convert_library_version: 'v2 ; Compat Mode: [0] {[v2.1] (DEFAULT) Don''t use any Compatibility
  Mode}'
urn: urn:groupe-schmidt:risk:library:nist-sp-800-82-annex-f
locale: en
ref_id: NIST-SP-800-82-Annex-F
name: NIST SP 800-82 Annex F
description: Library with annex F of NIST SP 800-82
copyright: NIST
version: 1
publication_date: 2025-07-22
provider: NIST
packager: Groupe-schmidt
translations:
  fr:
    name: NIST SP 800-82 Annexe F
    description: "Biblioth\xE8que contenant l\u2019annexe F du r\xE9f\xE9rentiel NIST\
      \ SP 800-82"
objects:
  framework:
    urn: urn:groupe-schmidt:risk:framework:nist-sp-800-82-annex-f
    ref_id: NIST-SP-800-82-Annex-F
    name: NIST SP 800-82 Annex F
    description: 'OT overlay is a partial adaptation of controls and control baselines
      NIST SP 800-53, Rev. 5, and adds additional EO-specific guidance.

      The concept of overlay is discussed in Annex C of NIST SP-800-53B. OT overlay
      is intended to apply to all OT systems in all industrial sectors. Further adaptation
      can add specificity to a particular sector (e.g., pipeline, energy, etc.). Ultimately,
      an overlay can be for a specific system (e.g., Company XYZ).

      This superimposition of OT constitutes an additional orientation and an adaptation
      for NIST SP 800-53, Rev. 5. Duplication of Annex F of NIST SP 800-53 would significantly
      increase the size of this publication, which is why it is not included here.

      The editorial team also considered that this OT overlay could serve as a template
      for other overlays.'
    translations:
      fr:
        name: NIST SP 800-82 Annexe F
        description: "La superposition d'OT est une adaptation partielle des contr\xF4\
          les et des lignes de base des contr\xF4les de la norme NIST SP 800-53, R\xE9\
          v. 5, et ajoute des orientations suppl\xE9mentaires sp\xE9cifiques \xE0\
          \ l'OT.\nLe concept de superposition est abord\xE9 dans l'annexe C de la\
          \ NIST SP-800-53B. La superposition OT est destin\xE9e \xE0 s'appliquer\
          \ \xE0 tous les syst\xE8mes OT\ndans tous les secteurs industriels. Une\
          \ adaptation plus pouss\xE9e peut ajouter une sp\xE9cificit\xE9 \xE0 un\
          \ secteur particulier (par exemple, pipeline, \xE9nergie, etc.). En fin\
          \ de compte, une superposition peut \xEAtre pour un syst\xE8me sp\xE9cifique\
          \ (par exemple, l'entreprise XYZ).\nCette superposition d'OT constitue une\
          \ orientation suppl\xE9mentaire et une adaptation pour NIST SP 800-53, R\xE9\
          v. 5. La duplication de l'annexe F de la norme NIST SP 800-53 augmenterait\
          \ consid\xE9rablement la taille de cette publication, c'est pourquoi elle\
          \ n'est pas incluse ici.\nL'\xE9quipe de r\xE9daction a \xE9galement consid\xE9\
          r\xE9 que cette superposition OT pourrait servir de mod\xE8le pour d'autres\
          \ superpositions."
    requirement_nodes:
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      assessable: false
      depth: 1
      ref_id: AC
      name: Access control
      translations:
        fr:
          name: "Contr\xF4le d'Acc\xE8s"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-1
      name: Policy and Procedures
      description: "Establishment of an access control policy and procedures aligned\
        \ with operational technology (OT) requirements. \n Define an access management\
        \ policy specific to OTs. \n Integrate OT requirements with non-OT systems.\
        \ \n  Manage access from external service providers."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "\xC9tablissement d'une politique de contr\xF4le d\u2019acc\xE8\
            s et de proc\xE9dures align\xE9es sur les exigences des technologies op\xE9\
            rationnelles (OT).\nD\xE9finir une politique de gestion des acc\xE8s sp\xE9\
            cifique aux OT.\nInt\xE9grer les exigences OT avec les syst\xE8mes non-OT.\n\
            \ G\xE9rer les acc\xE8s des prestataires externes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-2
      name: Account Management
      description: "Management of user accounts and their permissions on OT systems.\
        \ \n Restrict the creation of new accounts.  \n Deactivate inactive accounts.\
        \  \n Monitor account usage."
      translations:
        fr:
          name: Gestion des comptes
          description: "Gestion des comptes utilisateurs et de leurs permissions sur\
            \ les syst\xE8mes OT.\nRestreindre la cr\xE9ation de nouveaux comptes.\
            \ \nD\xE9sactiver les comptes inactifs. \nSurveiller l'utilisation des\
            \ comptes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-3
      name: Access Enforcement
      description: "Implement mechanisms to limit and enforce access restrictions\
        \ on OT resources. \n Use hardware and software mechanisms to control access.\
        \ \n  Restrict access to critical information."
      translations:
        fr:
          name: "Application des contr\xF4les d'acc\xE8s"
          description: "Mise en \u0153uvre de m\xE9canismes permettant de limiter\
            \ et d'appliquer les restrictions d'acc\xE8s aux ressources OT.\nUtiliser\
            \ des m\xE9canismes mat\xE9riels et logiciels pour contr\xF4ler les acc\xE8\
            s.\n Restreindre l\u2019acc\xE8s aux informations critiques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-4
      name: Information Flow Enforcement
      description: "Implementation of controls to regulate the flow of information\
        \ between OT systems and other IT systems. \n Define data filtering rules\
        \ between IT and OT.  \n Use industrial firewalls."
      translations:
        fr:
          name: Application du flux d'information
          description: "Mise en place de contr\xF4les pour r\xE9guler les flux d\u2019\
            informations entre les syst\xE8mes OT et autres syst\xE8mes informatiques.\n\
            D\xE9finir des r\xE8gles de filtrage des donn\xE9es entre IT et OT. \n\
            Utiliser des pare-feux industriels."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-5
      name: Separation of Duties
      description: "Prevent a user from having complete control over a critical process.\
        \ \n Assign roles and responsibilities in a manner that avoids conflict of\
        \ interest.  \n Separate critical tasks."
      translations:
        fr:
          name: "S\xE9paration des t\xE2ches"
          description: "Emp\xEAcher un utilisateur d\u2019avoir un contr\xF4le total\
            \ sur un processus critique.\nAttribuer les r\xF4les et responsabilit\xE9\
            s de mani\xE8re \xE0 \xE9viter tout conflit d\u2019int\xE9r\xEAt. \nS\xE9\
            parer les t\xE2ches critiques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-6
      name: Least Privilege
      description: "Strict privilege limitation of OT users and systems to minimize\
        \ risk. \n Restrict access to only necessary resources. \n  Disable accounts\
        \ with excessive privileges."
      translations:
        fr:
          name: "Principe du moindre privil\xE8ge"
          description: "Limitation stricte des privil\xE8ges des utilisateurs et syst\xE8\
            mes OT pour minimiser les risques.\nRestreindre l\u2019acc\xE8s aux seules\
            \ ressources n\xE9cessaires.\n D\xE9sactiver les comptes disposant de\
            \ privil\xE8ges excessifs."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-7
      name: Unsuccessful Logon Attempts
      description: "Implemented restrictions on repeated login attempts. \n Record\
        \ and report failed login attempts. \n  Apply a temporary lock."
      translations:
        fr:
          name: Tentatives de connexion infructueuses
          description: "Mise en place de restrictions sur les tentatives de connexion\
            \ r\xE9p\xE9t\xE9es.\nEnregistrer et signaler les tentatives de connexion\
            \ \xE9chou\xE9es.\n Appliquer un verrouillage temporaire."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-8
      name: System Use Notification
      description: "Inform users of the terms of use of the OT system before logging\
        \ in. \n Display a notification message before each connection.  \n Require\
        \ acceptance of terms."
      translations:
        fr:
          name: "Notification d'utilisation du syst\xE8me"
          description: "Informer les utilisateurs des conditions d'utilisation du\
            \ syst\xE8me OT avant connexion.\nAfficher un message de notification\
            \ avant chaque connexion. \nExiger l\u2019acceptation des conditions."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-10
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-10
      name: Concurrent Session Control
      description: "Limiting the number of active sessions for a user. \n Set a limit\
        \ on the number of concurrent connections. \n  Audit and monitor active sessions."
      translations:
        fr:
          name: "Contr\xF4le des sessions simultan\xE9es"
          description: "Limitation du nombre de sessions actives pour un utilisateur.\n\
            Fixer une limite au nombre de connexions simultan\xE9es.\n Auditer et\
            \ surveiller les sessions actives."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-11
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-11
      name: Device Lock
      description: "Securing OT terminals in case of inactivity. \n Set up an automatic\
        \ screen lock.  \n Restrict physical access to endpoints."
      translations:
        fr:
          name: Verrouillage des dispositifs
          description: "S\xE9curisation des terminaux OT en cas d\u2019inactivit\xE9\
            .\nConfigurer un verrouillage automatique des \xE9crans. \nRestreindre\
            \ l\u2019acc\xE8s physique aux terminaux."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-12
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-12
      name: Session Termination
      description: "Automatic closure of non-active sessions. \n Set a maximum amount\
        \ of idle time before closing. \n  Restrict persistent sessions."
      translations:
        fr:
          name: Terminaison de session
          description: "Fermeture automatique des sessions non actives.\nD\xE9finir\
            \ un temps maximal d'inactivit\xE9 avant fermeture.\n Restreindre les\
            \ sessions persistantes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-14
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-14
      name: Permitted Actions Without Identification or Authentication
      description: "Identifying actions that can be performed without authentication.\
        \ \n Limit anonymous access to low-risk transactions only.  \n Require authentication\
        \ for certain actions."
      translations:
        fr:
          name: "Actions autoris\xE9es sans identification ou authentification"
          description: "Identification des actions pouvant \xEAtre ex\xE9cut\xE9es\
            \ sans authentification.\nLimiter les acc\xE8s anonymes aux seules op\xE9\
            rations de faible risque. \nExiger une authentification pour certaines\
            \ actions."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-17
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-17
      name: Remote Access
      description: "Remote access control to OT systems.  \n Restrict remote access\
        \ to only authorized individuals.  \n Implement two-factor authentication."
      translations:
        fr:
          name: "Acc\xE8s \xE0 distance"
          description: "Contr\xF4le des acc\xE8s \xE0 distance aux syst\xE8mes OT.\
            \ \nRestreindre l\u2019acc\xE8s distant aux seules personnes autoris\xE9\
            es. \nMettre en place une double authentification."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-18
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-18
      name: Wireless Access
      description: "Regulation of wireless connections on OT networks. \n Restrict\
        \ the use of Wi-Fi connections.  \n Enforce WPA3 encryption and strong authentication."
      translations:
        fr:
          name: "Acc\xE8s sans fil"
          description: "R\xE9gulation des connexions sans fil sur les r\xE9seaux OT.\n\
            Restreindre l\u2019usage des connexions Wi-Fi. \nAppliquer un chiffrement\
            \ WPA3 et une authentification forte."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-19
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-19
      name: Access Control for Mobile Devices
      description: "Management of access to OT systems via mobile devices.  \n Prohibit\
        \ unauthorized access to OT systems from mobile devices. \n  Apply full encryption."
      translations:
        fr:
          name: "Contr\xF4le d'acc\xE8s aux appareils mobiles"
          description: "Gestion des acc\xE8s aux syst\xE8mes OT via appareils mobiles.\
            \ \nInterdire l\u2019acc\xE8s non autoris\xE9 aux syst\xE8mes OT depuis\
            \ des appareils mobiles.\n Appliquer un chiffrement total."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-20
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-20
      name: Use of External Systems
      description: "Control of interactions between OT and external systems. \n Limit\
        \ connections to trusted external systems.  \n Enforce strict device filtering."
      translations:
        fr:
          name: "Utilisation de syst\xE8mes externes"
          description: "Contr\xF4le des interactions entre syst\xE8mes OT et externes.\n\
            Limiter les connexions \xE0 des syst\xE8mes externes de confiance. \n\
            Appliquer un filtrage strict des p\xE9riph\xE9riques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-21
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-21
      name: Information Sharing
      description: "Management of information exchanges between OT and IT systems.\
        \ \n Define control procedures before any OT data is shared. \n  Apply encryption\
        \ mechanisms."
      translations:
        fr:
          name: Partage d'information
          description: "Gestion des \xE9changes d\u2019informations entre syst\xE8\
            mes OT et IT.\nD\xE9finir des proc\xE9dures de contr\xF4le avant tout\
            \ partage de donn\xE9es OT.\n Appliquer des m\xE9canismes de chiffrement."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac-22
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ac
      ref_id: AC-22
      name: Publicly Accessible Content
      description: "Protect sensitive OT information from public exposure. \n Verify\
        \ that the information published does not contain sensitive data. Apply audit\
        \ controls."
      translations:
        fr:
          name: Contenu accessible au public
          description: "Protection des informations OT sensibles contre une exposition\
            \ publique.\nV\xE9rifier que les informations publi\xE9es ne contiennent\
            \ pas de donn\xE9es sensibles. Appliquer des contr\xF4les d\u2019audit."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at
      assessable: false
      depth: 1
      ref_id: AT
      name: Awareness and Training
      translations:
        fr:
          name: Sensibilisation et Formation
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at
      ref_id: AT-1
      name: Policy and Procedures
      description: "Definition of cybersecurity awareness and training policies and\
        \ procedures adapted to OT (Operational Technology) environments.  \n Must\
        \ include the relationship between OT and non-OT systems.  Develop and document\
        \ a cybersecurity training policy for EO. Ensure compliance with EO-specific\
        \ requirements. Integrate the policy into the procedures for managing the\
        \ safety of industrial systems."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "D\xE9finition des politiques et proc\xE9dures de sensibilisation\
            \ et de formation en cybers\xE9curit\xE9 adapt\xE9es aux environnements\
            \ OT (Operational Technology). \nDoit inclure la relation entre les syst\xE8\
            mes OT et non-OT.  \xC9laborer et documenter une politique de formation\
            \ en cybers\xE9curit\xE9 pour l'OT. Assurer la mise en conformit\xE9 avec\
            \ les exigences sp\xE9cifiques aux OT. Int\xE9grer la politique dans les\
            \ proc\xE9dures de gestion de la s\xE9curit\xE9 des syst\xE8mes industriels.,"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at
      ref_id: AT-2
      name: Security Awareness Training
      description: "Cybersecurity awareness training including EO-specific policies,\
        \ security trends, and vulnerabilities.  \n Must be done during onboarding\
        \ and periodically.  Conduct initial and ongoing training sessions on OT security.\
        \  \n Integrate specific modules on potential attacks such as social engineering\
        \ and data exfiltration.  \n Tailor training to employees' level of responsibility.\
        \ Specific sub-measures"
      translations:
        fr:
          name: "Formation et sensibilisation \xE0 la cybers\xE9curit\xE9"
          description: "Formation \xE0\_ la sensibilisation en cybers\xE9curit\xE9\
            \ incluant les politiques sp\xE9cifiques \xE0\_ l'OT, les tendances de\
            \ s\xE9curit\xE9 et les vuln\xE9rabilit\xE9s. \nDoit \xEAtre effectu\xE9\
            e lors de l'int\xE9gration et de mani\xE8re p\xE9riodique.  Organiser\
            \ des sessions de formation initiale et continue sur la s\xE9curit\xE9\
            \ OT. \nInt\xE9grer des modules sp\xE9cifiques sur les attaques potentielles\
            \ comme l'ing\xE9nierie sociale et l'exfiltration de donn\xE9es. \nAdapter\
            \ la formation en fonction du niveau de responsabilit\xE9 des employ\xE9\
            s. Sous-mesures sp\xE9cifiques"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at-2(2)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at
      ref_id: AT-2(2)
      name: Insider Threat
      description: Specific training on insider threat and detection of suspicious
        behavior.
      translations:
        fr:
          name: Menace interne
          description: "Formation sp\xE9cifique sur la menace interne et la d\xE9\
            tection des comportements suspects.,"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at-2(3)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at
      ref_id: AT-2(3)
      name: Social Engineering and Mining
      description: Awareness of social engineering attacks and attempts to gather
        information.,
      translations:
        fr:
          name: "Ing\xE9nierie sociale et exploitation des donn\xE9es"
          description: "Sensibilisation aux attaques d'ing\xE9nierie sociale et aux\
            \ tentatives de collecte d'informations.,"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at-2(4)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at
      ref_id: AT-2(4)
      description: "Training on the recognition of abnormal behaviour in the EO. \
        \ \n  Example: A PLC remains in programming mode when it should be in execution\
        \ mode. An unexpected mouse movement on an HMI. \n  A parameter change without\
        \ operator action.,"
      translations:
        fr:
          name: "Communications suspectes et comportements anormaux du syst\xE8me"
          description: "Formation sur la reconnaissance des comportements anormaux\
            \ dans l'OT. \n Exemple: Un PLC restant en mode programmation alors qu'il\
            \ devrait \xEAtre en mode ex\xE9cution. Un mouvement inattendu de souris\
            \ sur un HMI.\n Un changement de param\xE8tre sans action de l'op\xE9\
            rateur.,"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at
      ref_id: AT-3
      name: Role-Based Training
      description: "Specialized training for the different roles involved in managing\
        \ OT systems. \n  Suitable for operators, engineers, supervisors, administrators,\
        \ etc.   \n Define training paths adapted to the responsibilities of each\
        \ role. \n  Train employees on the application of OT cybersecurity policies.\
        \  \n Provide case studies specific to OT incidents.\","
      translations:
        fr:
          name: "Formation \xE0 la s\xE9curit\xE9 bas\xE9e sur les r\xF4les"
          description: "Formation sp\xE9cialis\xE9e pour les diff\xE9rents r\xF4les\
            \ impliqu\xE9s dans la gestion des syst\xE8mes OT.\n Adapt\xE9e aux op\xE9\
            rateurs, ing\xE9nieurs, superviseurs, administrateurs, etc.  \nD\xE9finir\
            \ des parcours de formation adapt\xE9s aux responsabilit\xE9s de chaque\
            \ r\xF4le.\n Former les employ\xE9s sur l'application des politiques de\
            \ cybers\xE9curit\xE9 OT. \nFournir des \xE9tudes de cas sp\xE9cifiques\
            \ aux incidents OT.\","
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:at
      ref_id: AT-4
      name: Training Records
      description: "Maintaining training records to ensure compliance with regulatory\
        \ requirements and internal policies.   \n Implement a training management\
        \ system.  \n Track OT cybersecurity training participation and completion.\
        \  \n Conduct regular audits to verify that employees' skills are up to date."
      translations:
        fr:
          name: "Enregistrements de formation en s\xE9curit\xE9"
          description: "Maintien des enregistrements de formation pour assurer la\
            \ conformit\xE9 aux exigences r\xE9glementaires et aux politiques internes.\
            \  \nMettre en place un syst\xE8me de gestion des formations. \nSuivre\
            \ la participation et l'ach\xE8vement des formations en cybers\xE9curit\xE9\
            \ OT. \nR\xE9aliser des audits r\xE9guliers pour v\xE9rifier la mise \xE0\
            \_ jour des comp\xE9tences des employ\xE9s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      assessable: false
      depth: 1
      ref_id: AU
      name: Auditing and Accountability
      translations:
        fr:
          name: "Audit et Responsabilit\xE9"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-1
      name: Policy and Procedures
      description: "This requires organizations to define, document, and maintain\
        \ policies and procedures for auditing and accountability of OT systems. \n\
        \ Develop EO-specific logging policies.  \n Ensure that audit review procedures\
        \ are updated. Train staff on audit requirements."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "Cette mesure exige que les organisations d\xE9finissent, documentent\
            \ et maintiennent des politiques et proc\xE9dures pour l'audit et la responsabilit\xE9\
            \ des syst\xE8mes OT.\nD\xE9velopper des politiques de journalisation\
            \ sp\xE9cifiques aux OT. \nAssurer la mise \xE0\_ jour des proc\xE9dures\
            \ de revue d'audit. Former le personnel sur les exigences en mati\xE8\
            re d'audit."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-2
      name: Audit Events
      description: "Helps record critical events to ensure traceability and analysis\
        \ of suspicious activity. \n Include specific OT events like configuration\
        \ changes, alarms, and operator actions.  \n Deploy centralized logging solutions.\
        \ Perform regular log reviews for anomalies."
      translations:
        fr:
          name: "Journalisation des \xE9v\xE9nements"
          description: "Permet d'enregistrer les \xE9v\xE9nements critiques pour assurer\
            \ la tra\xE7abilit\xE9 et l'analyse des activit\xE9s suspectes.\nInclure\
            \ des \xE9v\xE9nements OT sp\xE9cifiques comme les changements de configuration,\
            \ les alarmes et les actions des op\xE9rateurs. \nD\xE9ployer des solutions\
            \ de journalisation centralis\xE9e. Effectuer des revues r\xE9guli\xE8\
            res des logs pour d\xE9tecter d'\xE9ventuelles anomalies."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-3
      name: Content of Audit Records
      description: "Defines the information that should be included in audit logs.\
        \ \n Ensure that the logs contain the date, time, user identity, event, and\
        \ system origin.  \n Verify the integrity of audit logs by implementing safeguards."
