urn: urn:intuitem:risk:library:pcidss-4_0
locale: en
ref_id: PCI DSS 4.0
name: Payment Card Industry Data Security Standard
description: 'Payment Card Industry Data Security Standard: Requirements and Testing
  Procedures, v4.0

  https://www.pcisecuritystandards.org/'
copyright: "\xA92006 - 2022 PCI Security Standards Council, LLC. All Rights Reserved."
version: 2
publication_date: 2025-05-19
provider: PCI Security Standards Council
packager: intuitem
translations:
  fr:
    name: "Norme de s\xE9curit\xE9 de l'industrie des cartes de paiement (PCI-DSS)\
      \ v4.0"
    description: "Norme de s\xE9curit\xE9 de l'industrie des cartes de paiement :\
      \ exigences et proc\xE9dures de test, v4.0\nhttps://www.pcisecuritystandards.org/"
objects:
  framework:
    urn: urn:intuitem:risk:framework:pcidss-4_0
    ref_id: PCI DSS 4.0
    name: Payment Card Industry Data Security Standard (PCI-DSS) 4.0
    description: 'Payment Card Industry Data Security Standard: Requirements and Testing
      Procedures, v4.0

      https://www.pcisecuritystandards.org/'
    translations:
      fr:
        name: "Norme de s\xE9curit\xE9 de l'industrie des cartes de paiement (PCI-DSS)\
          \ v4.0"
        description: "Norme de s\xE9curit\xE9 de l'industrie des cartes de paiement\
          \ : exigences et proc\xE9dures de test, v4.0\nhttps://www.pcisecuritystandards.org/"
    requirement_nodes:
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:build-and-maintain-a-secure-network-and-systems
      assessable: false
      depth: 1
      name: Build and Maintain a Secure Network and Systems
      translations:
        fr:
          name: "Installer et Maintenir des Mesures de S\xE9curit\xE9 du R\xE9seau"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:build-and-maintain-a-secure-network-and-systems
      ref_id: '1'
      name: Requirement 1
      description: Install and Maintain Network Security Controls
      translations:
        fr:
          name: Exigence 1
          description: "Installer et Maintenir des Mesures de S\xE9curit\xE9 du R\xE9\
            seau"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1
      ref_id: '1.1'
      description: Processes and mechanisms for installing and maintaining network
        security controls are defined and understood.
      translations:
        fr:
          description: "Les processus et m\xE9canismes d'installation et de maintenance\
            \ des contr\xF4les de s\xE9curit\xE9 du r\xE9seau sont d\xE9finis et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.1
      ref_id: 1.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 1 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties.'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 1 sont\_:\n\u2022 Document\xE9\
            es.\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.1
      ref_id: 1.1.2
      description: Roles and responsibilities for performing activities in Requirement
        1 are documented, assigned, and understood.
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s pour l'ex\xE9cution\
            \ des activit\xE9s de l'Exigence 1 sont document\xE9s, attribu\xE9s et\
            \ compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1
      ref_id: '1.2'
      description: Network security controls (NSCs) are configured and maintained.
      translations:
        fr:
          description: "Les mesures de s\xE9curit\xE9 de s\xE9curit\xE9 r\xE9seau\
            \ (NSC) sont configur\xE9s et maintenus."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2
      ref_id: 1.2.1
      description: 'Configuration standards for NSC rulesets are

        - Defined.

        - Implemented

        - Maintained.'
      translations:
        fr:
          description: "Les normes de configuration pour les ensembles de r\xE8gles\
            \ NSC sont\_:\n\u2022 D\xE9finies.\n\u2022 Mises en \u0153uvre.\n\u2022\
            \ Entretenues."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2
      ref_id: 1.2.2
      description: All changes to network connections and to configurations of NSCs
        are approved and managed in accordance with the change control process defined
        at Requirement 6.5.1.
      translations:
        fr:
          description: "Toutes les modifications apport\xE9es aux connexions r\xE9\
            seau et aux configurations des NSC sont approuv\xE9es et g\xE9r\xE9es\
            \ conform\xE9ment au processus de contr\xF4le des modifications d\xE9\
            fini \xE0 l'exigence 6.5.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2
      ref_id: 1.2.3
      description: An accurate network diagram(s) is maintained that shows all connections
        between the CDE and other networks, including any wireless networks.
      translations:
        fr:
          description: "Un ou plusieurs sch\xE9mas de r\xE9seau pr\xE9cis sont conserv\xE9\
            s, indiquant toutes les connexions entre le CDE et les autres r\xE9seaux,\
            \ y compris les r\xE9seaux sans fil."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2
      ref_id: 1.2.4
      description: 'An accurate data-flow diagram(s) is maintained that meets the
        following:

        - Shows all account data flows across systems and networks.

