    translations:
      fr:
        name: Politique de journalisation et de surveillance
        description: Journalisation
  - urn: urn:intuitem:risk:function:doc-pol:pol.transfer
    ref_id: POL.TRANSFER
    name: Information transfer policy
    category: policy
    annotation: A.5.14
    translations:
      fr:
        name: "Politique de transfert d\u2019informations"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:pol.secdev
    ref_id: POL.SECDEV
    name: Secure development policy
    category: policy
    translations:
      fr:
        name: "Politique de d\xE9veloppement s\xE9curis\xE9"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:pol.physical
    ref_id: POL.PHYSICAL
    name: Physical security policy
    category: policy
    description: 'Physical security perimeter

      Secure areas

      Employee access control

      Visitors access control

      Delivery management

      Cabling security

      Continual improvement'
    annotation: 5.1.g
    translations:
      fr:
        name: "Politique de s\xE9curit\xE9 physique"
        description: "P\xE9rim\xE8tre de s\xE9curit\xE9 physique\nZones s\xE9curis\xE9\
          es\nContr\xF4le d\u2019acc\xE8s des employ\xE9s\nContr\xF4le d\u2019acc\xE8\
          s des visiteurs\nGestion des livraisons\nS\xE9curit\xE9 du c\xE2blage\n\
          Am\xE9lioration continue"
  - urn: urn:intuitem:risk:function:doc-pol:pol.network
    ref_id: POL.NETWORK
    name: Network security management policy
    category: policy
    translations:
      fr:
        name: "Politique de gestion de la s\xE9curit\xE9 du r\xE9seau"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:pol.accept
    ref_id: POL.ACCEPT
    name: Acceptable use policy
    category: policy
    annotation: A.5.10
    translations:
      fr:
        name: "Politique d\u2019utilisation acceptable"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:pol.project
    ref_id: POL.PROJECT
    name: IS project integration policy
    category: policy
    translations:
      fr:
        name: "Politique d\u2019int\xE9gration de projets SI"
        description: null
  - urn: urn:intuitem:risk:function:doc-pol:pol.threat_intel
    ref_id: POL.THREAT_INTEL
    name: Threat intelligence policy
    category: policy
    description: 'Known Exploited Vulnerabilities

      Threat actors activity

      Continual improvement'
    annotation: 5.1.g
    translations:
      fr:
        name: Politique de renseignement sur les menaces
        description: "Vuln\xE9rabilit\xE9s exploit\xE9es connues\nActivit\xE9 des\
          \ acteurs de la menace\nAm\xE9lioration continue"
  - urn: urn:intuitem:risk:function:doc-pol:pol.incident
    ref_id: POL.INCIDENT
    name: IS incident management policy
    category: policy
    description: 'Security incident management

      Vulnerability management'
    annotation: A.5.24, A.5.25, A.5.26, A.5.27
    translations:
      fr:
        name: Politique de gestion des incidents du SI
        description: "Gestion des incidents de s\xE9curit\xE9\nGestion des vuln\xE9\
          rabilit\xE9s"
  - urn: urn:intuitem:risk:function:doc-pol:pol.maintenance
    ref_id: POL.MAINTENANCE
    name: Maintenance policy
    category: policy
    description: 'Obsolescence management

      Maintenance contracts

      Change management'
    annotation: A.7.13
    translations:
      fr:
        name: Politique de maintenance
        description: "Gestion de l\u2019obsolescence\nContrats de maintenance\nGestion\
          \ du changement"