      translations:
        fr:
          name: "Contenu des enregistrements d\u2019audit"
          description: "D\xE9finit les informations qui doivent \xEAtre incluses dans\
            \ les journaux d'audit.\nS'assurer que les journaux contiennent la date,\
            \ l'heure, l'identit\xE9 de l'utilisateur, l'\xE9v\xE9nement et l'origine\
            \ du syst\xE8me. \nV\xE9rifier l'int\xE9grit\xE9 des journaux d'audit\
            \ en mettant en place des m\xE9canismes de protection."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-4
      name: Audit Log Storage Capacity
      description: "Ensures that audit logs are stored adequately to prevent the loss\
        \ of critical information. \n Deploy redundant and secure storage solutions.\
        \  \n Transfer logs to alternate storage when they are full."
      translations:
        fr:
          name: "Capacit\xE9 de stockage des journaux d\u2019audit"
          description: "Garantit que les journaux d'audit sont stock\xE9s de mani\xE8\
            re ad\xE9quate pour \xE9viter la perte d'informations critiques.\nD\xE9\
            ployer des solutions de stockage redondant et s\xE9curis\xE9. \nTransf\xE9\
            rer les journaux sur un stockage alternatif en cas de saturation."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-5
      name: Response to Audit Logging Process Failures
      description: "Implements measures to detect and respond to logging system failures.\
        \ \n Set up alerts when logging fails.  \n Establish a recovery plan for log\
        \ storage failures."
      translations:
        fr:
          name: "R\xE9ponse aux d\xE9faillances du processus de journalisation"
          description: "Met en place des mesures pour d\xE9tecter et r\xE9pondre aux\
            \ pannes du syst\xE8me de journalisation.\nConfigurer des alertes en cas\
            \ d'\xE9chec de la journalisation. \n\xC9tablir un plan de reprise pour\
            \ les pannes de stockage des logs."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-6
      name: Audit Record Review, Analysis, and Reporting
      description: "Requires regular review and analysis of audit logs for anomalous\
        \ behavior. \n Automate log analysis via SIEM tools.  \n Correlate OT and\
        \ IT logs for better anomaly detection. \n  Integrate OT systems auditing\
        \ with physical monitoring."
      translations:
        fr:
          name: "Revue, analyse et rapport d\u2019audit"
          description: "Exige l'examen et l'analyse r\xE9guli\xE8re des journaux d'audit\
            \ pour d\xE9tecter les comportements anormaux.\nAutomatiser l'analyse\
            \ des logs via des outils SIEM. \nCorr\xE9ler les journaux OT et IT pour\
            \ une meilleure d\xE9tection des anomalies.\n Int\xE9grer l'audit des\
            \ syst\xE8mes OT avec la surveillance physique."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-7
      name: Audit Record Reduction and Report Generation
      description: "Allows you to filter audit logs for easy analysis. \n Implement\
        \ analysis tools that enable the correlation and visualization of critical\
        \ events.  \n Develop summary reports for management and security teams."
      translations:
        fr:
          name: "R\xE9duction et g\xE9n\xE9ration de rapports d\u2019audit"
          description: "Permet de filtrer les journaux d'audit pour faciliter leur\
            \ analyse.\nImpl\xE9menter des outils d'analyse permettant la corr\xE9\
            lation et la visualisation des \xE9v\xE9nements critiques. \n\xC9laborer\
            \ des rapports synth\xE9tiques pour le management et les \xE9quipes de\
            \ s\xE9curit\xE9."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-8
      name: Time Stamps
      description: "Ensures that all recorded events are properly time-stamped to\
        \ enable reliable correlation. \n Synchronize system clocks with a trusted\
        \ time source.  \n Use NTP synchronization solutions adapted to OT constraints."
      translations:
        fr:
          name: "Horodatage des \xE9v\xE9nements"
          description: "Assure que tous les \xE9v\xE9nements enregistr\xE9s sont correctement\
            \ horodat\xE9s pour permettre une corr\xE9lation fiable.\nSynchroniser\
            \ les horloges syst\xE8me avec une source de temps de confiance. \nUtiliser\
            \ des solutions de synchronisation NTP adapt\xE9es aux contraintes OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-9
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-9
      name: Protection of Audit Information
      description: "Ensures that audit information is protected from tampering and\
        \ unauthorized access. \n Store logs on separate, protected systems.  \n Use\
        \ encryption to protect logs.  \n Restrict access to logs to authorized users\
        \ only."
      translations:
        fr:
          name: "Protection des informations d\u2019audit"
          description: "Garantit que les informations d'audit sont prot\xE9g\xE9es\
            \ contre les alt\xE9rations et les acc\xE8s non autoris\xE9s.\nStocker\
            \ les journaux sur des syst\xE8mes s\xE9par\xE9s et prot\xE9g\xE9s. \n\
            Utiliser le chiffrement pour prot\xE9ger les logs. \nRestreindre l'acc\xE8\
            s aux journaux aux seuls utilisateurs autoris\xE9s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-10
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-10
      name: Non-repudiation
      description: "Prevents a user from denying an action performed on the system.\
        \ \n Implement digital signatures for critical events.  \n Ensure logging\
        \ of access and changes on OT equipment."
      translations:
        fr:
          name: "Non-r\xE9pudiation"
          description: "Emp\xEAche un utilisateur de nier une action effectu\xE9e\
            \ sur le syst\xE8me.\nMettre en place des signatures num\xE9riques pour\
            \ les \xE9v\xE9nements critiques. \nAssurer la journalisation des acc\xE8\
            s et des modifications sur les \xE9quipements OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-11
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-11
      name: Audit Record Retention
      description: "Sets the retention period for audit logs to meet legal and organizational\
        \ requirements.c \n Determine the retention period based on internal policies\
        \ and regulations.  \n Implement mechanisms for archiving and securely deleting\
        \ old logs."
      translations:
        fr:
          name: "Conservation des enregistrements d\u2019audit"
          description: "D\xE9finit la dur\xE9e de conservation des journaux d'audit\
            \ pour r\xE9pondre aux exigences l\xE9gales et organisationnelles.c\n\
            D\xE9terminer la dur\xE9e de conservation en fonction des politiques internes\
            \ et des r\xE9glementations en vigueur. \nMettre en place des m\xE9canismes\
            \ d'archivage et de suppression s\xE9curis\xE9e des anciens journaux."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au-12
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:au
      ref_id: AU-12
      name: Audit Generation
      description: "Requires all systems to generate audit logs to ensure traceability\
        \ of actions. \n Integrate OT systems into the organization's logging scope.\
        \  \n Set strict rules about which events to log to avoid information overload."
      translations:
        fr:
          name: "G\xE9n\xE9ration des enregistrements d\u2019audit"
          description: "Exige que tous les syst\xE8mes g\xE9n\xE8rent des journaux\
            \ d'audit pour assurer la tra\xE7abilit\xE9 des actions.\nInt\xE9grer\
            \ les syst\xE8mes OT dans le p\xE9rim\xE8tre de journalisation de l'organisation.\
            \ \nD\xE9finir des r\xE8gles strictes sur les \xE9v\xE9nements \xE0\_\
            \ journaliser pour \xE9viter une surcharge d'informations."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca
      assessable: false
      depth: 1
      ref_id: CA
      name: Assessment, Authorization and Monitoring
      translations:
        fr:
          name: "\xC9valuation et Autorisation"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca
      ref_id: CA-1
      name: Policy and Procedures
      description: "This requires the establishment and implementation of specific\
        \ policies and procedures for the assessment, authorization and monitoring\
        \ of EO systems. \n Develop and document EO-friendly policies. \n Ensure that\
        \ procedures cover the particularities of OT systems.  \n Update policies\
        \ regularly to reflect new threats."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "Cette mesure impose l'\xE9tablissement et la mise en oeuvre\
            \ de politiques et proc\xE9dures sp\xE9cifiques \xE0\_ l'\xE9valuation,\
            \ l'autorisation et la surveillance des syst\xE8mes OT.\nD\xE9velopper\
            \ et documenter des politiques adapt\xE9es aux OT.\nAssurer que les proc\xE9\
            dures couvrent les particularit\xE9s des syst\xE8mes OT. \nMettre \xE0\
            \_ jour les politiques r\xE9guli\xE8rement pour refl\xE9ter les nouvelles\
            \ menaces."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca
      ref_id: CA-2
      name: Control Assessments
      description: "Control assessments are performed to determine whether security\
        \ and privacy controls are well implemented and functioning properly. \n Conduct\
        \ assessments by qualified EO assessors.  \n Minimize the impact of evaluations\
        \ on EO operations.  \n Schedule assessments during maintenance periods to\
        \ avoid interruptions.  \n Use offline copies or test environments to avoid\
        \ impacts to production systems."
      translations:
        fr:
          name: "\xC9valuation des contr\xF4les"
          description: "Les \xE9valuations des contr\xF4les sont effectu\xE9es pour\
            \ d\xE9terminer si les contr\xF4les de s\xE9curit\xE9 et de confidentialit\xE9\
            \ sont bien impl\xE9ment\xE9s et fonctionnent correctement.\nEffectuer\
            \ des \xE9valuations par des assesseurs qualifi\xE9s en OT. \nMinimiser\
            \ l'impact des \xE9valuations sur les op\xE9rations des OT. \nPlanifier\
            \ les \xE9valuations pendant les p\xE9riodes de maintenance pour \xE9\
            viter les interruptions. \nUtiliser des copies hors ligne ou des environnements\
            \ de test pour \xE9viter les impacts sur les syst\xE8mes de production."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca
      ref_id: CA-3
      name: Information Exchange
      description: "The exchange of information between OTs and other systems must\
        \ be controlled to minimize the risks associated with external connections.\
        \ \n Perform a risk analysis before connecting to an external system.  \n\
        \ Obtain approval from an authorized official before establishing connections.\
        \  \n Document the accepted risks and the mitigation measures put in place.\
        \  \n Establish secure protocols for exchanges between different security\
        \ zones."
      translations:
        fr:
          name: "\xC9change d\u2019informations"
          description: "L'\xE9change d'informations entre les OT et d'autres syst\xE8\
            mes doit \xEAtre contr\xF4l\xE9 pour minimiser les risques li\xE9s aux\
            \ connexions externes.\nEffectuer une analyse des risques avant toute\
            \ connexion \xE0\_ un syst\xE8me externe. \nObtenir l'approbation d'un\
            \ responsable autoris\xE9 avant d'\xE9tablir des connexions. \nDocumenter\
            \ les risques accept\xE9s et les mesures d'att\xE9nuation mises en place.\
            \ \n\xC9tablir des protocoles s\xE9curis\xE9s pour les \xE9changes entre\
            \ zones de s\xE9curit\xE9 diff\xE9rentes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca
      ref_id: CA-5
      name: Plan of Action and Milestones
      description: "Allows organizations to establish a plan to address identified\
        \ security gaps. \n Identify and document security vulnerabilities that need\
        \ to be patched.  \n Identify temporary mitigation measures if immediate correction\
        \ is not possible.  \n Plan the implementation of solutions taking into account\
        \ the operational constraints of the OTs."
      translations:
        fr:
          name: "Plan d\u2019actions et jalons (POAM)"
          description: "Permet aux organisations d'\xE9tablir un plan pour r\xE9soudre\
            \ les lacunes de s\xE9curit\xE9 identifi\xE9es.\nIdentifier et documenter\
            \ les failles de s\xE9curit\xE9 \xE0\_ corriger. \nD\xE9terminer des mesures\
            \ d'att\xE9nuation temporaires si la correction imm\xE9diate n'est pas\
            \ possible. \nPlanifier la mise en oeuvre des solutions en tenant compte\
            \ des contraintes op\xE9rationnelles des OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca
      ref_id: CA-6
      name: Authorization
      description: "The authorization of a system is based on a risk analysis and\
        \ validation that security measures are in place before operating it. \n Define\
        \ a formal authorization process. \n Conduct a security and risk assessment\
        \ before approving an EO system.  \n Consider EO-specific risks (e.g., physical\
        \ security, process safety). Document and archive licensing decisions."
      translations:
        fr:
          name: Autorisation
          description: "L'autorisation d'un syst\xE8me repose sur une analyse des\
            \ risques et la validation que les mesures de s\xE9curit\xE9 sont en place\
            \ avant de l'exploiter.\nD\xE9finir un processus formel d'autorisation.\n\
            Effectuer une \xE9valuation de la s\xE9curit\xE9 et des risques avant\
            \ d'approuver un syst\xE8me OT. \nTenir compte des risques sp\xE9cifiques\
            \ aux OT (p. ex., s\xE9curit\xE9 physique, suret\xE9 des processus). Documenter\
            \ et archiver les d\xE9cisions d'autorisation."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca
      ref_id: CA-7
      name: Continuous Monitoring
      description: "Provide continuous monitoring of OT systems for anomalies or deviations\
        \ in security controls. \n Implement an ongoing monitoring program that includes\
        \ EO staff.  \n Ensure that monitoring does not disrupt OT operations. \n\
        \ Automate the collection and analysis of event logs when possible. Adjust\
        \ the frequency of monitoring based on risks and operational requirements."
      translations:
        fr:
          name: Surveillance continue
          description: "Assurer une surveillance continue des syst\xE8mes OT pour\
            \ d\xE9tecter toute anomalie ou d\xE9viation des contr\xF4les de s\xE9\
            curit\xE9.\nMettre en place un programme de surveillance continue incluant\
            \ du personnel OT. \nGarantir que la surveillance ne perturbe pas les\
            \ op\xE9rations OT.\nAutomatiser la collecte et l'analyse des journaux\
            \ d'\xE9v\xE9nements lorsque possible. Ajuster la fr\xE9quence de surveillance\
            \ en fonction des risques et des exigences op\xE9rationnelles."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca
      ref_id: CA-8
      name: Penetration Testing
      description: "Penetration tests are performed to identify potential vulnerabilities\
        \ in OT systems. \n Carefully plan testing to avoid impacts to operations.\
        \ \n  Perform testing on a simulated system rather than on production.  \n\
        \ Organize testing during maintenance periods. Verify that testing does not\
        \ compromise industrial safety."
      translations:
        fr:
          name: "Test d\u2019intrusion"
          description: "Des tests d'intrusion sont r\xE9alis\xE9s pour identifier\
            \ les vuln\xE9rabilit\xE9s potentielles des syst\xE8mes OT.\nPlanifier\
            \ soigneusement les tests pour \xE9viter les impacts sur les op\xE9rations.\n\
            \ Effectuer les tests sur un syst\xE8me simul\xE9 plut\xF4t que sur la\
            \ production. \nOrganiser les tests pendant les p\xE9riodes de maintenance.\
            \ V\xE9rifier que les tests ne compromettent pas la s\xE0\xBBret\xE9 industrielle."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca-9
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ca
      ref_id: CA-9
      name: Internal System Connections
      description: "Internal connections to the OTs must be checked and documented.\
        \ \n Define a procedure for the secure destruction of critical components.\
        \  \n Follow e-waste disposal regulations.  \n Ensure traceability of disposed\
        \ components to avoid potential leaks."
      translations:
        fr:
          name: "Connexions aux syst\xE8mes internes"
          description: "Les connexions internes aux OT doivent \xEAtre contr\xF4l\xE9\
            es et document\xE9es.\nD\xE9finir une proc\xE9dure de destruction s\xE9\
            curis\xE9e des composants critiques. \nSuivre les r\xE9glementations en\
            \ mati\xE8re d'\xE9limination des d\xE9chets \xE9lectroniques. \nAssurer\
            \ la tra\xE7abilit\xE9 des composants \xE9limin\xE9s pour \xE9viter les\
            \ fuites potentielles."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm
      assessable: false
      depth: 1
      ref_id: CM
      name: Configuration management
      translations:
        fr:
          name: Gestion de la Configuration
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm
      ref_id: CM-1
      name: Policy and Procedures
      description: "Policy and Procedures Description: Establish and document a policy\
        \ and procedures for managing OT configurations. \n   Develop a configuration\
        \ management policy specific to OT systems. Define procedures for managing\
        \ hardware and software configurations. \n  Ensure that employees and contractors\
        \ understand and comply with these procedures."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "Policy and Procedures (Politique et Proc\xE9dures) Description\
            \ : \xC9tablir et documenter une politique et des proc\xE9dures pour la\
            \ gestion des configurations OT.\n  D\xE9velopper une politique de gestion\
            \ de configuration sp\xE9cifique aux syst\xE8mes OT. D\xE9finir des proc\xE9\
            dures pour la gestion des configurations mat\xE9rielles et logicielles.\n\
            \ S'assurer que les employ\xE9s et les sous-traitants comprennent et respectent\
            \ ces proc\xE9dures."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm
      ref_id: CM-2
      name: Baseline Configuration
      description: "Baseline Configuration Description: Maintain a baseline for OT\
        \ systems.  \n Document the initial system configurations and compare them\
        \ to the current configurations. Automate configuration management if possible.\
        \ \n  Keep a history of previous configurations for reference and recovery\
        \ when needed."
      translations:
        fr:
          name: Configuration de base
          description: "Baseline Configuration (Configuration de R\xE9f\xE9rence)\
            \ Description : Maintenir une configuration de r\xE9f\xE9rence pour les\
            \ syst\xE8mes OT. \nDocumenter les configurations syst\xE8me initiales\
            \ et les comparer aux configurations en cours. Automatiser la gestion\
            \ des configurations si possible.\n Conserver un historique des configurations\
            \ ant\xE9rieures pour r\xE9f\xE9rence et restauration en cas de besoin."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm
      ref_id: CM-3
      name: Configuration Change Control
      description: "Manage changes to OT configurations through a formal process.\
        \   \n Establish a process for requesting and approving configuration changes.\
        \  \n Test and validate changes before they are released to production. Document\
        \ all changes made to systems."
      translations:
        fr:
          name: "Contr\xF4le des changements de configuration"
          description: "G\xE9rer les modifications des configurations OT \xE0 travers\
            \ un processus formel.  \n\xC9tablir un processus de demande et d'approbation\
            \ des changements de configuration. \nTester et valider les modifications\
            \ avant leur mise en production. Documenter toutes les modifications effectu\xE9\
            es sur les syst\xE8mes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm
      ref_id: CM-4
      name: Impact Analysis
      description: "Analyze the impacts of configuration changes on the security and\
        \ availability of OT systems.  \n Perform tests in a separate environment\
        \ before applying a change.  \n Verify that new configurations meet security\
        \ requirements.  \n Include safety and security teams in the impact assessment\
        \ process."
      translations:
        fr:
          name: "Analyse d\u2019impact"
          description: "Analyser les impacts des modifications de configuration sur\
            \ la s\xE9curit\xE9 et la disponibilit\xE9 des syst\xE8mes OT. \nEffectuer\
            \ des tests en environnement s\xE9par\xE9 avant d'appliquer une modification.\
            \ \nV\xE9rifier que les nouvelles configurations respectent les exigences\
            \ de s\xE9curit\xE9. \nInclure les \xE9quipes de s\xE9curit\xE9 et de\
            \ s\xFBret\xE9 dans le processus d\u2019\xE9valuation des impacts."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm
      ref_id: CM-5
      name: Access Restrictions for Change
      description: "Limit access to critical configurations to prevent unauthorized\
        \ changes.  \n  Use mode switches on programmable logic controllers (PLCs)\
        \ to prevent unauthorized changes. \n  Enforce strict authentication for administrative\
        \ access to configurations. Set up an audit trail to track changes made."
      translations:
        fr:
          name: "Restrictions d\u2019acc\xE8s aux modifications"
          description: "Limiter l'acc\xE8s aux configurations critiques pour pr\xE9\
            venir les modifications non autoris\xE9es. \n Utiliser des commutateurs\
            \ de mode sur les automates programmables (PLC) pour emp\xEAcher les modifications\
            \ non autoris\xE9es.\n Appliquer une authentification stricte pour les\
            \ acc\xE8s administratifs aux configurations. Mettre en place un journal\
            \ d\u2019audit pour suivre les changements apport\xE9s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm
      ref_id: CM-6
      name: Configuration Settings
      description: "Define, apply, and verify configuration settings for OT systems.\
        \  \n  Centralize the management of configuration settings.  \n Set up alerts\
        \ for unauthorized changes to settings.  \n Automate the application of security\
        \ configurations on OT devices."