        - Updated as needed upon changes to the environment.'
      translations:
        fr:
          description: "Un ou des diagrammes de flux de donn\xE9es pr\xE9cis sont\
            \ maintenus et r\xE9pondent aux crit\xE8res suivants :\n\u2022 Affichent\
            \ tous les flux de donn\xE9es de carte \xE0 travers tous les syst\xE8\
            mes et les r\xE9seaux.\n\u2022 Sont mis \xE0 jour au besoin lors de modifications\
            \ apport\xE9es \xE0 l'environnement."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2
      ref_id: 1.2.5
      description: All services, protocols, and ports allowed are identified, approved,
        and have a defined business need.
      translations:
        fr:
          description: "Tous les services, protocoles et ports autoris\xE9s sont identifi\xE9\
            s, approuv\xE9s et ont un besoin m\xE9tier d\xE9fini."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2
      ref_id: 1.2.6
      description: Security features are defined and implemented for all services,
        protocols, and ports that are in use and considered to be insecure, such that
        the risk is mitigated.
      translations:
        fr:
          description: "Les fonctionnalit\xE9s de s\xE9curit\xE9 sont d\xE9finies\
            \ et mises en oeuvre pour tous les services, protocoles et ports utilis\xE9\
            s et consid\xE9r\xE9s comme non s\xE9curis\xE9s, de sorte que le risque\
            \ soit att\xE9nu\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2
      ref_id: 1.2.7
      description: Configurations of NSCs are reviewed at least once every six months
        to confirm they are relevant and effective.
      translations:
        fr:
          description: "Les configurations des contr\xF4les de s\xE9curit\xE9 r\xE9\
            seau (NSC) sont revues au moins une fois tous les six mois afin de confirmer\
            \ leur pertinence et leur efficacit\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2.8
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.2
      ref_id: 1.2.8
      description: 'Configuration files for NSCs are:

        - Secured from unauthorized access.

        - Kept consistent with active network configurations.'
      translations:
        fr:
          description: "Les fichiers de configuration des NSC sont comme suit :\n\u2022\
            \ S\xE9curis\xE9s contre les acc\xE8s non autoris\xE9s.\n\u2022 Maintenus\
            \ coh\xE9rents avec les configurations de r\xE9seau actives."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1
      ref_id: '1.3'
      description: Network access to and from the cardholder data environment is restricted.
      translations:
        fr:
          description: "L'acc\xE8s au r\xE9seau vers et depuis l'environnement de\
            \ donn\xE9es du titulaire de carte est restreint."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.3
      ref_id: 1.3.1
      description: "Inbound traffic to the CDE is restricted as follows: \n- To only\
        \ traffic that is necessary. \n- All other traffic is specifically denied."
      translations:
        fr:
          description: "Le trafic entrant vers le CDE est limit\xE9 comme suit :\n\
            \u2022 Seul le trafic qui est n\xE9cessaire.\n\u2022 Tout autre trafic\
            \ est sp\xE9cifiquement refus\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.3
      ref_id: 1.3.2
      description: 'Outbound traffic from the CDE is restricted as follows:

        - To only traffic that is necessary.