      translations:
        fr:
          name: "Param\xE8tres de configuration"
          description: "D\xE9finir, appliquer et v\xE9rifier les param\xE8tres de\
            \ configuration pour les syst\xE8mes OT. \n Centraliser la gestion des\
            \ param\xE8tres de configuration. \nMettre en place des alertes en cas\
            \ de modification non autoris\xE9e des param\xE8tres. \nAutomatiser l\u2019\
            application des configurations de s\xE9curit\xE9 sur les \xE9quipements\
            \ OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm
      ref_id: CM-7
      name: Least Functionality
      description: "Reducing the functionality of OT systems to what is strictly necessary.\
        \   \n Disable non-essential ports and services on devices.  \n Enforce an\
        \ explicit authorization policy for the software and protocols used.  \n Perform\
        \ periodic reviews of enabled features."
      translations:
        fr:
          name: "Fonctionnalit\xE9 minimale"
          description: "R\xE9duire les fonctionnalit\xE9s des syst\xE8mes OT \xE0\
            \ ce qui est strictement n\xE9cessaire.  \nD\xE9sactiver les ports et\
            \ services non essentiels sur les \xE9quipements. \nAppliquer une politique\
            \ d\u2019autorisation explicite des logiciels et protocoles utilis\xE9\
            s. \nEffectuer des revues p\xE9riodiques des fonctionnalit\xE9s activ\xE9\
            es."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm
      ref_id: CM-8
      name: System Component Inventory
      description: "Maintain an accurate inventory of OT system hardware and software\
        \ components.   \n Update inventory when adding or removing components.  \n\
        \ Use automated tools to detect unauthorized components. Ensure the traceability\
        \ of critical equipment."
      translations:
        fr:
          name: "Inventaire des composants du syst\xE8me"
          description: "Maintenir un inventaire pr\xE9cis des composants mat\xE9riels\
            \ et logiciels des syst\xE8mes OT.  \nMettre \xE0 jour l\u2019inventaire\
            \ lors de l'ajout ou du retrait de composants. \nUtiliser des outils automatis\xE9\
            s pour d\xE9tecter les composants non autoris\xE9s. Assurer la tra\xE7\
            abilit\xE9 des \xE9quipements critiques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm-9
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cm
      ref_id: CM-9
      name: Configuration Management Plan
      description: "Define a configuration management plan that includes responsibilities\
        \ and methodologies applied.   \n Write a document detailing configuration\
        \ management practices.  \n Integrate subcontractors and suppliers into the\
        \ implementation of the plan.  \n Establish a process for updating and validating\
        \ the plan."
      translations:
        fr:
          name: Plan de gestion de la configuration
          description: "D\xE9finir un plan de gestion des configurations incluant\
            \ les responsabilit\xE9s et les m\xE9thodologies appliqu\xE9es.  \nR\xE9\
            diger un document d\xE9taillant les pratiques de gestion des configurations.\
            \ \nInt\xE9grer les sous-traitants et fournisseurs dans l\u2019application\
            \ du plan. \nMettre en place un processus de mise \xE0 jour et de validation\
            \ du plan."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      assessable: false
      depth: 1
      ref_id: CP
      name: Contingency Planning
      translations:
        fr:
          name: "Planification de la Continuit\xE9"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      ref_id: CP-1
      name: Policy and Procedures
      description: "Establish contingency planning policies and procedures specific\
        \ to OT systems. \n  Develop a written policy that details continuity plans\
        \ specific to OT operations. \n  Define roles and responsibilities in the\
        \ event of an incident. \n  Ensure periodic policy review based on new threats\
        \ and updates to OT infrastructures"
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "\xC9tablir des politiques et proc\xE9dures de planification\
            \ de contingence sp\xE9cifiques aux syst\xE8mes OT.\n D\xE9velopper une\
            \ politique \xE9crite qui d\xE9taille les plans de continuit\xE9 sp\xE9\
            cifiques aux op\xE9rations OT.\n D\xE9finir les r\xF4les et responsabilit\xE9\
            s en cas d\u2019incident.\n Assurer une r\xE9vision p\xE9riodique des\
            \ politiques en fonction des nouvelles menaces et des mises \xE0 jour\
            \ des infrastructures OT"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      ref_id: CP-2
      name: Contingency Plan
      description: "Implement a detailed contingency plan for the resumption of operations\
        \ in the event of an incident affecting OT systems. \n  \n  Write an OT contingency\
        \ plan integrating the scenarios of outages, cyberattacks and natural disasters.\
        \ \n  Regularly test this plan with exercises and simulations. \n  Coordinate\
        \ with other organizational plans (CP-2(1)). \n  Identify critical assets\
        \ to prioritize in the event of a crisis (CP-2(8"
      translations:
        fr:
          name: "Plan de continuit\xE9"
          description: "Mettre en place un plan d\xE9taill\xE9 de contingence pour\
            \ la reprise des op\xE9rations en cas d'incident affectant les syst\xE8\
            mes OT.\n\n R\xE9diger un plan de contingence OT int\xE9grant les sc\xE9\
            narios de pannes, de cyberattaques et de catastrophes naturelles.\n Tester\
            \ r\xE9guli\xE8rement ce plan avec des exercices et simulations.\n Assurer\
            \ la coordination avec les autres plans de l'organisation (CP-2(1)).\n\
            \ Identifier les actifs critiques pour \xE9tablir des priorit\xE9s en\
            \ cas de crise (CP-2(8"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      ref_id: CP-3
      name: Contingency Training
      description: "Train OT staff on contingency procedures. \n  \n  Organize training\
        \ sessions for OT operators on incident management. \n  Conduct regular testing\
        \ and assessments of employees' knowledge of business continuity. \n  Develop\
        \ guides and manuals for quick reference during crises"
      translations:
        fr:
          name: "Formation \xE0 la continuit\xE9"
          description: "Former le personnel OT aux proc\xE9dures de contingence.\n\
            \n Organiser des sessions de formation pour les op\xE9rateurs OT sur la\
            \ gestion des incidents.\n R\xE9aliser des tests et \xE9valuations r\xE9\
            guliers des connaissances des employ\xE9s en mati\xE8re de continuit\xE9\
            \ des op\xE9rations.\n D\xE9velopper des guides et manuels pour r\xE9\
            f\xE9rence rapide lors des crises"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      ref_id: CP-4
      name: Contingency Plan Testing
      description: "Conduct tests and exercises of the contingency plan to ensure\
        \ its effectiveness. \n  \n  Conduct annual contingency plan tests (CP-4(1)).\
        \ \n  Conduct real-world exercises to identify flaws in the plan. \n  Document\
        \ lessons learned after each test and incorporate them into the updated plan."
      translations:
        fr:
          name: "Tests du plan de continuit\xE9"
          description: "Effectuer des tests et des exercices du plan de contingence\
            \ pour s'assurer de son efficacit\xE9.\n\n Organiser des tests annuels\
            \ du plan de contingence (CP-4(1)).\n Mener des exercices en conditions\
            \ r\xE9elles pour identifier les failles du plan.\n Documenter les le\xE7\
            ons apprises apr\xE8s chaque test et les int\xE9grer dans le plan mis\
            \ \xE0 jour."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      ref_id: CP-6
      name: Alternate Storage Site
      description: "Provide a secondary storage site for critical data and equipment.\
        \ \n  \n  Identify a secure remote site to store backups and critical equipment.\
        \ \n  Ensure connectivity and quick access to stored data and systems in the\
        \ event of a crisis. \n  Regularly test access to backups to avoid errors\
        \ during recovery"
      translations:
        fr:
          name: Site de stockage alternatif
          description: "Pr\xE9voir un site de stockage secondaire pour les donn\xE9\
            es et \xE9quipements critiques.\n\n Identifier un site distant s\xE9curis\xE9\
            \ pour stocker les sauvegardes et \xE9quipements critiques.\n Assurer\
            \ la connectivit\xE9 et l'acc\xE8s rapide aux donn\xE9es et aux syst\xE8\
            mes stock\xE9s en cas de crise.\n Tester r\xE9guli\xE8rement l'acc\xE8\
            s aux sauvegardes pour \xE9viter les erreurs lors de leur r\xE9cup\xE9\
            ration"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      ref_id: CP-7
      name: Alternate Processing Site
      description: "Provide a secondary site to ensure business continuity in the\
        \ event of a primary site outage. \n  \n  Establish a secondary infrastructure\
        \ that can take over in the event of a major incident. \n  Define protocols\
        \ for automatic or semi-automatic failover to the alternative site. \n  Regularly\
        \ test the passage to the emergency site to ensure that it is working properly."
      translations:
        fr:
          name: Site de traitement alternatif
          description: "Pr\xE9voir un site secondaire pour assurer la continuit\xE9\
            \ des op\xE9rations en cas de panne du site principal.\n\n Mettre en place\
            \ une infrastructure secondaire capable de prendre le relais en cas d'incident\
            \ majeur.\n D\xE9finir des protocoles de bascule automatique ou semi-automatique\
            \ vers le site alternatif.\n Tester r\xE9guli\xE8rement le passage au\
            \ site de secours pour garantir son bon fonctionnement."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      ref_id: CP-8
      name: Telecommunications Services
      description: "Ensure critical communication services remain functional in the\
        \ event of a disaster. \n  \n  Have alternative telecommunications providers\
        \ in the event of a main network outage. \n  Establish redundant communication\
        \ networks, such as satellite links or dedicated mobile networks. \n  Test\
        \ the resilience of communication infrastructures in the face of outages or\
        \ attacks."
      translations:
        fr:
          name: "Services de t\xE9l\xE9communications"
          description: "S'assurer que les services de communication critiques restent\
            \ fonctionnels en cas de sinistre.\n\n Avoir des fournisseurs de t\xE9\
            l\xE9communications alternatifs en cas de panne du r\xE9seau principal.\n\
            \ Mettre en place des r\xE9seaux de communication redondants, comme des\
            \ liaisons satellite ou des r\xE9seaux mobiles d\xE9di\xE9s.\n Tester\
            \ la r\xE9silience des infrastructures de communication face \xE0 des\
            \ pannes ou attaques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp-9
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      ref_id: CP-9
      name: System Backup
      description: "Perform regular and secure backups of OT systems and configurations.\
        \ \n  \n  Define an automated backup policy with a frequency adapted to OT\
        \ needs. \n  Store local and offsite copies to prevent loss in the event of\
        \ an attack or failure. \n  Regularly test backup restoration to ensure integrity"
      translations:
        fr:
          name: "Sauvegarde des syst\xE8mes"
          description: "Effectuer des sauvegardes r\xE9guli\xE8res et s\xE9curis\xE9\
            es des syst\xE8mes et configurations OT.\n\n D\xE9finir une politique\
            \ de sauvegarde automatis\xE9e avec une fr\xE9quence adapt\xE9e aux besoins\
            \ OT.\n Stocker des copies locales et hors site pour \xE9viter toute perte\
            \ en cas d\u2019attaque ou de d\xE9faillance.\n Tester r\xE9guli\xE8rement\
            \ la restauration des sauvegardes pour garantir leur int\xE9grit\xE9"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp-10
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      ref_id: CP-10
      name: System Recovery and Reconstitution
      description: "Prepare procedures for the rapid recovery of systems after an\
        \ incident. \n  \n  Define a clear recovery strategy for each type of outage\
        \ or incident. \n  Maintain detailed documentation of the recovery steps of\
        \ OT systems. \n  Ensure that suppliers and partners are included in the recovery\
        \ plan"
      translations:
        fr:
          name: "R\xE9cup\xE9ration et reconstitution des syst\xE8mes"
          description: "Pr\xE9parer des proc\xE9dures pour la restauration rapide\
            \ des syst\xE8mes apr\xE8s un incident.\n\n D\xE9finir une strat\xE9gie\
            \ de r\xE9cup\xE9ration claire pour chaque type de panne ou incident.\n\
            \ Maintenir une documentation d\xE9taill\xE9e des \xE9tapes de restauration\
            \ des syst\xE8mes OT.\n S\u2019assurer que les fournisseurs et partenaires\
            \ sont int\xE9gr\xE9s au plan de r\xE9cup\xE9ratio"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp-12
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:cp
      ref_id: CP-12
      name: Safe Mode
      description: "Establish a secure mode of operation that allows OT systems to\
        \ continue operating with limited capabilities in the event of a major incident.\
        \ \n  \n  Configure OT systems to switch to safe mode if a serious anomaly\
        \ is detected. \n  Set alert and action thresholds to automatically trigger\
        \ secure mode. \n  Test this mode regularly to ensure that it works properly\
        \ in the event of an incident."
      translations:
        fr:
          name: Mode de secours
          description: "Mettre en place un mode de fonctionnement s\xE9curis\xE9 permettant\
            \ aux syst\xE8mes OT de continuer \xE0 fonctionner avec des capacit\xE9\
            s limit\xE9es en cas d'incident majeur.\n\n Configurer les syst\xE8mes\
            \ OT pour qu'ils puissent basculer en mode s\xE9curis\xE9 en cas de d\xE9\
            tection d'une anomalie grave.\n D\xE9finir des seuils d\u2019alerte et\
            \ d\u2019action pour d\xE9clencher automatiquement le mode s\xE9curis\xE9\
            .\n Tester r\xE9guli\xE8rement ce mode pour s\u2019assurer qu\u2019il\
            \ fonctionne correctement en cas d\u2019incident."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      assessable: false
      depth: 1
      ref_id: IA
      name: Identification and Authentication
      translations:
        fr:
          name: Identification et Authentification
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-1
      name: Policy and Procedures
      description: "Establishes policies and procedures for managing identification\
        \ and authentication in an OT environment. \n   \n Define clear roles and\
        \ responsibilities for identity and authentication management. \n Document\
        \ processes for accessing OT systems. \n Train staff on best practices in\
        \ identity management."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "\xC9tablit des politiques et des proc\xE9dures pour la gestion\
            \ de l'identification et de l'authentification dans un environnement OT.\n\
            \t\nD\xE9finir des r\xF4les et responsabilit\xE9s clairs pour la gestion\
            \ des identit\xE9s et de l'authentification.\nDocumenter les processus\
            \ d'acc\xE8s aux syst\xE8mes OT.\nFormer le personnel sur les meilleures\
            \ pratiques en mati\xE8re de gestion des identit\xE9s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-2
      name: Identification and Authentication (Organizational Users)
      description: "Ensures that only authorized users can access OT systems. \n \
        \ \n Implement multi-factor authentication (MFA) for sensitive accounts. \n\
        \ Restrict the use of shared accounts and enforce strict access policies.\
        \ \n Use strong authentication methods such as smart cards or tokens."
      translations:
        fr:
          name: Identification et authentification (Utilisateurs organisationnels)
          description: "Assure que seuls les utilisateurs autoris\xE9s peuvent acc\xE9\
            der aux syst\xE8mes OT.\n\nMettre en place une authentification multi-facteur\
            \ (MFA) pour les comptes sensibles.\nRestreindre l'utilisation de comptes\
            \ partag\xE9s et appliquer des politiques strictes d'acc\xE8s.\nUtiliser\
            \ des m\xE9thodes d'authentification robustes comme les cartes \xE0 puce\
            \ ou les tokens."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-2(1)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-2(1)
      description: Require MFA for manager accounts.
      translations:
        fr:
          name: "Authentification multifacteur pour les comptes privil\xE9gi\xE9s"
          description: Exiger MFA pour les comptes administrateurs.
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-2(2)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-2(2)
      description: Extend MFA to standard users.
      translations:
        fr:
          name: "Authentification multifacteur pour les comptes non privil\xE9gi\xE9\
            s"
          description: "\xC9tendre MFA aux utilisateurs standards."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-2(5)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-2(5)
      description: Allow individual authentication while allowing group authentication
        under certain conditions.
      translations:
        fr:
          name: Authentification individuelle avec authentification de groupe
          description: "Autoriser l\u2019authentification individuelle tout en permettant\
            \ une authentification de groupe sous certaines conditions."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-2(8)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-2(8)
      description: Prevent replay attacks via cryptographic mechanisms.
      translations:
        fr:
          name: "Acc\xE8s aux comptes \u2013 R\xE9sistance aux attaques de relecture"
          description: "Emp\xEAcher les attaques de rejeu via des m\xE9canismes cryptographiques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-2(12)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-2(12)
      description: Accept secure identification cards (e.g. PIV cards) when applicable.
      translations:
        fr:
          name: Acceptation des identifiants PIV (Personal Identity Verification)
          description: "Accepter les cartes d\u2019identification s\xE9curis\xE9es\
            \ (ex. cartes PIV) lorsque applicable."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-3
      name: Device Identification and Authentication
      description: "Ensures that devices connecting to OT systems are authenticated.\
        \ \n  \n Implement authentication of OT devices before they can communicate.\
        \ \n Use digital certificates for device authentication. \n Enforce strict\
        \ asset identity management."
      translations:
        fr:
          name: Identification et authentification des dispositifs
          description: "Assure que les dispositifs se connectant aux syst\xE8mes OT\
            \ sont authentifi\xE9s.\n\nMettre en place une authentification des appareils\
            \ OT avant qu\u2019ils ne puissent communiquer.\nUtiliser des certificats\
            \ num\xE9riques pour l\u2019authentification des dispositifs.\nAppliquer\
            \ une gestion stricte des identit\xE9s des \xE9quipements."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-3(1)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-3(1)
      description: Two-way authentication via cryptography.
      translations:
        fr:
          name: Authentification cryptographique bidirectionnelle
          description: Authentification bidirectionnelle via cryptographie.
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-3(4)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-3(4)
      description: Verify the integrity of devices before they are connected.
      translations:
        fr:
          name: Attestation des dispositifs
          description: "V\xE9rification de l'int\xE9grit\xE9 des appareils avant leur\
            \ connexion."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-4
      name: Identifier Management
      description: "Manage user and system credentials. \n  \n Assign unique identifiers\
        \ to each user and device. \n Implement restrictions on the reuse of credentials.\
        \ \n Differentiate identifiers according to access levels."
      translations:
        fr:
          name: Gestion des identifiants
          description: "Gestion des identifiants attribu\xE9s aux utilisateurs et\
            \ aux syst\xE8mes.\n\nAttribuer des identifiants uniques \xE0 chaque utilisateur\
            \ et appareil.\nMettre en place des restrictions sur la r\xE9utilisation\
            \ des identifiants.\nDiff\xE9rencier les identifiants selon les niveaux\
            \ d\u2019acc\xE8s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-4(4)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-4(4)
      description: Indicate the status of users (e.g. employees, contractors, visitors).
      translations:
        fr:
          name: Identification du statut des utilisateurs
          description: "Indiquer le statut des utilisateurs (ex. employ\xE9s, sous-traitants,\
            \ visiteurs)."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-5
      name: Authenticator Management
      description: "Management of authentication mechanisms used to protect access\
        \ to systems. \n   \n Enforce robust password management policies (length,\
        \ complexity, rotation). \n Prefer certificate-based authentication rather\
        \ than passwords alone. \n Restrict the transmission of plaintext passwords\
        \ over the network."
      translations:
        fr:
          name: Gestion des authentifiants
          description: "Gestion des m\xE9canismes d\u2019authentification utilis\xE9\
            s pour prot\xE9ger l\u2019acc\xE8s aux syst\xE8mes.\n\t\nImposer des politiques\
            \ robustes de gestion des mots de passe (longueur, complexit\xE9, rotation).\n\
            Pr\xE9f\xE9rer l\u2019authentification bas\xE9e sur des certificats plut\xF4\
            t que les mots de passe seuls.\nRestreindre la transmission de mots de\
            \ passe en clair sur le r\xE9seau."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-5(1)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-5(1)
      description: Enforce strict password policies.
      translations:
        fr:
          name: "Authentification bas\xE9e sur les mots de passe"
          description: "Application de r\xE8gles strictes sur les mots de passe."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-5(2)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-5(2)
      description: Use of public key authentication.
      translations:
        fr:
          name: "Authentification bas\xE9e sur une cl\xE9 publique"
          description: "Utilisation de l'authentification par cl\xE9 publique."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-5(6)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-5(6)
      description: Protects authentication means from compromise.
      translations:
        fr:
          name: Protection des authentifiants
          description: "Protection des moyens d\u2019authentification contre les compromissions."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-6
      name: Authentication Feedback
      description: "Restricts the display of authentication information to prevent\
        \ accidental leaks. \n  \n Hide on-screen password entries. \n Prevent reuse\
        \ of authentication responses"
      translations:
        fr:
          name: "R\xE9troaction d\u2019authentification"
          description: "Limite l'affichage des informations d'authentification pour\
            \ \xE9viter les fuites accidentelles.\n\nMasquer les saisies de mots de\
            \ passe \xE0 l\u2019\xE9cran.\nEmp\xEAcher la r\xE9utilisation des r\xE9\
            ponses d\u2019authentification"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-7
      name: Cryptographic Module Authentication
      description: "Verifies the authenticity of the cryptographic modules used. \n\
        \  \n Ensure that cryptographic modules are certified and compliant with standards\
        \ (e.g. FIPS 140-3). \n Restrict access to cryptographic modules to authorized\
        \ users."
      translations:
        fr:
          name: Authentification par module cryptographique
          description: "V\xE9rifie l'authenticit\xE9 des modules cryptographiques\
            \ utilis\xE9s.\n\nS\u2019assurer que les modules cryptographiques sont\
            \ certifi\xE9s et conformes aux standards (ex. FIPS 140-3).\nRestreindre\
            \ l\u2019acc\xE8s aux modules cryptographiques aux utilisateurs autoris\xE9\
            s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-8
      name: Identification and Authentication (Non-Organizational Users)
      description: "Manage authentication of external users accessing OT systems.\
        \ \n  \n Implement specific controls for third-party access. \n Require MFA\
        \ for external connections."
      translations:
        fr:
          name: Identification et authentification (Utilisateurs non organisationnels)
          description: "Gestion de l\u2019authentification des utilisateurs externes\
            \ acc\xE9dant aux syst\xE8mes OT.\n\nMettre en place des contr\xF4les\
            \ sp\xE9cifiques pour les acc\xE8s tiers.\nExiger MFA pour les connexions\
            \ externes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-8(1)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-8(1)
      description: Accept PIV cards from other agencies.
      translations:
        fr:
          name: "Acceptation des identifiants PIV provenant d\u2019autres agences"
          description: Accepter les cartes PIV d'autres agences.
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-8(2)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-8(2)
      description: Accept third-party authenticators.
      translations:
        fr:
          name: Acceptation des authentifiants externes
          description: Accepter des authentificateurs tiers.
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-8(4)
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-8(4)
      description: Apply standardized authentication profiles.
      translations:
        fr:
          name: "Utilisation de profils d\xE9finis"
          description: "Appliquer des profils d\u2019authentification standardis\xE9\
            s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-11
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-11
      name: Re-authentication
      description: "Requires re-authentication after a period of inactivity or during\
        \ sensitive actions. \n  \n Enforce re-authentication after a certain session\
        \ time. \n Require re-authentication to access certain critical resources."
      translations:
        fr:
          name: "R\xE9-authentification"
          description: "Exige une r\xE9-authentification apr\xE8s une p\xE9riode d'inactivit\xE9\
            \ ou lors d'actions sensibles.\n\nImposer une r\xE9-authentification apr\xE8\
            s un certain temps de session.\nExiger une nouvelle authentification pour\
            \ acc\xE9der \xE0 certaines ressources critiques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia-12
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ia
      ref_id: IA-12
      name: Identity Proofing
      description: "Verifies users' identities before they register. \n  \n Implement\
        \ multi-step identity verification procedures. \n Require documentary proof\
        \ of identity before the credentials are issued."
      translations:
        fr:
          name: "V\xE9rification d\u2019identit\xE9"
          description: "V\xE9rifie l\u2019identit\xE9 des utilisateurs avant leur\
            \ enregistrement.\n\nMettre en place des proc\xE9dures de v\xE9rification\
            \ d\u2019identit\xE9 en plusieurs \xE9tapes.\nExiger des preuves documentaires\
            \ d\u2019identit\xE9 avant l\u2019\xE9mission des identifiants."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir
      assessable: false
      depth: 1
      ref_id: IR
      name: Incident Response
      translations:
        fr:
          name: "R\xE9ponse aux Incidents"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir
      ref_id: IR-1
      name: Policy and Procedures
      description: "Establish a clear policy and procedures for incident management.\
        \ \n  \n Define EO-specific procedures for responding to incidents. \n Ensure\
        \ alignment with IT and cybersecurity policies. \n Train OT staff on incident\
        \ response requirements."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "\xC9tablir une politique et des proc\xE9dures claires pour\
            \ la gestion des incidents.\n\nD\xE9finir des proc\xE9dures sp\xE9cifiques\
            \ \xE0 l\u2019OT pour r\xE9pondre aux incidents.\nAssurer l\u2019alignement\
            \ avec les politiques IT et de cybers\xE9curit\xE9.\nFormer le personnel\
            \ OT aux exigences de r\xE9ponse aux incidents."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir
      ref_id: IR-2
      name: Incident Response Training
      description: "Training of staff on best practices in incident response. \n Organize\
        \ regular training sessions for OT teams. \n Conduct simulated incidents (IR-2(1)).\
        \ \n Deploy automated training environments (IR-2(2))."
      translations:
        fr:
          name: "Formation \xE0 la r\xE9ponse aux incidents"
          description: "Formation du personnel sur les meilleures pratiques en mati\xE8\
            re de r\xE9ponse aux incidents.\nOrganiser des sessions de formation r\xE9\
            guli\xE8res pour les \xE9quipes OT.\nEffectuer des simulations d\u2019\
            incidents (IR-2(1)).\nD\xE9ployer des environnements d\u2019entra\xEE\
            nement automatis\xE9s (IR-2(2))."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir
      ref_id: IR-3
      name: Incident Response Testing
      description: "Test the ability of systems and teams to respond to incidents.\
        \ \n  \n Conduct hands-on incident management exercises. \n Coordinate these\
        \ tests with other plans (continuity, disaster recovery) (IR-3(2)). \n Analyze\
        \ results and improve procedures"
      translations:
        fr:
          name: "Test du plan de r\xE9ponse aux incidents"
          description: "Tester la capacit\xE9 des syst\xE8mes et des \xE9quipes \xE0\
            \ r\xE9agir aux incidents.\n\nMener des exercices pratiques de gestion\
            \ des incidents.\nCoordonner ces tests avec d'autres plans (continuit\xE9\
            , reprise apr\xE8s sinistre) (IR-3(2)).\nAnalyser les r\xE9sultats et\
            \ am\xE9liorer les proc\xE9dures"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir
      ref_id: IR-4
      name: Incident Handling
      description: "Manage incidents in real time to limit their impact. \n  \n Implement\
        \ automation processes (IR-4(1)). \n Correlate incident information to other\
        \ sources for better analysis (IR-4(4)). \n Integrate an OT Incident Response\
        \ Team (IR-4(11)). \n Collaborate with vendors and partners to manage embedded\
        \ component incidents."
      translations:
        fr:
          name: Gestion des incidents
          description: "G\xE9rer les incidents en temps r\xE9el pour limiter leur\
            \ impact.\n\nMettre en place des processus d\u2019automatisation (IR-4(1)).\n\
            Correlier les informations d'incident \xE0 d'autres sources pour une meilleure\
            \ analyse (IR-4(4)).\nInt\xE9grer une \xE9quipe de r\xE9ponse aux incidents\
            \ OT (IR-4(11)).\nCollaborer avec les fournisseurs et partenaires pour\
            \ g\xE9rer les incidents li\xE9s aux composants embarqu\xE9s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir
      ref_id: IR-5
      name: Incident Monitoring
      description: "Actively monitor for security incidents. \n  \n Deploy automated\
        \ incident collection and analysis tools (IR-5(1)). \n Continuously monitor\
        \ OT systems and identify anomalies. \n Set up automated alerts for critical\
        \ incidents"
      translations:
        fr:
          name: Surveillance des incidents
          description: "Assurer une surveillance active pour d\xE9tecter les incidents\
            \ de s\xE9curit\xE9.\n\nD\xE9ployer des outils de collecte et analyse\
            \ automatis\xE9e des incidents (IR-5(1)).\nSurveiller en continu les syst\xE8\
            mes OT et identifier les anomalies.\nMettre en place des alertes automatis\xE9\
            es pour les incidents critiques"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir
      ref_id: IR-6
      name: Incident Reporting
      description: "Formalize incident reporting to internal and external stakeholders.\
        \ \n  \n Ensure rapid escalation of incidents to the teams concerned. \n Automate\
        \ reporting for efficiency (IR-6(1)). \n Coordinating reports with the supply\
        \ chain and partners (IR-6(3)). \n Collaborate with international organizations\
        \ and CERTs (Cyber Emergency Response Teams)."
      translations:
        fr:
          name: Signalement des incidents
          description: "Formaliser le signalement des incidents aux parties prenantes\
            \ internes et externes.\n\nAssurer une remont\xE9e rapide des incidents\
            \ aux \xE9quipes concern\xE9es.\nAutomatiser le reporting pour plus d\u2019\
            efficacit\xE9 (IR-6(1)).\nCoordonner les signalements avec la cha\xEE\
            ne d'approvisionnement et les partenaires (IR-6(3)).\nCollaborer avec\
            \ les organismes internationaux et les CERT (Cyber Emergency Response\
            \ Teams)."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir
      ref_id: IR-7
      name: Incident Response Assistance
      description: "Provide support to assist OT teams with incident management. \n\
        \  \n Set up a help desk for OT incidents. \n Automate information management\
        \ and resource availability (IR-7(1)). \n Develop a network of partners specialized\
        \ in OT incident response."
      translations:
        fr:
          name: "Assistance \xE0 la r\xE9ponse aux incidents"
          description: "Fournir un support pour aider les \xE9quipes OT dans la gestion\
            \ des incidents.\n\nMettre en place un service d\u2019assistance pour\
            \ les incidents OT.\nAutomatiser la gestion des informations et la disponibilit\xE9\
            \ des ressources (IR-7(1)).\nD\xE9velopper un r\xE9seau de partenaires\
            \ sp\xE9cialis\xE9s en r\xE9ponse aux incidents OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ir
      ref_id: IR-8
      name: Incident Response Plan
      description: "Develop a detailed plan to organize incident response. \n  \n\
        \ Define the roles and responsibilities of staff. \n Create an incident response\
        \ workflow. \n Integrate a classification of incidents based on their OT impact.\
        \ \n Document internal and external contacts to be notified in the event of\
        \ an incident"
      translations:
        fr:
          name: "Plan de r\xE9ponse aux incidents"
          description: "\xC9laborer un plan d\xE9taill\xE9 pour organiser la r\xE9\
            ponse aux incidents.\n\nD\xE9finir les r\xF4les et responsabilit\xE9s\
            \ du personnel.\nCr\xE9er un workflow de r\xE9ponse aux incidents.\nInt\xE9\
            grer une classification des incidents bas\xE9e sur leur impact OT.\nDocumenter\
            \ les contacts internes et externes \xE0 notifier en cas d\u2019incident"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma
      assessable: false
      depth: 1
      ref_id: MA
      name: Maintenance
      translations:
        fr:
          name: Maintenance
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma
      ref_id: MA-1
      name: Policy and Procedures
      description: "Defines maintenance policies and procedures specific to OT environments.\
        \ \n  Tailors these policies to the unique needs of industrial systems. \n\
        \  \n  Write and maintain documented procedures for the maintenance of OT\
        \ equipment. \n  Integrate cybersecurity requirements into maintenance policies.\
        \ \n  Train maintenance personnel on the cybersecurity risks associated with\
        \ interventions."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "D\xE9finit des politiques et proc\xE9dures de maintenance\
            \ sp\xE9cifiques aux environnements OT.\n\tAdapte ces politiques aux besoins\
            \ uniques des syst\xE8mes industriels.\n\n R\xE9diger et maintenir des\
            \ proc\xE9dures document\xE9es pour la maintenance des \xE9quipements\
            \ OT.\n Int\xE9grer des exigences de cybers\xE9curit\xE9 aux politiques\
            \ de maintenance.\n Former le personnel de maintenance aux risques de\
            \ cybers\xE9curit\xE9 li\xE9s aux interventions."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma
      ref_id: MA-2
      name: Controlled Maintenance
      description: "Ensures that equipment maintenance is planned, authorized, and\
        \ tracked. \n  Preserves the integrity and safety of OT components during\
        \ interventions. \n  \n  Implement a process for validating maintenance interventions.\
        \ \n  Document each intervention in a secure maintenance log. \n  Verify the\
        \ integrity of systems after each maintenance operation"
      translations:
        fr:
          name: "Maintenance contr\xF4l\xE9e"
          description: "Assure que la maintenance des \xE9quipements est planifi\xE9\
            e, autoris\xE9e et suivie.\n\tPr\xE9serve l'int\xE9grit\xE9 et la s\xE9\
            curit\xE9 des composants OT pendant les interventions.\n\n Mettre en place\
            \ un processus de validation des interventions de maintenance.\n Documenter\
            \ chaque intervention dans un journal de maintenance s\xE9curis\xE9.\n\
            \ V\xE9rifier l\u2019int\xE9grit\xE9 des syst\xE8mes apr\xE8s chaque op\xE9\
            ration de maintenance"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma
      ref_id: MA-3
      name: Maintenance Tools
      description: "Controls the use of maintenance tools to avoid the risk of compromise.\
        \ \n  Includes monitoring of storage media and external devices used during\
        \ interventions. \n  \n  Restrict the use of unapproved maintenance tools.\
        \ \n  Check and sanitize tools before connecting them to OT systems. \n  Apply\
        \ measures to protect against copying and exfiltration of data on external\
        \ media."
      translations:
        fr:
          name: Outils de maintenance
          description: "Contr\xF4le l'utilisation des outils de maintenance pour \xE9\
            viter les risques de compromission.\n\tInclut la surveillance des supports\
            \ de stockage et des dispositifs externes utilis\xE9s lors des interventions.\n\
            \n Restreindre l'utilisation des outils de maintenance non approuv\xE9\
            s.\n V\xE9rifier et d\xE9sinfecter les outils avant de les connecter aux\
            \ syst\xE8mes OT.\n Appliquer des mesures de protection contre la copie\
            \ et l'exfiltration de donn\xE9es sur les supports externes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma
      ref_id: MA-4
      name: Nonlocal Maintenance
      description: "Manages maintenance interventions carried out remotely via secure\
        \ connections. \n  Implements mechanisms for monitoring and tracing remote\
        \ access. \n  \n  Use secure connections for any remote maintenance (VPN,\
        \ strong authentication). \n  Record and audit all remote maintenance sessions\
        \ (logs and captures). \n  Define procedures for automatic access shut-off\
        \ after the intervention"
      translations:
        fr:
          name: "Maintenance \xE0 distance"
          description: "G\xE8re les interventions de maintenance r\xE9alis\xE9es \xE0\
            \ distance via des connexions s\xE9curis\xE9es.\n\tImpl\xE9mente des m\xE9\
            canismes de surveillance et de tra\xE7abilit\xE9 des acc\xE8s distants.\n\
            \n Utiliser des connexions s\xE9curis\xE9es pour toute maintenance \xE0\
            \ distance (VPN, authentification forte).\n Enregistrer et auditer toutes\
            \ les sessions de maintenance distantes (logs et captures).\n D\xE9finir\
            \ des proc\xE9dures de coupure automatique des acc\xE8s apr\xE8s l\u2019\
            intervention"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma
      ref_id: MA-5
      name: Maintenance Personnel
      description: "Ensures that only authorized individuals can perform maintenance\
        \ on OT systems. \n  Involves background checks and assigning specific permissions.\
        \ \n  \n  Implement a clearance control process for maintenance technicians.\
        \ \n  Limit access to only necessary equipment based on the operator's role.\
        \ \n  Conduct regular security checks on maintenance personnel"
      translations:
        fr:
          name: Personnel de maintenance
          description: "S'assure que seules les personnes autoris\xE9es peuvent effectuer\
            \ des op\xE9rations de maintenance sur les syst\xE8mes OT.\n\tImplique\
            \ la v\xE9rification des ant\xE9c\xE9dents et l\u2019attribution d\u2019\
            autorisations sp\xE9cifiques.\n\n Mettre en place un processus de contr\xF4\
            le des habilitations pour les techniciens de maintenance.\n Limiter l\u2019\
            acc\xE8s aux seuls \xE9quipements n\xE9cessaires en fonction du r\xF4\
            le de l\u2019op\xE9rateur.\n Effectuer des v\xE9rifications de s\xE9curit\xE9\
            \ r\xE9guli\xE8res sur le personnel de maintenance"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma
      ref_id: MA-6
      name: Timely Maintenance
      description: "Ensures that maintenance operations are carried out in a timely\
        \ manner to avoid critical failures. \n  Prevents failures through preventive\
        \ maintenance programs. \n  \n  Establish a preventive maintenance schedule\
        \ to avoid unexpected interruptions. \n  Use monitoring sensors to detect\
        \ anomalies before the outage. \n  Prioritize maintenance of critical components\
        \ to avoid security risks."
      translations:
        fr:
          name: Maintenance en temps opportun
          description: "Garantit que les op\xE9rations de maintenance sont effectu\xE9\
            es dans des d\xE9lais ad\xE9quats pour \xE9viter les pannes critiques.\n\
            \tPr\xE9vient les d\xE9faillances gr\xE2ce \xE0 des programmes de maintenance\
            \ pr\xE9ventive.\n\n \xC9tablir un planning de maintenance pr\xE9ventive\
            \ pour \xE9viter les interruptions inattendues.\n Utiliser des capteurs\
            \ de surveillance pour d\xE9tecter les anomalies avant la panne.\n Prioriser\
            \ la maintenance des composants critiques pour \xE9viter les risques de\
            \ s\xE9curit\xE9."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ma
      ref_id: MA-7
      name: Field Maintenance
      description: "Manages maintenance interventions carried out directly in the\
        \ field (off-site). \n  Involves specific precautions for sensitive or critical\
        \ OT equipment. \n  \n  Identify systems that require special calibration\
        \ or controlled maintenance. \n  Restrict maintenance to qualified people\
        \ with specific tools. \n  Verify the compliance of interventions with regulatory\
        \ and industrial standards."
      translations:
        fr:
          name: Maintenance sur le terrain
          description: "G\xE8re les interventions de maintenance r\xE9alis\xE9es directement\
            \ sur le terrain (hors site).\n\tImplique des pr\xE9cautions sp\xE9cifiques\
            \ pour les \xE9quipements OT sensibles ou critiques.\n\n Identifier les\
            \ syst\xE8mes n\xE9cessitant une calibration sp\xE9ciale ou une maintenance\
            \ contr\xF4l\xE9e.\n Restreindre la maintenance aux personnes qualifi\xE9\
            es avec des outils sp\xE9cifiques.\n V\xE9rifier la conformit\xE9 des\
            \ interventions avec les normes r\xE9glementaires et industrielles."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp
      assessable: false
      depth: 1
      ref_id: MP
      name: Media Protection
      translations:
        fr:
          name: "Protection des M\xE9dias"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp
      ref_id: MP-1
      name: Policy and Procedures
      description: "Establishes policies and procedures to manage and protect media\
        \ containing sensitive information, including those in OT environments. \n\
        \  \n Define a specific policy for the management of OT storage media. \n\
        \ Identify the special requirements related to OT-IT interactions. \n Ensure\
        \ that these procedures are regularly updated according to risks and emerging\
        \ threats."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "\xC9tablit des politiques et proc\xE9dures pour g\xE9rer et\
            \ prot\xE9ger les m\xE9dias contenant des informations sensibles, y compris\
            \ ceux des environnements OT.\n\nD\xE9finir une politique sp\xE9cifique\
            \ pour la gestion des supports de stockage en OT.\nIdentifier les exigences\
            \ particuli\xE8res li\xE9es aux interactions OT-IT.\nAssurer une mise\
            \ \xE0 jour r\xE9guli\xE8re de ces proc\xE9dures en fonction des risques\
            \ et des menaces \xE9mergentes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp
      ref_id: MP-2
      name: Media Access
      description: "Controls access to physical and digital media to prevent unauthorized\
        \ access. \n  \n Restrict access to media to authorized users only. \n Implement\
        \ authentication checks before use. \n Regularly audit access for anomalies"
      translations:
        fr:
          name: "Acc\xE8s aux m\xE9dias"
          description: "Contr\xF4le l'acc\xE8s aux m\xE9dias physiques et num\xE9\
            riques pour \xE9viter tout acc\xE8s non autoris\xE9.\n\nRestreindre l'acc\xE8\
            s aux m\xE9dias aux seuls utilisateurs autoris\xE9s.\nMettre en place\
            \ des contr\xF4les d'authentification avant toute utilisation.\nAuditer\
            \ r\xE9guli\xE8rement les acc\xE8s pour d\xE9tecter toute anomalie"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp
      ref_id: MP-3
      name: Media Marking
      description: "Ensures that media containing sensitive information is properly\
        \ labeled to prevent data leakage and mismanagement. \n  \n Clearly label\
        \ all media containing critical information. \n Use appropriate security classifications\
        \ for OT media. \n Train staff on the importance of marking and safe handling\
        \ of media."
      translations:
        fr:
          name: Marquage des supports
          description: "Assure que les m\xE9dias contenant des informations sensibles\
            \ sont correctement \xE9tiquet\xE9s pour pr\xE9venir les fuites de donn\xE9\
            es et la mauvaise gestion.\n\n\xC9tiqueter clairement tous les supports\
            \ contenant des informations critiques.\nUtiliser des classifications\
            \ de s\xE9curit\xE9 appropri\xE9es pour les m\xE9dias OT.\nFormer le personnel\
            \ sur l\u2019importance du marquage et de la manipulation s\xE9curis\xE9\
            e des supports."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp
      ref_id: MP-4
      name: Media Storage
      description: "Defines measures to securely store physical and digital media\
        \ to prevent unauthorized access or alteration. \n  \n Store sensitive media\
        \ in secure areas with restricted access. \n Use safes or locked cabinets\
        \ for critical media. \n Control and log access to physical and digital media"
      translations:
        fr:
          name: "Stockage des m\xE9dias"
          description: "D\xE9finit des mesures pour stocker de mani\xE8re s\xE9curis\xE9\
            e les m\xE9dias physiques et num\xE9riques afin d'\xE9viter tout acc\xE8\
            s non autoris\xE9 ou toute alt\xE9ration.\n\nStocker les m\xE9dias sensibles\
            \ dans des zones s\xE9curis\xE9es avec acc\xE8s restreint.\nUtiliser des\
            \ coffres-forts ou des armoires verrouill\xE9es pour les supports critiques.\n\
            Contr\xF4ler et journaliser l'acc\xE8s aux supports physiques et num\xE9\
            riques"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp
      ref_id: MP-5
      name: Media Transport
      description: "Establishes secure transport protocols to prevent data exposure\
        \ when moving media. \n  \n Encrypt the data stored on the media being transported.\
        \ \n Use secure means of transport with supervision (e.g. authorised personnel,\
        \ secure transport chains). \n Establish procedures for tracking media in\
        \ transit"
      translations:
        fr:
          name: "Transport des m\xE9dias"
          description: "\xC9tablit des protocoles de transport s\xE9curis\xE9 pour\
            \ pr\xE9venir l'exposition des donn\xE9es lors du d\xE9placement des supports.\n\
            \nCrypter les donn\xE9es stock\xE9es sur les supports transport\xE9s.\n\
            Utiliser des moyens de transport s\xE9curis\xE9s avec surveillance (ex.\
            \ : personnel habilit\xE9, cha\xEEnes de transport s\xE9curis\xE9es).\n\
            Mettre en place des proc\xE9dures pour le suivi des m\xE9dias en transit"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp
      ref_id: MP-6
      name: Media Sanitization
      description: "Ensures that media is properly cleaned or destroyed before disposal\
        \ or reuse to prevent unauthorized data recovery. \n  \n Apply standards-compliant\
        \ data suppression methods (e.g., NIST SP 800-88). \n Check that the media\
        \ is effectively disinfected before they are recycled. \n Document all media\
        \ destruction procedures."
      translations:
        fr:
          name: "Assainissement des m\xE9dias"
          description: "Garantit que les m\xE9dias sont correctement nettoy\xE9s ou\
            \ d\xE9truits avant leur \xE9limination ou leur r\xE9utilisation afin\
            \ de pr\xE9venir toute r\xE9cup\xE9ration non autoris\xE9e des donn\xE9\
            es.\n\nAppliquer des m\xE9thodes de suppression de donn\xE9es conformes\
            \ aux standards (ex. : NIST SP 800-88).\nV\xE9rifier que la d\xE9sinfection\
            \ des m\xE9dias est effective avant leur recyclage.\nDocumenter toutes\
            \ les proc\xE9dures de destruction des supports."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:mp
      ref_id: MP-7
      name: Media Use
      description: "Sets restrictions on media usage to prevent data leakage and malware\
        \ infections. \n  \n Prohibit the use of unauthorized removable media on OT\
        \ systems. \n Implement tools to control and log access to media. \n Train\
        \ employees on the risks of inappropriate media use."
      translations:
        fr:
          name: "Utilisation des m\xE9dias"
          description: "D\xE9finit des restrictions sur l\u2019utilisation des m\xE9\
            dias pour pr\xE9venir les fuites de donn\xE9es et les infections par logiciels\
            \ malveillants.\n\nInterdire l'utilisation de m\xE9dias amovibles non\
            \ autoris\xE9s sur les syst\xE8mes OT.\nMettre en place des outils de\
            \ contr\xF4le et de journalisation des acc\xE8s aux m\xE9dias.\nFormer\
            \ les employ\xE9s aux risques li\xE9s \xE0 l'utilisation inappropri\xE9\
            e des m\xE9dias."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      assessable: false
      depth: 1
      ref_id: PE
      name: Physical and Environmental Protection
      translations:
        fr:
          name: Protection Physique et Environnementale
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-1
      name: Policy and Procedures
      description: "Defines policies and procedures for the physical and environmental\
        \ protection of OT systems. This includes regulatory aspects and EO-specific\
        \ requirements. \n  \n  Establish physical security policies that are appropriate\
        \ for OT systems. \n  Develop documented procedures for physical access, monitoring,\
        \ and infrastructure management. \n  Ensure regulatory compliance with applicable\
        \ laws and standards"
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "D\xE9finit des politiques et proc\xE9dures pour la protection\
            \ physique et environnementale des syst\xE8mes OT. Cela inclut les aspects\
            \ r\xE9glementaires et les exigences sp\xE9cifiques \xE0 l\u2019OT.\n\n\
            \t\xC9tablir des politiques de s\xE9curit\xE9 physique adapt\xE9es aux\
            \ syst\xE8mes OT.\n\t\xC9laborer des proc\xE9dures document\xE9es pour\
            \ l\u2019acc\xE8s physique, la surveillance et la gestion des infrastructures.\n\
            \tAssurer la conformit\xE9 r\xE9glementaire aux lois et normes applicables"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-2
      name: Physical Access Authorizations
      description: "Manages physical access authorization to areas containing critical\
        \ OT equipment. \n  \n  Set up an allowlist to restrict access to OT areas.\
        \ \n  Use access badges and biometric systems to identify authorized users.\
        \ \n  Ensure regular review of access to remove obsolete permissions."
      translations:
        fr:
          name: "Autorisations d\u2019acc\xE8s physique"
          description: "G\xE8re l'autorisation d'acc\xE8s physique aux zones contenant\
            \ des \xE9quipements OT critiques.\n\n\tMettre en place une liste d\u2019\
            autorisation pour restreindre l\u2019acc\xE8s aux zones OT.\n\tUtiliser\
            \ des badges d\u2019acc\xE8s et des syst\xE8mes biom\xE9triques pour identifier\
            \ les utilisateurs autoris\xE9s.\n\tAssurer une revue r\xE9guli\xE8re\
            \ des acc\xE8s pour retirer les autorisations obsol\xE8tes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-3
      name: Physical Access Control
      description: "Implements physical controls to restrict and monitor access to\
        \ OT facilities. \n  \n  Install physical barriers (secure gates, fences,\
        \ etc.). \n  Deploy surveillance cameras and alarms. \n  Enforce strict access\
        \ control in case of emergency to ensure the safety of critical equipment."
      translations:
        fr:
          name: "Contr\xF4le d\u2019acc\xE8s physique"
          description: "Impl\xE9mente des contr\xF4les physiques pour restreindre\
            \ et surveiller l'acc\xE8s aux installations OT.\n\n\tInstaller des barri\xE8\
            res physiques (portes s\xE9curis\xE9es, cl\xF4tures, etc.).\n\tD\xE9ployer\
            \ des cam\xE9ras de surveillance et des alarmes.\n\tAppliquer un contr\xF4\
            le d'acc\xE8s strict en cas d'urgence pour garantir la s\xE9curit\xE9\
            \ des \xE9quipements critiques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-6
      name: Monitoring Physical Access
      description: "Monitors physical access to OT systems and infrastructure. \n\
        \  \n  Use intrusion sensors and alarms. \n  Provide real-time video monitoring.\
        \ \n  Maintain an I/O history for incident analysis"
      translations:
        fr:
          name: "Surveillance de l\u2019acc\xE8s physique"
          description: "Surveille les acc\xE8s physiques aux syst\xE8mes et infrastructures\
            \ OT.\n\n\tUtiliser des capteurs d'intrusion et des alarmes.\n\tAssurer\
            \ une surveillance vid\xE9o en temps r\xE9el.\n\tMaintenir un historique\
            \ des entr\xE9es/sorties pour analyse des incidents"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-8
      name: Visitor Access Records
      description: "Records visitor access to sensitive areas. \n  \n  Maintain a\
        \ visitor log with identity and reason for visit. \n  Supervise visits by\
        \ authorized personnel. \n  Restricting access to critical areas to employees\
        \ only"
      translations:
        fr:
          name: "Enregistrement des acc\xE8s des visiteurs"
          description: "Enregistre les acc\xE8s des visiteurs dans les zones sensibles.\n\
            \n\tMaintenir un registre des visiteurs avec identit\xE9 et raison de\
            \ la visite.\n\tAssurer une surveillance des visites par du personnel\
            \ autoris\xE9.\n\tRestreindre l'acc\xE8s aux zones critiques uniquement\
            \ aux employ\xE9s"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-9
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-9
      name: Power Equipment and Cabling
      description: "Secures electrical equipment and wiring from damage and sabotage.\
        \ \n  \n  Use cable trays that are secure and protected from interference.\
        \ \n  Establish restricted areas for access to electrical equipment. \n  Monitor\
        \ the temperature and health of power systems"
      translations:
        fr:
          name: "\xC9quipements \xE9lectriques et c\xE2blage"
          description: "S\xE9curise les \xE9quipements \xE9lectriques et les c\xE2\
            blages contre les dommages et sabotages.\n\n\tUtiliser des chemins de\
            \ c\xE2bles s\xE9curis\xE9s et prot\xE9g\xE9s contre les interf\xE9rences.\n\
            \t\xC9tablir des zones restreintes pour l\u2019acc\xE8s aux \xE9quipements\
            \ \xE9lectriques.\n\tSurveiller la temp\xE9rature et l\u2019int\xE9grit\xE9\
            \ des syst\xE8mes d\u2019alimentation"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-10
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-10
      name: Emergency Shutoff
      description: "Allows for the emergency shutdown of certain critical OT systems\
        \ in the event of an incident. \n  \n  Implement emergency shutdown procedures.\
        \ \n  Test the emergency stop buttons regularly. \n  Ensure that the emergency\
        \ stop does not cause additional danger."
      translations:
        fr:
          name: "Arr\xEAt d\u2019urgence"
          description: "Permet d\u2019\xE9teindre d\u2019urgence certains syst\xE8\
            mes OT critiques en cas d\u2019incident.\n\n\tMettre en place des proc\xE9\
            dures d\u2019arr\xEAt d\u2019urgence.\n\tTester r\xE9guli\xE8rement les\
            \ boutons d'arr\xEAt d'urgence.\n\tAssurer que l\u2019arr\xEAt d\u2019\
            urgence ne cause pas de danger suppl\xE9mentaire."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-11
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-11
      name: Emergency Power
      description: "Manages backup power for critical OT systems. \n  Install backup\
        \ UPS and generators. \n  Test the automatic failover capability regularly.\
        \ \n  Ensure redundant power to prevent critical failures"
      translations:
        fr:
          name: "Alimentation \xE9lectrique d\u2019urgence"
          description: "G\xE8re l\u2019alimentation \xE9lectrique de secours pour\
            \ les syst\xE8mes OT critiques.\n\tInstaller des onduleurs (UPS) et g\xE9\
            n\xE9rateurs de secours.\n\tTester r\xE9guli\xE8rement la capacit\xE9\
            \ de basculement automatique.\n\tAssurer une alimentation redondante pour\
            \ \xE9viter les pannes critiques"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-12
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-12
      name: Emergency Lighting
      description: "Provides emergency lighting in the event of a power outage. \n\
        \  \n  Install stand-alone emergency lights. \n  Periodically check the capacity\
        \ of the batteries. \n  Ensure critical areas remain visible in the event\
        \ of an incident"
      translations:
        fr:
          name: "\xC9clairage d\u2019urgence"
          description: "Fournit un \xE9clairage d\u2019urgence en cas de panne \xE9\
            lectrique.\n\n\tInstaller des lumi\xE8res d\u2019urgence autonomes.\n\t\
            V\xE9rifier p\xE9riodiquement la capacit\xE9 des batteries.\n\tGarantir\
            \ que les zones critiques restent visibles en cas d\u2019incident"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-13
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-13
      name: Fire Protection
      description: "Protects OT installations from fire hazards. \n  \n  Install smoke\
        \ detectors and sprinklers. \n  Ensure that fire suppression systems are suitable\
        \ for OT environments (avoid water in certain areas). \n  Conduct regular\
        \ testing of firefighting equipment"
      translations:
        fr:
          name: "Protection contre l\u2019incendie"
          description: "Prot\xE8ge les installations OT contre les risques d\u2019\
            incendie.\n\n\tInstaller des d\xE9tecteurs de fum\xE9e et des extincteurs\
            \ automatiques.\n\tS\u2019assurer que les syst\xE8mes de suppression d\u2019\
            incendie sont adapt\xE9s aux environnements OT (\xE9viter l'eau dans certaines\
            \ zones).\n\tEffectuer des tests r\xE9guliers des \xE9quipements anti-incendie"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-14
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-14
      name: Environmental Controls
      description: "Manages temperature, humidity and other environmental parameters.\
        \ \n  \n  Install HVAC systems suitable for OT infrastructures. \n  Monitor\
        \ environmental conditions in real-time. \n  Use equipment that is designed\
        \ to withstand extreme conditions."
      translations:
        fr:
          name: "Contr\xF4les environnementaux"
          description: "G\xE8re la temp\xE9rature, l\u2019humidit\xE9 et autres param\xE8\
            tres environnementaux.\n\n\tInstaller des syst\xE8mes HVAC adapt\xE9s\
            \ aux infrastructures OT.\n\tSurveiller les conditions environnementales\
            \ en temps r\xE9el.\n\tUtiliser des \xE9quipements con\xE7us pour r\xE9\
            sister aux conditions extr\xEAmes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe-15
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pe
      ref_id: PE-15
      name: Water Damage Protection
      description: "Prevents water damage to OT equipment. \n  \n  Install leak sensors\
        \ and automatic shut-off valves. \n  Ensure that wiring and equipment are\
        \ protected from water. \n  Regularly test drainage and drainage systems."
      translations:
        fr:
          name: "Protection contre les d\xE9g\xE2ts des eaux"
          description: "\xC9vite les dommages caus\xE9s par l\u2019eau aux \xE9quipements\
            \ OT.\n\n\tInstaller des capteurs de fuite et des vannes d'arr\xEAt automatiques.\n\
            \tAssurer que les c\xE2blages et \xE9quipements sont prot\xE9g\xE9s de\
            \ l'eau.\n\tTester r\xE9guli\xE8rement les syst\xE8mes d'\xE9vacuation\
            \ et de drainage."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl
      assessable: false
      depth: 1
      ref_id: PL
      name: Planning
      translations:
        fr:
          name: Planification
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl
      ref_id: PL-1
      name: Policy and Procedures
      description: "This control requires the establishment of security policies and\
        \ procedures that are appropriate for OT environments and how they interact\
        \ with non-OT systems. \n  \n  Draft and approve a security policy specific\
        \ to OTs. \n  Define roles and responsibilities for OT cybersecurity management.\
        \ \n  Establish a process for updating and revising policies based on technological\
        \ developments and threats."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "Ce contr\xF4le impose l'\xE9tablissement de politiques et\
            \ proc\xE9dures de s\xE9curit\xE9 adapt\xE9es aux environnements OT et\
            \ \xE0 leur interaction avec les syst\xE8mes non-OT.\n\n\tR\xE9diger et\
            \ approuver une politique de s\xE9curit\xE9 sp\xE9cifique aux OT.\n\t\
            D\xE9finir les r\xF4les et responsabilit\xE9s pour la gestion de la cybers\xE9\
            curit\xE9 OT.\n\t\xC9tablir un processus de mise \xE0 jour et de r\xE9\
            vision des politiques en fonction des \xE9volutions technologiques et\
            \ des menaces."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl
      ref_id: PL-2
      name: System Security and Privacy Plans
      description: "Develop and maintain a security and privacy plan for OT systems,\
        \ to ensure consistency in risk management. \n  \n  Develop an OT security\
        \ planning document outlining the security controls and measures in place.\
        \ \n  Integrate specific risk management scenarios into critical OT systems.\
        \ \n  Achieve inter-system coordination to prevent a low-impact system from\
        \ compromising a high-impact system"
      translations:
        fr:
          name: "Plans de s\xE9curit\xE9 et de confidentialit\xE9 des syst\xE8mes"
          description: "D\xE9velopper et maintenir un plan de s\xE9curit\xE9 et de\
            \ confidentialit\xE9 pour les syst\xE8mes OT, afin d'assurer une coh\xE9\
            rence dans la gestion des risques.\n\n\t\xC9laborer un document de planification\
            \ de s\xE9curit\xE9 OT d\xE9crivant les contr\xF4les et mesures de s\xE9\
            curit\xE9 mis en place.\n\tInt\xE9grer des sc\xE9narios de gestion des\
            \ risques sp\xE9cifiques aux syst\xE8mes OT critiques.\n\tR\xE9aliser\
            \ une coordination inter-syst\xE8mes pour \xE9viter qu\u2019un syst\xE8\
            me \xE0 faible impact compromette un syst\xE8me \xE0 impact \xE9lev\xE9"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl
      ref_id: PL-4
      name: Rules of Behavior
      description: "Define rules of behavior to be followed to ensure the secure use\
        \ of OT systems. \n  \n  Establish a clear access and usage policy for OT\
        \ users. \n  Train operators in good cybersecurity practices. \n  Raise awareness\
        \ of the risks of non-compliant actions, such as installing unauthorized software."
      translations:
        fr:
          name: "R\xE8gles de comportement"
          description: "D\xE9finir des r\xE8gles de comportement \xE0 respecter pour\
            \ garantir l'utilisation s\xE9curis\xE9e des syst\xE8mes OT.\n\n\tMettre\
            \ en place une politique d'acc\xE8s et d'utilisation claire pour les utilisateurs\
            \ OT.\n\tFormer les op\xE9rateurs aux bonnes pratiques de cybers\xE9curit\xE9\
            .\n\tSensibiliser aux risques des actions non conformes, comme l'installation\
            \ de logiciels non autoris\xE9s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl
      ref_id: PL-7
      name: Concept of Operations
      description: "Document known operational procedures and analyze their relationship\
        \ with IT and OT technologies. \n  \n  Write a reference document detailing\
        \ OT business processes. \n  Identify critical interdependencies between IT\
        \ and OT. \n  Implement an OT incident response guide based on existing procedures."
      translations:
        fr:
          name: "Concept des op\xE9rations"
          description: "Documenter les proc\xE9dures op\xE9rationnelles connues et\
            \ analyser leur relation avec les technologies IT et OT.\n\n\tR\xE9diger\
            \ un document de r\xE9f\xE9rence d\xE9taillant les processus op\xE9rationnels\
            \ OT.\n\tIdentifier les interd\xE9pendances critiques entre IT et OT.\n\
            \tMettre en place un guide de r\xE9ponse aux incidents OT bas\xE9 sur\
            \ les proc\xE9dures existantes."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl
      ref_id: PL-8
      name: Security and Privacy Architecture
      description: "Establish a robust security and privacy architecture for OT systems.\
        \ \n  \n  Implement a \"Defense in Depth\" approach. \n  Segment OT networks\
        \ to limit the spread of attacks. \n  Integrate encryption and authentication\
        \ controls adapted to OT constraints."
      translations:
        fr:
          name: "Architectures de s\xE9curit\xE9 et de confidentialit\xE9"
          description: "\xC9tablir une architecture de s\xE9curit\xE9 et de confidentialit\xE9\
            \ robuste pour les syst\xE8mes OT.\n\n\tMettre en place une approche \"\
            Defense in Depth\" (D\xE9fense en profondeur).\n\tSegmenter les r\xE9\
            seaux OT pour limiter la propagation des attaques.\n\tInt\xE9grer des\
            \ contr\xF4les de chiffrement et d\u2019authentification adapt\xE9s aux\
            \ contraintes OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl-9
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl
      ref_id: PL-9
      name: Centralized Management
      description: "Centrally manage OT security, including breach remediation, malware\
        \ protection, and event logging. \n  \n  Implement a centralized OT vulnerability\
        \ management platform. \n  Automate security log monitoring and anomaly detection.\
        \ \n  Manage organization-wide security updates."
      translations:
        fr:
          name: "Gestion centralis\xE9e"
          description: "G\xE9rer de fa\xE7on centralis\xE9e la s\xE9curit\xE9 OT,\
            \ notamment la rem\xE9diation des failles, la protection contre les codes\
            \ malveillants et la journalisation des \xE9v\xE9nements.\n\n\tImpl\xE9\
            menter une plateforme centralis\xE9e de gestion des vuln\xE9rabilit\xE9\
            s OT.\n\tAutomatiser la surveillance des journaux de s\xE9curit\xE9 et\
            \ la d\xE9tection d\u2019anomalies.\n\tG\xE9rer les mises \xE0 jour de\
            \ s\xE9curit\xE9 \xE0 l\u2019\xE9chelle de l\u2019organisation."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl-10
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pl
      ref_id: PL-10
      name: Baseline Selection
      description: "Select an appropriate security baseline based on OT risks and\
        \ constraints. \n  \n  Define minimum security standards for OT equipment\
        \ and infrastructure. \n  Implement selection criteria for OT suppliers and\
        \ equipment. \n  Perform compliance analyses to validate the implementation\
        \ of baselines."
      translations:
        fr:
          name: "S\xE9lection de la configuration de base"
          description: "S\xE9lectionner une baseline de s\xE9curit\xE9 appropri\xE9\
            e en fonction des risques et des contraintes OT.\n\n\tD\xE9finir des standards\
            \ de s\xE9curit\xE9 minimaux pour les \xE9quipements et infrastructures\
            \ OT.\n\tMettre en place des crit\xE8res de s\xE9lection pour les fournisseurs\
            \ et \xE9quipements OT.\n\tEffectuer des analyses de conformit\xE9 pour\
            \ valider la mise en \u0153uvre des baselines."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm
      assessable: false
      depth: 1
      ref_id: PM
      name: Organization-Wide Information Security Program Management Controls
      translations:
        fr:
          name: "Gestion du programme de s\xE9curit\xE9 de l'information"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm
      ref_id: PM-1
      name: Information Security Program Plan
      description: "The information security program plan defines the structure, objectives,\
        \ resources, and responsibilities to ensure the ongoing management of cyber\
        \ security. \n  \n  Develop and document an information security plan covering\
        \ all OT and IT systems. \n  Define cybersecurity roles and responsibilities.\
        \ \n  Establish a process for evaluating and regularly updating the plan.\
        \ \n  Coordinate with other organizational initiatives (risk management, safety,\
        \ regulatory compliance)."
      translations:
        fr:
          name: "Plan du programme de s\xE9curit\xE9 de l'information"
          description: "Le plan de programme de s\xE9curit\xE9 de l'information d\xE9\
            finit la structure, les objectifs, les ressources et les responsabilit\xE9\
            s pour assurer la gestion continue de la cybers\xE9curit\xE9.\n\n\tD\xE9\
            velopper et documenter un plan de s\xE9curit\xE9 de l'information couvrant\
            \ l'ensemble des syst\xE8mes OT et IT.\n\tD\xE9finir les r\xF4les et responsabilit\xE9\
            s en mati\xE8re de cybers\xE9curit\xE9.\n\tMettre en place un processus\
            \ d'\xE9valuation et de mise \xE0 jour r\xE9guli\xE8re du plan.\n\tAssurer\
            \ une coordination avec les autres initiatives organisationnelles (gestion\
            \ des risques, s\xFBret\xE9, conformit\xE9 r\xE9glementaire)."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm
      ref_id: PM-2
      name: Information Security Program Leadership Role
      description: "Refers to a manager or team responsible for leading and managing\
        \ the information security program. \n  \n  Appoint a cybersecurity program\
        \ manager (e.g., CISO, OT manager). \n  Clearly define their responsibilities\
        \ and authority. \n  Coordinate with other stakeholders in the organization."
      translations:
        fr:
          name: "R\xF4le de leadership dans le programme de s\xE9curit\xE9 de l'information"
          description: "D\xE9signe un responsable ou une \xE9quipe en charge de la\
            \ direction et de la gestion du programme de s\xE9curit\xE9 de l'information.\n\
            \n\tNommer un responsable du programme de cybers\xE9curit\xE9 (ex. CISO,\
            \ responsable OT).\n\tD\xE9finir clairement ses responsabilit\xE9s et\
            \ son autorit\xE9.\n\tAssurer une coordination avec les autres parties\
            \ prenantes de l'organisation."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm
      ref_id: PM-3
      name: Information Security and Privacy Resources
      description: "Ensure the availability of the necessary resources (human, financial\
        \ and technological) for the implementation of the security program. \n  \n\
        \  Allocate a specific budget to OT cybersecurity. \n  Identify and train\
        \ qualified personnel in industrial cybersecurity. \n  Implement tools and\
        \ technologies for monitoring and protecting OT systems."
      translations:
        fr:
          name: "Ressources pour la s\xE9curit\xE9 de l'information et la confidentialit\xE9"
          description: "Assurer la disponibilit\xE9 des ressources n\xE9cessaires\
            \ (humaines, financi\xE8res et technologiques) pour la mise en \u0153\
            uvre du programme de s\xE9curit\xE9.\n\n\tAllouer un budget sp\xE9cifique\
            \ \xE0 la cybers\xE9curit\xE9 OT.\n\tIdentifier et former du personnel\
            \ qualifi\xE9 en cybers\xE9curit\xE9 industrielle.\n\tMettre en place\
            \ des outils et technologies pour la surveillance et la protection des\
            \ syst\xE8mes OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm
      ref_id: PM-4
      name: Plan of Action and Milestones Process
      description: "Defines a formal process for identifying, tracking, and resolving\
        \ cybersecurity gaps. \n  \n  Establish a register of risks and corrective\
        \ actions. \n  Assign responsibilities and timelines for each action. \n \
        \ Ensure regular follow-up and updates of action plans"
      translations:
        fr:
          name: Plan d'action et processus des jalons
          description: "D\xE9finit un processus formel pour identifier, suivre et\
            \ r\xE9soudre les lacunes en mati\xE8re de cybers\xE9curit\xE9.\n\n\t\
            Mettre en place un registre des risques et des actions correctives.\n\t\
            Attribuer des responsabilit\xE9s et des d\xE9lais pour chaque action.\n\
            \tAssurer un suivi r\xE9gulier et des mises \xE0 jour des plans d\u2019\
            action"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm
      ref_id: PM-5
      name: System Inventory
      description: "Maintain an accurate inventory of information systems and OT equipment.\
        \ \n  \n  Document all OT and IT assets in a centralized ledger. \n  Ensure\
        \ regular updates of equipment configurations and connections. \n  Identify\
        \ critical components that require enhanced protection"
      translations:
        fr:
          name: "Inventaire des syst\xE8mes"
          description: "Maintenir un inventaire pr\xE9cis des syst\xE8mes d'information\
            \ et des \xE9quipements OT.\n\n\tDocumenter tous les actifs OT et IT dans\
            \ un registre centralis\xE9.\n\tAssurer une mise \xE0 jour r\xE9guli\xE8\
            re des configurations et des connexions des \xE9quipements.\n\tIdentifier\
            \ les composants critiques n\xE9cessitant une protection renforc\xE9e"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:pm
      ref_id: PM-6
      name: Measures of Performance
      description: "Establish indicators to measure the effectiveness of the security\
        \ program. \n  \n  Define KPIs (Key Performance Indicators) to track compliance\
        \ with cybersecurity policies. \n  Conduct regular audits to assess the performance\
        \ of security measures. \n  Use dashboards to monitor trends and identify\
        \ areas for improvement."
      translations:
        fr:
          name: Mesures de performance
          description: "\xC9tablir des indicateurs pour mesurer l'efficacit\xE9 du\
            \ programme de s\xE9curit\xE9.\n\n\tD\xE9finir des KPI (Key Performance\
            \ Indicators) pour suivre la conformit\xE9 aux politiques de cybers\xE9\
            curit\xE9.\n\tEffectuer des audits r\xE9guliers pour \xE9valuer la performance\
            \ des mesures de s\xE9curit\xE9.\n\tUtiliser des tableaux de bord pour\
            \ surveiller les tendances et identifier les domaines \xE0 am\xE9liorer."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps
      assessable: false
      depth: 1
      ref_id: PS
      name: Personnel Security
      translations:
        fr:
          name: "S\xE9curit\xE9 du personnel"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps
      ref_id: PS-1
      name: Policy and Procedures
      description: "Establish policies and procedures for the management of personnel\
        \ security, including responsibilities and processes for the selection, hiring,\
        \ evaluation, training and separation of employees. \n   \n Write a personnel\
        \ security policy specific to OT systems. \n Train staff on the safety requirements\
        \ of operations. \n Periodically evaluate the effectiveness of procedures."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "\xC9tablir des politiques et proc\xE9dures pour la gestion\
            \ de la s\xE9curit\xE9 du personnel, incluant les responsabilit\xE9s et\
            \ les processus pour la s\xE9lection, l\u2019embauche, l\u2019\xE9valuation,\
            \ la formation et la s\xE9paration des employ\xE9s.\n\t \nR\xE9diger une\
            \ politique de s\xE9curit\xE9 du personnel sp\xE9cifique aux syst\xE8\
            mes OT.\nFormer le personnel sur les exigences de s\xE9curit\xE9 des op\xE9\
            rations.\n\xC9valuer p\xE9riodiquement l\u2019efficacit\xE9 des proc\xE9\
            dures."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps
      ref_id: PS-2
      name: Position Risk Designation
      description: "Identify critical positions and assign a level of risk based on\
        \ their responsibilities and access to sensitive resources.  \n Use industry-specific\
        \ regulations to define risk levels. \n Perform a job analysis to determine\
        \ safety requirements. \n Regularly update risk designations based on evolving\
        \ threats."
      translations:
        fr:
          name: "D\xE9signation des risques pour les postes"
          description: "Identifier les postes critiques et attribuer un niveau de\
            \ risque en fonction de leurs responsabilit\xE9s et de l\u2019acc\xE8\
            s aux ressources sensibles. \nUtiliser des r\xE9glementations sp\xE9cifiques\
            \ au secteur pour d\xE9finir les niveaux de risque.\nEffectuer une analyse\
            \ des postes pour d\xE9terminer les exigences de s\xE9curit\xE9.\nMettre\
            \ \xE0 jour r\xE9guli\xE8rement les d\xE9signations de risque en fonction\
            \ de l\u2019\xE9volution des menaces."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps
      ref_id: PS-3
      name: Personnel Screening
      description: "Conduct background checks on employees and contractors based on\
        \ their level of access to OT systems. \n   \n Implement a pre-employment\
        \ background check process. \n Perform periodic checks for employees in sensitive\
        \ positions. \n Apply enhanced checks for system administrators and other\
        \ critical roles."
      translations:
        fr:
          name: "V\xE9rification des ant\xE9c\xE9dents du personnel"
          description: "Effectuer des v\xE9rifications des ant\xE9c\xE9dents des employ\xE9\
            s et des sous-traitants en fonction de leur niveau d\u2019acc\xE8s aux\
            \ syst\xE8mes OT.\n\t \nMettre en place un processus de v\xE9rification\
            \ des ant\xE9c\xE9dents avant l\u2019embauche.\nR\xE9aliser des contr\xF4\
            les p\xE9riodiques pour les employ\xE9s occupant des postes sensibles.\n\
            Appliquer des v\xE9rifications renforc\xE9es pour les administrateurs\
            \ syst\xE8me et autres r\xF4les critiques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps
      ref_id: PS-4
      name: Personnel Termination
      description: "Define a secure employee departure management process to minimize\
        \ security risks related to unauthorized residual access. \n   \n Immediately\
        \ revoke access to OT systems after the departure notification. \n Ensure\
        \ the return of all equipment and access badges. \n Conduct post-departure\
        \ follow-up to ensure that no security breaches have occurred."
      translations:
        fr:
          name: "Gestion des d\xE9parts du personnel"
          description: "D\xE9finir un processus de gestion s\xE9curis\xE9 des d\xE9\
            parts des employ\xE9s pour minimiser les risques de s\xE9curit\xE9 li\xE9\
            s \xE0 un acc\xE8s r\xE9siduel non autoris\xE9.\n\t \nR\xE9voquer imm\xE9\
            diatement l\u2019acc\xE8s aux syst\xE8mes OT apr\xE8s la notification\
            \ de d\xE9part.\nAssurer la restitution de tout mat\xE9riel et badge d\u2019\
            acc\xE8s.\nEffectuer un suivi post-d\xE9part pour s\u2019assurer qu\u2019\
            aucune br\xE8che de s\xE9curit\xE9 n\u2019a eu lieu."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps
      ref_id: PS-5
      name: Personnel Transfer
      description: "Manage the internal transfer of employees to adapt their access\
        \ privileges to their new responsibilities. \n   \n Update the access rights\
        \ of transferred employees. \n Inform new departments of security responsibilities.\
        \ \n Verify that the old extension does not retain any residual access"
      translations:
        fr:
          name: Transfert de personnel
          description: "G\xE9rer le transfert interne des employ\xE9s afin d\u2019\
            adapter leurs privil\xE8ges d\u2019acc\xE8s en fonction de leurs nouvelles\
            \ responsabilit\xE9s.\n\t \nMettre \xE0 jour les droits d\u2019acc\xE8\
            s des employ\xE9s transf\xE9r\xE9s.\nInformer les nouveaux d\xE9partements\
            \ des responsabilit\xE9s en mati\xE8re de s\xE9curit\xE9.\nV\xE9rifier\
            \ que l\u2019ancien poste ne conserve aucun acc\xE8s r\xE9siduel"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps
      ref_id: PS-6
      name: Access Agreements
      description: "Ensure that any employee or contractor with access to OT systems\
        \ understands and agrees to the security requirements and associated responsibilities.\
        \ \n   \n Draft clear and detailed access agreements. \n Require the signing\
        \ of a confidentiality and security compliance agreement before any access.\
        \ \n Conduct periodic reminders of user obligations"
      translations:
        fr:
          name: "Accords d\u2019acc\xE8s"
          description: "S\u2019assurer que tout employ\xE9 ou sous-traitant ayant\
            \ un acc\xE8s aux syst\xE8mes OT comprend et accepte les exigences de\
            \ s\xE9curit\xE9 et les responsabilit\xE9s associ\xE9es.\n\t \nR\xE9diger\
            \ des accords d\u2019acc\xE8s clairs et d\xE9taill\xE9s.\nExiger la signature\
            \ d\u2019un accord de confidentialit\xE9 et de respect des r\xE8gles de\
            \ s\xE9curit\xE9 avant tout acc\xE8s.\nEffectuer des rappels p\xE9riodiques\
            \ sur les obligations des utilisateurs"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps
      ref_id: PS-7
      name: External Personnel Security
      description: "Apply specific controls for external service providers, subcontractors\
        \ and consultants with access to critical infrastructure. \n   \n Impose background\
        \ checks on contractors. \n Restrict their access to only the resources necessary\
        \ for their missions. \n Implement security training and awareness sessions."
      translations:
        fr:
          name: "S\xE9curit\xE9 du personnel externe"
          description: "Appliquer des contr\xF4les sp\xE9cifiques pour les prestataires\
            \ externes, sous-traitants et consultants ayant acc\xE8s aux infrastructures\
            \ critiques.\n\t \nImposer des v\xE9rifications d\u2019ant\xE9c\xE9dents\
            \ pour les sous-traitants.\nRestreindre leur acc\xE8s aux seules ressources\
            \ n\xE9cessaires \xE0 leurs missions.\nMettre en place des sessions de\
            \ formation et de sensibilisation \xE0 la s\xE9curit\xE9."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps
      ref_id: PS-8
      name: Personnel Sanctions
      description: "Define a disciplinary framework for non-compliance with security\
        \ policies. \n   \n Establish a clear disciplinary procedure. \n Communicate\
        \ to employees the consequences of violations of safety rules. \n Implement\
        \ a follow-up of violations and penalties applied."
      translations:
        fr:
          name: "Sanctions en cas de violation des r\xE8gles de s\xE9curit\xE9"
          description: "D\xE9finir un cadre disciplinaire en cas de non-respect des\
            \ politiques de s\xE9curit\xE9.\n\t \n\xC9tablir une proc\xE9dure disciplinaire\
            \ claire.\nCommuniquer aux employ\xE9s les cons\xE9quences des violations\
            \ des r\xE8gles de s\xE9curit\xE9.\nMettre en place un suivi des infractions\
            \ et des sanctions appliqu\xE9es."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps-9
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ps
      ref_id: PS-9
      name: Position Descriptions
      description: "Ensure that each job description includes security responsibilities\
        \ and requirements for the protection of critical assets. \n   \n Add a safety\
        \ section in all job descriptions. \n Clarify cybersecurity and OT protection\
        \ expectations for each role. \n Train employees on their specific responsibilities\
        \ for OT security."
      translations:
        fr:
          name: Descriptions des postes
          description: "Assurer que chaque description de poste inclut les responsabilit\xE9\
            s de s\xE9curit\xE9 et les exigences en mati\xE8re de protection des actifs\
            \ critiques.\n\t \nAjouter une section sur la s\xE9curit\xE9 dans toutes\
            \ les descriptions de poste.\nClarifier les attentes en mati\xE8re de\
            \ cybers\xE9curit\xE9 et de protection OT pour chaque r\xF4le.\nFormer\
            \ les employ\xE9s sur leurs responsabilit\xE9s sp\xE9cifiques en mati\xE8\
            re de s\xE9curit\xE9 OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra
      assessable: false
      depth: 1
      ref_id: RA
      name: Risk Assessment
      translations:
        fr:
          name: "\xC9valuation des risques"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra
      ref_id: RA-1
      name: Policy and Procedures
      description: "Define a policy and procedures for assessing cybersecurity risks\
        \ in an OT environment. \n Develop a policy adapted to OT systems, taking\
        \ into account the interdependencies with IT systems. \n Ensure that the policy\
        \ covers threat assessments specific to industrial environments. \n Train\
        \ OT and IT teams on how to apply risk assessment procedures."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "D\xE9finir une politique et des proc\xE9dures pour l'\xE9\
            valuation des risques li\xE9s \xE0 la cybers\xE9curit\xE9 dans un environnement\
            \ OT.\n\xC9laborer une politique adapt\xE9e aux syst\xE8mes OT, en tenant\
            \ compte des interd\xE9pendances avec les syst\xE8mes IT.\nS'assurer que\
            \ la politique couvre les \xE9valuations des menaces sp\xE9cifiques aux\
            \ environnements industriels.\nFormer les \xE9quipes OT et IT \xE0 l'application\
            \ des proc\xE9dures d\u2019\xE9valuation des risques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra
      ref_id: RA-2
      name: Security Categorization
      description: "Determine the level of impact of OT systems based on potential\
        \ threats and operational requirements. \n Use Process Hazard Analysis (PHA)\
        \ and Functional Safety Assessments. \n Classify OT assets according to their\
        \ criticality to production and safe operations. \n Adapt protective measures\
        \ according to the level of risk assigned to OT systems"
      translations:
        fr:
          name: "Cat\xE9gorisation de la s\xE9curit\xE9"
          description: "D\xE9terminer le niveau d\u2019impact des syst\xE8mes OT en\
            \ fonction des menaces potentielles et des exigences op\xE9rationnelles.\n\
            Utiliser des \xE9valuations de s\xE9curit\xE9 des proc\xE9d\xE9s industriels\
            \ (PHA - Process Hazard Analysis) et des \xE9valuations de s\xE9curit\xE9\
            \ fonctionnelle.\nClassifier les actifs OT selon leur criticit\xE9 pour\
            \ la production et la s\xE9curit\xE9 des op\xE9rations.\nAdapter les mesures\
            \ de protection en fonction du niveau de risque attribu\xE9 aux syst\xE8\
            mes OT"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra
      ref_id: RA-3
      name: Risk Assessment
      description: "Identify and assess cybersecurity risks based on potential threats,\
        \ vulnerabilities, and impacts. \n Perform regular risk assessments by integrating\
        \ scenarios specific to OT environments (e.g. SCADA compromise). \n Combine\
        \ cybersecurity and industrial engineering experts for in-depth threat analysis.\
        \ \n Assess the impact of threats on critical infrastructure and business\
        \ continuity."
      translations:
        fr:
          name: "\xC9valuation des risques"
          description: "Identifier et \xE9valuer les risques li\xE9s \xE0 la cybers\xE9\
            curit\xE9 en fonction des menaces, vuln\xE9rabilit\xE9s et impacts potentiels.\n\
            Effectuer des \xE9valuations r\xE9guli\xE8res des risques en int\xE9grant\
            \ des sc\xE9narios sp\xE9cifiques aux environnements OT (ex: compromission\
            \ d\u2019un SCADA).\nAssocier des experts en cybers\xE9curit\xE9 et en\
            \ ing\xE9nierie industrielle pour une analyse approfondie des menaces.\n\
            \xC9valuer l\u2019impact des menaces sur les infrastructures critiques\
            \ et la continuit\xE9 op\xE9rationnelle."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra
      ref_id: RA-5
      name: Vulnerability Monitoring and Scanning
      description: "Implement mechanisms to monitor and detect vulnerabilities in\
        \ OT systems. \n Perform vulnerability scans with tools adapted to OT environments\
        \ (e.g. passive rather than active analysis to avoid disruptions). \n Maintain\
        \ an inventory of OT assets and cross-reference it with recognized vulnerability\
        \ databases (CISA, NIST, NVD). \n Plan vulnerability assessments during periods\
        \ of planned shutdown of industrial systems"
      translations:
        fr:
          name: "Surveillance et analyse des vuln\xE9rabilit\xE9s"
          description: "Mettre en place des m\xE9canismes pour surveiller et d\xE9\
            tecter les vuln\xE9rabilit\xE9s des syst\xE8mes OT.\nEffectuer des scans\
            \ de vuln\xE9rabilit\xE9s avec des outils adapt\xE9s aux environnements\
            \ OT (ex: analyse passive plut\xF4t qu\u2019active pour \xE9viter les\
            \ perturbations).\nMaintenir un inventaire des actifs OT et le croiser\
            \ avec des bases de vuln\xE9rabilit\xE9s reconnues (CISA, NIST NVD).\n\
            Planifier les \xE9valuations de vuln\xE9rabilit\xE9s pendant les p\xE9\
            riodes d\u2019arr\xEAt planifi\xE9 des syst\xE8mes industriels"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra-9
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:ra
      ref_id: RA-9
      name: Criticality Analysis
      description: "Determine the critical components of an OT environment and their\
        \ impact in the event of a failure or attack. \n Define criticality criteria\
        \ based on production and safety implications. \n Assess the interdependencies\
        \ between OT and IT components to identify points of vulnerability. \n Implement\
        \ specific mitigation measures for assets identified as critical."
      translations:
        fr:
          name: "Analyse de criticit\xE9"
          description: "D\xE9terminer les composants critiques d'un environnement\
            \ OT et leur impact en cas de d\xE9faillance ou d'attaque.\nD\xE9finir\
            \ les crit\xE8res de criticit\xE9 en fonction des cons\xE9quences sur\
            \ la production et la s\xE9curit\xE9.\n\xC9valuer les interd\xE9pendances\
            \ entre les composants OT et IT pour identifier les points de vuln\xE9\
            rabilit\xE9.\nMettre en place des mesures de mitigation sp\xE9cifiques\
            \ pour les actifs identifi\xE9s comme critiques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa
      assessable: false
      depth: 1
      ref_id: SA
      name: System and Services Acquisition
      translations:
        fr:
          name: "Acquisition des syst\xE8mes et services"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa
      ref_id: SA-1
      name: Policy and Procedures
      description: "Establish policies and procedures to ensure that the procurement\
        \ of systems and services takes into account OT security. \n Write a policy\
        \ covering OT specificities and its interactions with non-OT systems. \n Integrate\
        \ cybersecurity requirements from the procurement phase of OT equipment."
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "\xC9tablir des politiques et proc\xE9dures pour assurer que\
            \ l\u2019acquisition de syst\xE8mes et services prend en compte la s\xE9\
            curit\xE9 OT.\nR\xE9diger une politique couvrant les sp\xE9cificit\xE9\
            s OT et ses interactions avec les syst\xE8mes non-OT.\nInt\xE9grer des\
            \ exigences de cybers\xE9curit\xE9 d\xE8s la phase d\u2019acquisition\
            \ des \xE9quipements OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa
      ref_id: SA-2
      name: Allocation of Resources
      description: "Determine the financial, human and technical resources required\
        \ to ensure the security of acquisitions. \n Assess costs and needs to secure\
        \ existing and future OT systems. \n Ensure adequate funding for the upgrade\
        \ of critical equipment. \n Allocate teams dedicated to the management and\
        \ security of new acquisitions"
      translations:
        fr:
          name: Allocation des ressources
          description: "D\xE9terminer les ressources financi\xE8res, humaines et techniques\
            \ n\xE9cessaires pour garantir la s\xE9curit\xE9 des acquisitions.\n\xC9\
            valuer les co\xFBts et les besoins pour s\xE9curiser les syst\xE8mes OT\
            \ existants et futurs.\nAssurer un financement adapt\xE9 pour la mise\
            \ \xE0 jour des \xE9quipements critiques.\nAllouer des \xE9quipes d\xE9\
            di\xE9es \xE0 la gestion et s\xE9curisation des nouvelles acquisitions"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa
      ref_id: SA-3
      name: System Development Life Cycle
      description: "Ensure that cybersecurity is integrated into every phase of the\
        \ OT systems lifecycle. \n Define a lifecycle management process that takes\
        \ into account the longevity of OT equipment. \n Work with third-party integrators\
        \ to mitigate security risks. \n Plan for technology updates to limit the\
        \ use of outdated systems"
      translations:
        fr:
          name: "Cycle de vie du d\xE9veloppement des syst\xE8mes"
          description: "Assurer que la cybers\xE9curit\xE9 est int\xE9gr\xE9e \xE0\
            \ chaque phase du cycle de vie des syst\xE8mes OT.\nD\xE9finir un processus\
            \ de gestion du cycle de vie prenant en compte la long\xE9vit\xE9 des\
            \ \xE9quipements OT.\nTravailler avec des int\xE9grateurs tiers pour limiter\
            \ les risques de s\xE9curit\xE9.\nPlanifier des mises \xE0 jour technologiques\
            \ afin de limiter l\u2019utilisation de syst\xE8mes obsol\xE8tes"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa
      ref_id: SA-4
      name: Acquisition Process
      description: "Manage acquisitions to include cybersecurity requirements by design\
        \ of OT systems. \n Include cybersecurity clauses in acquisition contracts.\
        \ \n Take into account the security specifications and protocols used (e.g.\
        \ SCADA). \n Verify that purchased OT products comply with applicable standards\
        \ (NIST, IEC 62443)"
      translations:
        fr:
          name: "Processus d\u2019acquisition"
          description: "G\xE9rer les acquisitions de mani\xE8re \xE0 inclure des exigences\
            \ de cybers\xE9curit\xE9 d\xE8s la conception des syst\xE8mes OT.\nInclure\
            \ des clauses de cybers\xE9curit\xE9 dans les contrats d\u2019acquisition.\n\
            Prendre en compte les sp\xE9cifications de s\xE9curit\xE9 et les protocoles\
            \ utilis\xE9s (ex: SCADA).\nV\xE9rifier que les produits OT achet\xE9\
            s respectent les normes en vigueur (NIST, IEC 62443)"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sa
      ref_id: SA-5
      name: System Documentation
      description: "Ensure complete documentation of acquired systems to ensure their\
        \ secure management. \n Require vendors to provide documentation detailing\
        \ the architecture, protocols, and potential vulnerabilities of acquired systems.\
        \ \n Set up an internal repository of OT equipment and available updates.\
        \ \n Train OT teams on documentation and secure use of new systems"
      translations:
        fr:
          name: "Documentation des syst\xE8mes"
          description: "Assurer une documentation compl\xE8te des syst\xE8mes acquis\
            \ pour garantir leur gestion s\xE9curis\xE9e.\nExiger des fournisseurs\
            \ des documents d\xE9taillant l\u2019architecture, les protocoles et les\
            \ vuln\xE9rabilit\xE9s potentielles des syst\xE8mes acquis.\nMettre en\
            \ place un r\xE9f\xE9rentiel interne des \xE9quipements OT et des mises\
            \ \xE0 jour disponibles.\nFormer les \xE9quipes OT sur la documentation\
            \ et l\u2019utilisation s\xE9curis\xE9e des nouveaux syst\xE8mes"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      assessable: false
      depth: 1
      ref_id: SC
      name: System and Communications Protection
      translations:
        fr:
          name: "Protection des syst\xE8mes et des communications"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-1
      name: Policy and Procedures
      description: "Define policies and procedures to ensure the protection of OT\
        \ systems and communications. \n Develop a policy that incorporates the specific\
        \ requirements for OT systems. \n Include guidance on the use of secure protocols\
        \ and defence-in-depth mechanisms. \n Provide training for OT staff on the\
        \ implementation of protection procedures"
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "D\xE9finir des politiques et proc\xE9dures pour assurer la\
            \ protection des syst\xE8mes et des communications OT.\n\xC9laborer une\
            \ politique int\xE9grant les exigences sp\xE9cifiques aux syst\xE8mes\
            \ OT.\nInclure des directives sur l\u2019usage des protocoles s\xE9curis\xE9\
            s et les m\xE9canismes de d\xE9fense en profondeur.\nAssurer la formation\
            \ du personnel OT sur la mise en \u0153uvre des proc\xE9dures de protection"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-2
      name: Separation of System and User Functionality
      description: "Ensure the separation of administrative and operational functions\
        \ of OT systems to minimize the risk of intrusion. \n Set up separate accounts\
        \ for the administration and operation of systems. \n Use separate systems\
        \ for OT management and operations. \n Implement enhanced logging measures\
        \ to detect anomalous activity."
      translations:
        fr:
          name: "S\xE9paration des fonctions syst\xE8me et utilisateur"
          description: "Assurer la s\xE9paration des fonctions administratives et\
            \ op\xE9rationnelles des syst\xE8mes OT pour minimiser les risques d\u2019\
            intrusion.\nMettre en place des comptes distincts pour l\u2019administration\
            \ et l\u2019exploitation des syst\xE8mes.\nUtiliser des syst\xE8mes s\xE9\
            par\xE9s pour la gestion OT et les op\xE9rations.\nMettre en place des\
            \ mesures de journalisation renforc\xE9e pour d\xE9tecter toute activit\xE9\
            \ anormale."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-3
      name: Security Function Isolation
      description: "Ensure the isolation of security functions to prevent them from\
        \ being compromised by unauthorized users. \n Implement secure architectures\
        \ with strong access controls. \n Deploy OT equipment with dedicated security\
        \ modules (e.g. industrial firewalls). \n Regularly check that security features\
        \ cannot be disabled by a standard user"
      translations:
        fr:
          name: "Isolation des fonctions de s\xE9curit\xE9"
          description: "Assurer l\u2019isolement des fonctions de s\xE9curit\xE9 pour\
            \ \xE9viter leur compromission par des utilisateurs non autoris\xE9s.\n\
            Impl\xE9menter des architectures s\xE9curis\xE9es avec des contr\xF4les\
            \ d\u2019acc\xE8s renforc\xE9s.\nD\xE9ployer des \xE9quipements OT avec\
            \ des modules de s\xE9curit\xE9 d\xE9di\xE9s (ex: firewalls industriels).\n\
            V\xE9rifier r\xE9guli\xE8rement que les fonctions de s\xE9curit\xE9 ne\
            \ peuvent pas \xEAtre d\xE9sactiv\xE9es par un utilisateur standard"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-4
      name: Information in System Shared Resources
      description: "Prevent sensitive information from leaking when resources are\
        \ shared between different processes. \n Restrict access to critical information\
        \ to only authorized users and processes. \n Implement mechanisms for segmenting\
        \ and isolating OT systems. \n Conduct audits to identify risks related to\
        \ shared resources"
      translations:
        fr:
          name: "Informations dans les ressources partag\xE9es du syst\xE8me"
          description: "\xC9viter la fuite d\u2019informations sensibles lorsque des\
            \ ressources sont partag\xE9es entre diff\xE9rents processus.\nRestreindre\
            \ l\u2019acc\xE8s aux informations critiques uniquement aux utilisateurs\
            \ et processus autoris\xE9s.\nImpl\xE9menter des m\xE9canismes de segmentation\
            \ et d\u2019isolation des syst\xE8mes OT.\nEffectuer des audits pour identifier\
            \ les risques li\xE9s aux ressources partag\xE9es"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-5
      name: Denial-of-Service Protection
      description: "Protect OT systems from DoS attacks that can disrupt critical\
        \ operations. \n Prioritize protection against DoS attacks based on OT risk\
        \ analysis. \n Use industrial firewalls and anomaly detection systems to block\
        \ attacks in advance. \n Implement incident response plans to quickly restore\
        \ services in the event of an attack"
      translations:
        fr:
          name: "Protection contre les attaques par d\xE9ni de service"
          description: "Prot\xE9ger les syst\xE8mes OT contre les attaques DoS qui\
            \ peuvent perturber les op\xE9rations critiques.\nPrioriser la protection\
            \ contre les attaques DoS en fonction de l\u2019analyse des risques OT.\n\
            Utiliser des firewalls industriels et des syst\xE8mes de d\xE9tection\
            \ d\u2019anomalies pour bloquer les attaques en amont.\nMettre en place\
            \ des plans de r\xE9ponse aux incidents pour restaurer rapidement les\
            \ services en cas d\u2019attaque"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-7
      name: Boundary Protection
      description: "Secure OT system boundaries to prevent unauthorized access. \n\
        \ Segment OT and IT networks with separate security zones. \n Deploy secure\
        \ gateways to filter exchanges between OT and IT. \n Use secure protocols\
        \ and VPNs for traffic between industrial sites."
      translations:
        fr:
          name: "Protection des fronti\xE8res"
          description: "S\xE9curiser les fronti\xE8res des syst\xE8mes OT pour emp\xEA\
            cher les acc\xE8s non autoris\xE9s.\nSegmenter les r\xE9seaux OT et IT\
            \ avec des zones de s\xE9curit\xE9 distinctes.\nD\xE9ployer des passerelles\
            \ s\xE9curis\xE9es pour filtrer les \xE9changes entre OT et IT.\nUtiliser\
            \ des protocoles s\xE9curis\xE9s et des VPN pour le trafic entre les sites\
            \ industriels."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-8
      name: Transmission Confidentiality and Integrity
      description: "Ensure the confidentiality and integrity of OT communications\
        \ in transit. \n Implement encryption protocols for sensitive communications.\
        \ \n Verify that transmission mechanisms do not generate critical latency\
        \ for OT operations. \n Regularly assess the security of communication channels"
      translations:
        fr:
          name: "Confidentialit\xE9 et int\xE9grit\xE9 des transmissions"
          description: "Assurer la confidentialit\xE9 et l\u2019int\xE9grit\xE9 des\
            \ communications OT en transit.\nMettre en place des protocoles de chiffrement\
            \ pour les communications sensibles.\nV\xE9rifier que les m\xE9canismes\
            \ de transmission ne g\xE9n\xE8rent pas de latence critique pour les op\xE9\
            rations OT.\n\xC9valuer r\xE9guli\xE8rement la s\xE9curit\xE9 des canaux\
            \ de communication"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-10
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-10
      name: Network Disconnect
      description: "Manage network disconnection based on risk and operational needs.\
        \ \n Define scenarios for secure disconnection in the event of an incident.\
        \ \n Automate the cutting of unauthorized connections through real-time monitoring\
        \ systems. \n Regularly test logout procedures to ensure they are effective."
      translations:
        fr:
          name: "D\xE9connexion r\xE9seau"
          description: "G\xE9rer la d\xE9connexion des r\xE9seaux en fonction des\
            \ risques et des besoins op\xE9rationnels.\nD\xE9finir des sc\xE9narios\
            \ de d\xE9connexion s\xE9curis\xE9e en cas d\u2019incident.\nAutomatiser\
            \ la coupure des connexions non autoris\xE9es via des syst\xE8mes de surveillance\
            \ en temps r\xE9el.\nTester r\xE9guli\xE8rement les proc\xE9dures de d\xE9\
            connexion pour s\u2019assurer de leur efficacit\xE9."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-12
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-12
      name: Cryptographic Key Establishment and Management
      description: "Ensure effective management of cryptographic keys used to secure\
        \ OT communications. \n Establish a key management process that aligns with\
        \ industry best practices. \n Use secure hardware modules (HSMs) to store\
        \ and protect keys. \n Regularly audit key management mechanisms to identify\
        \ potential vulnerabilities."
      translations:
        fr:
          name: "\xC9tablissement et gestion des cl\xE9s cryptographiques"
          description: "Assurer une gestion efficace des cl\xE9s cryptographiques\
            \ utilis\xE9es pour s\xE9curiser les communications OT.\n\xC9tablir un\
            \ processus de gestion des cl\xE9s conforme aux meilleures pratiques du\
            \ secteur.\nUtiliser des modules mat\xE9riels s\xE9curis\xE9s (HSM) pour\
            \ stocker et prot\xE9ger les cl\xE9s.\nAuditer r\xE9guli\xE8rement les\
            \ m\xE9canismes de gestion des cl\xE9s pour identifier les failles potentielles."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-15
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-15
      name: Collaborative Computing Devices and Applications
      description: "Manage the risks of using collaborative applications in an OT\
        \ environment. \n Restrict the use of collaborative tools that could compromise\
        \ the security of OT systems. \n Verify that the applications used comply\
        \ with industrial cybersecurity standards. \n Disable non-essential functions\
        \ on devices connected to critical systems."
      translations:
        fr:
          name: "S\xE9curit\xE9 des dispositifs et applications collaboratives"
          description: "G\xE9rer les risques li\xE9s \xE0 l\u2019utilisation d\u2019\
            applications collaboratives dans un environnement OT.\nRestreindre l\u2019\
            usage des outils collaboratifs qui pourraient compromettre la s\xE9curit\xE9\
            \ des syst\xE8mes OT.\nV\xE9rifier que les applications utilis\xE9es respectent\
            \ les normes de cybers\xE9curit\xE9 industrielle.\nD\xE9sactiver les fonctions\
            \ non essentielles sur les dispositifs connect\xE9s aux syst\xE8mes critiques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-28
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-28
      name: Protection of Information at Rest
      description: "Ensure the protection of sensitive data stored in OT systems.\
        \ \n Use encryption of sensitive data stored on industrial systems. \n Restrict\
        \ physical and logical access to critical data storage servers. \n Set up\
        \ secure backups to prevent data loss."
      translations:
        fr:
          name: Protection des informations au repos
          description: "Assurer la protection des donn\xE9es sensibles stock\xE9es\
            \ dans les syst\xE8mes OT.\nUtiliser le chiffrement des donn\xE9es sensibles\
            \ stock\xE9es sur les syst\xE8mes industriels.\nRestreindre l\u2019acc\xE8\
            s physique et logique aux serveurs de stockage des donn\xE9es critiques.\n\
            Mettre en place des sauvegardes s\xE9curis\xE9es pour pr\xE9venir les\
            \ pertes de donn\xE9es."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-45
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-45
      name: System Time Synchronization
      description: "Ensure synchronization of OT system clocks to ensure consistency\
        \ of events and audit logs. \n Use reliable reference time sources (e.g.,\
        \ GPS, IEEE 1588). \n Implement centralized synchronization mechanisms for\
        \ all OT equipment. \n Regularly check timestamps for consistency in system\
        \ and network logs"
      translations:
        fr:
          name: "Synchronisation de l\u2019horloge du syst\xE8me"
          description: "Assurer la synchronisation des horloges des syst\xE8mes OT\
            \ pour garantir la coh\xE9rence des \xE9v\xE9nements et journaux d\u2019\
            audit.\nUtiliser des sources de temps de r\xE9f\xE9rence fiables (ex:\
            \ GPS, IEEE 1588).\nMettre en place des m\xE9canismes de synchronisation\
            \ centralis\xE9s pour l\u2019ensemble des \xE9quipements OT.\nV\xE9rifier\
            \ r\xE9guli\xE8rement la coh\xE9rence des horodatages dans les journaux\
            \ syst\xE8me et r\xE9seau"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc-47
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sc
      ref_id: SC-47
      name: Alternate Communications Path
      description: "Implement communication alternatives to ensure business continuity\
        \ in the event of an incident. \n Define backup communication paths to ensure\
        \ the resiliency of OT networks. \n Regularly test backup communication mechanisms.\
        \ \n Train staff on the use of alternative routes in the event of a breakdown\
        \ or attack"
      translations:
        fr:
          name: Chemins de communication alternatifs
          description: "Mettre en place des alternatives de communication pour garantir\
            \ la continuit\xE9 des op\xE9rations en cas d\u2019incident.\nD\xE9finir\
            \ des chemins de communication de secours pour assurer la r\xE9silience\
            \ des r\xE9seaux OT.\nTester r\xE9guli\xE8rement les m\xE9canismes de\
            \ communication de secours.\nFormer le personnel sur l\u2019usage des\
            \ voies alternatives en cas de panne ou d\u2019attaque"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      assessable: false
      depth: 1
      ref_id: SI
      name: System and Information Integrity
      translations:
        fr:
          name: "Int\xE9grit\xE9 des syst\xE8mes et des informations"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-1
      name: Policy and Procedures
      description: "Establish specific policies and procedures to ensure the integrity\
        \ of OT systems and information. \n Develop policies that take into account\
        \ the specificities of OT and their relationship with IT systems. \n Define\
        \ processes for managing incidents related to the integrity of industrial\
        \ systems. \n Train OT teams on data integrity best practices"
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "\xC9tablir des politiques et proc\xE9dures sp\xE9cifiques\
            \ pour garantir l'int\xE9grit\xE9 des syst\xE8mes et des informations\
            \ OT.\n\xC9laborer des politiques prenant en compte les sp\xE9cificit\xE9\
            s OT et leur relation avec les syst\xE8mes IT.\nD\xE9finir des processus\
            \ de gestion des incidents li\xE9s \xE0 l\u2019int\xE9grit\xE9 des syst\xE8\
            mes industriels.\nFormer les \xE9quipes OT sur les meilleures pratiques\
            \ en mati\xE8re d'int\xE9grit\xE9 des donn\xE9es"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-2
      name: Flaw Remediation
      description: "Identify, remediate, and manage vulnerabilities in OT systems\
        \ while minimizing the impact on availability. \n Implement validation and\
        \ testing processes before patching. \n Employ compensatory measures (e.g.,\
        \ network segmentation, access throttling) when patches are not available.\
        \ \n Follow the cybersecurity recommendations of specialized organizations\
        \ (e.g. CISA, ICS-CERT)"
      translations:
        fr:
          name: Correction des failles
          description: "Identifier, corriger et g\xE9rer les vuln\xE9rabilit\xE9s\
            \ des syst\xE8mes OT tout en limitant l\u2019impact sur la disponibilit\xE9\
            .\nMettre en place des processus de validation et de test avant l\u2019\
            application des correctifs.\nEmployer des mesures compensatoires (ex:\
            \ segmentation r\xE9seau, limitation des acc\xE8s) lorsque les correctifs\
            \ ne sont pas disponibles.\nSuivre les recommandations de cybers\xE9curit\xE9\
            \ des organismes sp\xE9cialis\xE9s (ex: CISA, ICS-CERT)"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-3
      name: Malicious Code Protection
      description: "Deploy malware protections without impacting critical OT system\
        \ operations. \n Check that the protection mechanisms do not affect the performance\
        \ of industrial equipment. \n Restrict the use of removable media and other\
        \ potential vectors of infection. \n Perform security scans on software updates\
        \ before they are installed."
      translations:
        fr:
          name: Protection contre les codes malveillants
          description: "D\xE9ployer des protections contre les logiciels malveillants\
            \ sans impacter les op\xE9rations critiques des syst\xE8mes OT.\nV\xE9\
            rifier que les m\xE9canismes de protection n\u2019affectent pas la performance\
            \ des \xE9quipements industriels.\nRestreindre l\u2019usage des supports\
            \ amovibles et d\u2019autres vecteurs potentiels d\u2019infection.\nEffectuer\
            \ des analyses de s\xE9curit\xE9 sur les mises \xE0 jour de logiciels\
            \ avant leur installation."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-4
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-4
      name: System Monitoring
      description: "Implement monitoring mechanisms to detect suspicious activity\
        \ and threats in real-time. \n Deploy monitoring solutions adapted to OT environments\
        \ (e.g. IDS specific to industrial networks). \n Set up alerts on unusual\
        \ events without generating disruptions. \n Regularly audit security logs\
        \ and access to critical systems."
      translations:
        fr:
          name: "Surveillance des syst\xE8mes"
          description: "Mettre en place des m\xE9canismes de surveillance pour d\xE9\
            tecter les activit\xE9s suspectes et les menaces en temps r\xE9el.\nD\xE9\
            ployer des solutions de monitoring adapt\xE9es aux environnements OT (ex:\
            \ IDS sp\xE9cifiques aux r\xE9seaux industriels).\nMettre en place des\
            \ alertes sur les \xE9v\xE9nements inhabituels sans g\xE9n\xE9rer de perturbations.\n\
            Auditer r\xE9guli\xE8rement les journaux de s\xE9curit\xE9 et les acc\xE8\
            s aux syst\xE8mes critiques."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-5
      name: Security Alerts, Advisories, and Directives
      description: "Ensure effective updating and dissemination of OT cybersecurity\
        \ alerts and recommendations. \n Use cybersecurity alerts published by specialized\
        \ agencies (e.g. CISA, ICS-CERT). \n Integrate an active monitoring process\
        \ on vulnerabilities impacting industrial equipment. \n Train teams on emerging\
        \ threat management and appropriate responses"
      translations:
        fr:
          name: "Alertes, avis et directives de s\xE9curit\xE9"
          description: "Assurer une mise \xE0 jour et une diffusion efficace des alertes\
            \ et recommandations de cybers\xE9curit\xE9 OT.\nUtiliser les alertes\
            \ de cybers\xE9curit\xE9 publi\xE9es par les agences sp\xE9cialis\xE9\
            es (ex: CISA, ICS-CERT).\nInt\xE9grer un processus de veille active sur\
            \ les vuln\xE9rabilit\xE9s impactant les \xE9quipements industriels.\n\
            Former les \xE9quipes \xE0 la gestion des menaces \xE9mergentes et aux\
            \ r\xE9ponses appropri\xE9es"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-6
      name: Security and Privacy Function Verification
      description: "Validate the effectiveness of the security mechanisms put in place\
        \ on OT systems. \n Plan periodic security tests in accordance with operational\
        \ constraints. \n Verify that protection mechanisms do not impact the availability\
        \ of critical systems. \n Document detected deviations and improvement plans"
      translations:
        fr:
          name: "V\xE9rification des fonctions de s\xE9curit\xE9 et de confidentialit\xE9"
          description: "Valider l\u2019efficacit\xE9 des m\xE9canismes de s\xE9curit\xE9\
            \ mis en place sur les syst\xE8mes OT.\nPlanifier des tests de s\xE9curit\xE9\
            \ p\xE9riodiques en accord avec les contraintes op\xE9rationnelles.\n\
            V\xE9rifier que les m\xE9canismes de protection n\u2019impactent pas la\
            \ disponibilit\xE9 des syst\xE8mes critiques.\nDocumenter les \xE9carts\
            \ d\xE9tect\xE9s et les plans d\u2019am\xE9lioration"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-7
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-7
      name: Software, Firmware, and Information Integrity
      description: "Ensure that software and firmware used in OT systems have not\
        \ been tampered with. \n Use digital signatures and integrity validation mechanisms.\
        \ \n Verify that updates are applied securely. \n Implement real-time monitoring\
        \ solutions to detect unauthorized changes"
      translations:
        fr:
          name: "Int\xE9grit\xE9 des logiciels, micrologiciels et informations"
          description: "Assurer que les logiciels et micrologiciels utilis\xE9s dans\
            \ les syst\xE8mes OT n\u2019ont pas \xE9t\xE9 alt\xE9r\xE9s.\nEmployer\
            \ des signatures num\xE9riques et des m\xE9canismes de validation d\u2019\
            int\xE9grit\xE9.\nV\xE9rifier que les mises \xE0 jour sont appliqu\xE9\
            es de mani\xE8re s\xE9curis\xE9e.\nMettre en place des solutions de surveillance\
            \ en temps r\xE9el pour d\xE9tecter les modifications non autoris\xE9\
            es"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-8
      name: Spam Protection
      description: "Prevent the intrusion of spam and other forms of unwanted traffic\
        \ into OT systems. \n Disable non-essential features like email and web browsing\
        \ on OT systems. \n Restrict access to network services to only necessary\
        \ equipment. \n Verify the effectiveness of spam controls applied to connected\
        \ networks."
      translations:
        fr:
          name: Protection contre le spam
          description: "Emp\xEAcher l\u2019intrusion de spam et d\u2019autres formes\
            \ de trafic ind\xE9sirable dans les syst\xE8mes OT.\nD\xE9sactiver les\
            \ fonctionnalit\xE9s non essentielles comme les emails et la navigation\
            \ web sur les syst\xE8mes OT.\nRestreindre l\u2019acc\xE8s aux services\
            \ r\xE9seau uniquement aux \xE9quipements n\xE9cessaires.\nV\xE9rifier\
            \ l\u2019efficacit\xE9 des contr\xF4les anti-spam appliqu\xE9s aux r\xE9\
            seaux connect\xE9s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-10
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-10
      name: Information Input Validation
      description: "Ensure that data entered into OT systems is valid and does not\
        \ contain malicious content. \n Verify input data on critical interfaces (e.g.\
        \ SCADA, HMI). \n Implement filtering and validation mechanisms for orders\
        \ sent to industrial equipment. \n Restrict the types of input accepted to\
        \ limit the risk of injection attacks"
      translations:
        fr:
          name: "Validation des entr\xE9es d'information"
          description: "Assurer que les donn\xE9es saisies dans les syst\xE8mes OT\
            \ sont valides et ne contiennent pas de contenus malveillants.\nV\xE9\
            rifier les donn\xE9es d\u2019entr\xE9e sur les interfaces critiques (ex:\
            \ SCADA, HMI).\nMettre en place des m\xE9canismes de filtrage et de validation\
            \ des commandes envoy\xE9es aux \xE9quipements industriels.\nRestreindre\
            \ les types d\u2019entr\xE9e accept\xE9s pour limiter les risques d\u2019\
            attaques par injection"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-11
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-11
      name: Error Handling
      description: "Ensure error handling that does not disclose sensitive information\
        \ on OT systems. \n Define error handling mechanisms specific to OT environments.\
        \ \n Avoid overly detailed error messages that can help an attacker. \n Ensure\
        \ critical errors trigger appropriate alerts."
      translations:
        fr:
          name: Gestion des erreurs
          description: "Assurer une gestion des erreurs qui ne divulgue pas d\u2019\
            informations sensibles sur les syst\xE8mes OT.\nD\xE9finir des m\xE9canismes\
            \ de gestion des erreurs sp\xE9cifiques aux environnements OT.\n\xC9viter\
            \ les messages d\u2019erreur trop d\xE9taill\xE9s pouvant aider un attaquant.\n\
            Assurer que les erreurs critiques d\xE9clenchent des alertes appropri\xE9\
            es."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-12
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-12
      name: Information Handling and Retention
      description: "Ensure the retention of critical information for the continuity\
        \ and security of OT operations. \n Define retention and archiving policies\
        \ adapted to industrial systems. \n Ensure restricted access to critical data.\
        \ \n Automate the backup of essential information to prevent data loss"
      translations:
        fr:
          name: "Gestion et r\xE9tention des informations"
          description: "Garantir la conservation des informations critiques pour la\
            \ continuit\xE9 et la s\xE9curit\xE9 des op\xE9rations OT.\nD\xE9finir\
            \ des politiques de conservation et d\u2019archivage adapt\xE9es aux syst\xE8\
            mes industriels.\nAssurer l\u2019acc\xE8s restreint aux donn\xE9es critiques.\n\
            Automatiser la sauvegarde des informations essentielles pour \xE9viter\
            \ les pertes de donn\xE9es"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si-13
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:si
      ref_id: SI-13
      name: Predictable Failure Prevention
      description: "Identify and mitigate potential causes of outages in OT systems.\
        \ \n Implement mechanisms to monitor hardware and software failures. \n Perform\
        \ risk analyses on critical components. \n Plan preventive interventions on\
        \ aging equipment"
      translations:
        fr:
          name: "Pr\xE9vention des pannes pr\xE9visibles"
          description: "Identifier et att\xE9nuer les causes potentielles de pannes\
            \ dans les syst\xE8mes OT.\nMettre en place des m\xE9canismes de surveillance\
            \ des d\xE9faillances mat\xE9rielles et logicielles.\nR\xE9aliser des\
            \ analyses de risque sur les composants critiques.\nPlanifier des interventions\
            \ pr\xE9ventives sur les \xE9quipements vieillissants"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      assessable: false
      depth: 1
      ref_id: SR
      name: Supply Chain Risk Management
      translations:
        fr:
          name: "Gestion des risques de la cha\xEEne d'approvisionnement"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr-1
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      ref_id: SR-1
      name: Policy and Procedures
      description: "Develop policies and procedures to manage risks related to the\
        \ supply chain of OT components. \n Integrate cybersecurity controls into\
        \ vendor selection. \n Define evaluation criteria for incoming and produced\
        \ components. \n Implement compensating controls for OT systems using outdated\
        \ components"
      translations:
        fr:
          name: "Politiques et proc\xE9dures"
          description: "D\xE9velopper des politiques et des proc\xE9dures pour g\xE9\
            rer les risques li\xE9s \xE0 la cha\xEEne d\u2019approvisionnement des\
            \ composants OT.\nInt\xE9grer les contr\xF4les de cybers\xE9curit\xE9\
            \ dans la s\xE9lection des fournisseurs.\nD\xE9finir des crit\xE8res d\u2019\
            \xE9valuation pour les composants re\xE7us et produits.\nMettre en place\
            \ des contr\xF4les compensatoires pour les syst\xE8mes OT utilisant des\
            \ composants obsol\xE8tes"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr-2
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      ref_id: SR-2
      name: Supply Chain Risk Management Plan
      description: "Establish a structured supply chain risk management plan, incorporating\
        \ the identification and mitigation of potential threats. \n Identify critical\
        \ assets dependent on the supply chain. \n Establish a team dedicated to supplier\
        \ risk management. \n Ensure continuous monitoring of threats affecting key\
        \ suppliers."
      translations:
        fr:
          name: "Plan de gestion des risques de la cha\xEEne d\u2019approvisionnement"
          description: "\xC9tablir un plan structur\xE9 de gestion des risques li\xE9\
            s \xE0 la cha\xEEne d\u2019approvisionnement, int\xE9grant l'identification\
            \ et l'att\xE9nuation des menaces potentielles.\nIdentifier les actifs\
            \ critiques d\xE9pendant de la cha\xEEne d\u2019approvisionnement.\nMettre\
            \ en place une \xE9quipe d\xE9di\xE9e \xE0 la gestion des risques fournisseurs.\n\
            Assurer une surveillance continue des menaces affectant les fournisseurs\
            \ cl\xE9s."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr-3
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      ref_id: SR-3
      name: Supply Chain Controls and Processes
      description: "Implement secure processes to minimize risk from third-party suppliers\
        \ and components. \n Diversify suppliers to avoid failures common to a single\
        \ source. \n Assess suppliers' manufacturing and cybersecurity practices.\
        \ \n Verify the conformity of components before they are integrated into OT\
        \ systems."
      translations:
        fr:
          name: "Contr\xF4les et processus de la cha\xEEne d\u2019approvisionnement"
          description: "Mettre en place des processus s\xE9curis\xE9s pour minimiser\
            \ les risques li\xE9s aux fournisseurs et composants tiers.\nDiversifier\
            \ les fournisseurs pour \xE9viter les d\xE9faillances communes \xE0 une\
            \ seule source.\n\xC9valuer les pratiques de fabrication et de cybers\xE9\
            curit\xE9 des fournisseurs.\nV\xE9rifier la conformit\xE9 des composants\
            \ avant leur int\xE9gration aux syst\xE8mes OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr-5
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      ref_id: SR-5
      name: Acquisition Strategies, Tools, and Methods
      description: "Develop robust acquisition strategies to ensure the availability\
        \ of critical components of OT systems. \n Maintain a stock of critical spare\
        \ parts to avoid interruptions in the event of a shortage. \n Establish trusted\
        \ partnerships with certified suppliers. \n Verify the reliability of suppliers\
        \ by conducting regular audits."
      translations:
        fr:
          name: "Strat\xE9gies, outils et m\xE9thodes d\u2019acquisition"
          description: "\xC9laborer des strat\xE9gies d\u2019acquisition robustes\
            \ pour garantir la disponibilit\xE9 des composants critiques des syst\xE8\
            mes OT.\nMaintenir un stock de pi\xE8ces de rechange critiques pour \xE9\
            viter les interruptions en cas de p\xE9nurie.\n\xC9tablir des partenariats\
            \ de confiance avec des fournisseurs certifi\xE9s.\nV\xE9rifier la fiabilit\xE9\
            \ des fournisseurs en r\xE9alisant des audits r\xE9guliers."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr-6
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      ref_id: SR-6
      name: Supplier Assessments and Reviews
      description: "Conduct periodic vendor assessments to ensure compliance with\
        \ OT security requirements. \n Assess vendor cybersecurity posture through\
        \ compliance audits. \n Require safety reports on critical components. \n\
        \ Set up a watch to identify potential vulnerabilities in suppliers."
      translations:
        fr:
          name: "\xC9valuations et revues des fournisseurs"
          description: "Effectuer des \xE9valuations p\xE9riodiques des fournisseurs\
            \ pour garantir leur conformit\xE9 avec les exigences de s\xE9curit\xE9\
            \ OT.\n\xC9valuer la posture de cybers\xE9curit\xE9 des fournisseurs via\
            \ des audits de conformit\xE9.\nExiger des rapports de s\xE9curit\xE9\
            \ sur les composants critiques.\nMettre en place une veille pour identifier\
            \ les vuln\xE9rabilit\xE9s potentielles chez les fournisseurs."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr-8
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      ref_id: SR-8
      name: Notification Agreements
      description: "Establish agreements with vendors to ensure transparency and timely\
        \ communication in the event of vulnerabilities or security incidents. \n\
        \ Require vendors to provide prompt notification when vulnerabilities are\
        \ discovered in their products. \n Define SLAs (Service Level Agreements)\
        \ to govern incident response and remediation times. \n Proactively monitor\
        \ cybersecurity alerts affecting OT components."
      translations:
        fr:
          name: Accords de notification
          description: "\xC9tablir des accords avec les fournisseurs pour garantir\
            \ la transparence et la communication rapide en cas de vuln\xE9rabilit\xE9\
            s ou d\u2019incidents de s\xE9curit\xE9.\nExiger des fournisseurs une\
            \ notification rapide en cas de d\xE9couverte de vuln\xE9rabilit\xE9s\
            \ affectant leurs produits.\nD\xE9finir des SLA (Service Level Agreements)\
            \ pour encadrer les d\xE9lais de r\xE9ponse et de correction des incidents.\n\
            Assurer une surveillance proactive des alertes de cybers\xE9curit\xE9\
            \ affectant les composants OT."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr-9
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      ref_id: SR-9
      name: Tamper Resistance and Detection
      description: "Implement measures to detect any physical or software tampering\
        \ with OT components throughout their lifecycle. \n Verify the integrity of\
        \ the equipment received by implementing authenticity checks. \n Deploy mechanisms\
        \ to detect unauthorized changes to critical components. \n Raise awareness\
        \ among operators to identify signs of physical tampering on industrial equipment."
      translations:
        fr:
          name: "R\xE9sistance et d\xE9tection des alt\xE9rations"
          description: "Mettre en place des mesures pour d\xE9tecter toute alt\xE9\
            ration physique ou logicielle des composants OT tout au long de leur cycle\
            \ de vie.\nV\xE9rifier l\u2019int\xE9grit\xE9 des \xE9quipements re\xE7\
            us en mettant en place des contr\xF4les d\u2019authenticit\xE9.\nD\xE9\
            ployer des m\xE9canismes de d\xE9tection des modifications non autoris\xE9\
            es des composants critiques.\nSensibiliser les op\xE9rateurs \xE0 identifier\
            \ les signes d\u2019alt\xE9ration physique sur les \xE9quipements industriels."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr-10
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      ref_id: SR-10
      name: Inspection of Systems or Components
      description: "Implement a process for systematically inspecting components before\
        \ they are integrated into OT systems. \n Require compliance certifications\
        \ for critical equipment. \n Verify the provenance and authenticity of components\
        \ prior to installation. \n Use analysis tools to detect possible software\
        \ or hardware alterations"
      translations:
        fr:
          name: "Inspection des syst\xE8mes ou composants"
          description: "Mettre en place un processus d\u2019inspection syst\xE9matique\
            \ des composants avant leur int\xE9gration aux syst\xE8mes OT.\nExiger\
            \ des certifications de conformit\xE9 pour les \xE9quipements critiques.\n\
            V\xE9rifier la provenance et l\u2019authenticit\xE9 des composants avant\
            \ leur installation.\nUtiliser des outils d\u2019analyse pour d\xE9tecter\
            \ d\u2019\xE9ventuelles alt\xE9rations logicielles ou mat\xE9rielles"
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr-11
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      ref_id: SR-11
      name: Component Authenticity
      description: "Ensure that components used in OT systems are authentic and free\
        \ of counterfeits. \n Implement authenticity validation processes, including\
        \ verification of serial numbers and digital signatures. \n Require suppliers\
        \ to provide guarantees on the authenticity and traceability of components.\
        \ \n Actively monitor alerts about counterfeit components in the marketplace."
      translations:
        fr:
          name: "Authenticit\xE9 des composants"
          description: "Assurer que les composants utilis\xE9s dans les syst\xE8mes\
            \ OT sont authentiques et exempts de contre-fa\xE7ons.\nMettre en place\
            \ des processus de validation d\u2019authenticit\xE9, incluant la v\xE9\
            rification des num\xE9ros de s\xE9rie et des signatures num\xE9riques.\n\
            Exiger des fournisseurs des garanties sur l\u2019authenticit\xE9 et la\
            \ tra\xE7abilit\xE9 des composants.\nSurveiller activement les alertes\
            \ concernant des composants contrefaits sur le march\xE9."
    - urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr-12
      assessable: true
      depth: 2
      parent_urn: urn:groupe-schmidt:risk:req_node:nist-sp-800-82-annex-f:sr
      ref_id: SR-12
      name: Component Disposal
      description: "Ensure secure disposal of obsolete or compromised OT components\
        \ to prevent unauthorized reuse. \n Define a procedure for the secure destruction\
        \ of critical components. \n Follow e-waste disposal regulations. \n Ensure\
        \ traceability of disposed components to avoid potential leaks."
      translations:
        fr:
          name: "\xC9limination des composants"
          description: "Assurer une \xE9limination s\xE9curis\xE9e des composants\
            \ OT obsol\xE8tes ou compromis pour \xE9viter leur r\xE9utilisation non\
            \ autoris\xE9e.\nD\xE9finir une proc\xE9dure de destruction s\xE9curis\xE9\
            e des composants critiques.\nSuivre les r\xE9glementations en mati\xE8\
            re d\u2019\xE9limination des d\xE9chets \xE9lectroniques.\nAssurer la\
            \ tra\xE7abilit\xE9 des composants \xE9limin\xE9s pour \xE9viter les fuites\
            \ potentielles."