        - All other traffic is specifically denied.'
      translations:
        fr:
          description: "Le trafic sortant du CDE est limit\xE9 comme suit :\n\u2022\
            \ Seul le trafic qui est n\xE9cessaire.\n\u2022 Tout autre trafic est\
            \ sp\xE9cifiquement refus\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.3.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.3
      ref_id: 1.3.3
      description: "NSCs are installed between all wireless networks and the CDE,\
        \ regardless of whether the wireless network is a CDE, such that: \n- All\
        \ wireless traffic from wireless networks into the CDE is denied by default.\n\
        - Only wireless traffic with an authorized business purpose is allowed into\
        \ the CDE."
      translations:
        fr:
          description: "Les NSC sont install\xE9s entre tous les r\xE9seaux sans fil\
            \ et le CDE, que le r\xE9seau sans fil soit ou non un CDE, de sorte que\
            \ :\n\u2022 Tout le trafic sans fil allant des r\xE9seaux sans fil vers\
            \ le CDE est refus\xE9 par d\xE9faut.\n\u2022 Seul le trafic sans fil\
            \ avec des besoins m\xE9tier autoris\xE9s est autoris\xE9 \xE0 acc\xE9\
            der au CDE."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1
      ref_id: '1.4'
      description: Network connections between trusted and untrusted networks are
        controlled.
      translations:
        fr:
          description: "Les connexions r\xE9seau entre les r\xE9seaux de confiance\
            \ et les r\xE9seaux non fiables sont contr\xF4l\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4
      ref_id: 1.4.1
      description: NSCs are implemented between trusted and untrusted networks.
      translations:
        fr:
          description: "Les NSC sont mis en oeuvre entre les r\xE9seaux approuv\xE9\
            s et les r\xE9seaux non fiables."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4
      ref_id: 1.4.2
      description: 'Inbound traffic from untrusted networks to trusted networks is
        restricted to:

        - Communications with system components that are authorized to provide publicly
        accessible services, protocols, and ports.

        - Stateful responses to communications initiated by system components in a
        trusted network.

        - All other traffic is denied.'
      translations:
        fr:
          description: "Le trafic entrant des r\xE9seaux non fiables vers les r\xE9\
            seaux de confiance est limit\xE9 :\n\u2022 Aux communications avec des\
            \ composants syst\xE8mes autoris\xE9s \xE0 fournir des services, des protocoles\
            \ et des ports accessibles au public.\n\u2022 Aux r\xE9ponses avec \xE9\
            tat aux communications initi\xE9es par les composants syst\xE8me dans\
            \ un r\xE9seau de confiance.\n\u2022 Tout autre trafic est refus\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4
      ref_id: 1.4.3
      description: Anti-spoofing measures are implemented to detect and block forged
        source IP addresses from entering the trusted network.
      translations:
        fr:
          description: "Des mesures d\u2019anti usurpation sont mises en oeuvre afin\
            \ de d\xE9tecter et emp\xEAcher les adresses IP sources falsifi\xE9es\
            \ d'entrer dans le r\xE9seau de confiance."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4
      ref_id: 1.4.4
      description: System components that store cardholder data are not directly accessible
        from untrusted networks.
      translations:
        fr:
          description: "Les composants syst\xE8me qui stockent les donn\xE9es des\
            \ titulaires de cartes ne sont pas directement accessibles \xE0 partir\
            \ de r\xE9seaux non fiables."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.4
      ref_id: 1.4.5
      description: The disclosure of internal IP addresses and routing information
        is limited to only authorized parties.
      translations:
        fr:
          description: "La divulgation des adresses IP internes et des informations\
            \ de routage est limit\xE9e aux seules parties autoris\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.5
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1
      ref_id: '1.5'
      description: Risks to the CDE from computing devices that are able to connect
        to both untrusted networks and the CDE are mitigated.
      translations:
        fr:
          description: "Les risques pour le CDE provenant d'appareils informatiques\
            \ capables de se connecter \xE0 la fois \xE0 des r\xE9seaux non fiables\
            \ et au CDE sont att\xE9nu\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:1.5.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:1.5
      ref_id: 1.5.1
      description: "Security controls are implemented on any computing devices, including\
        \ company- and employee-owned devices, that connect to both untrusted networks\
        \ (including the Internet) and the CDE as follows:\n- Specific configuration\
        \ settings are defined to prevent threats being introduced into the entity\u2019\
        s network.\n- Security controls are actively running.\n- Security controls\
        \ are not alterable by users of the computing devices unless specifically\
        \ documented and authorized by Management on a case-by-case basis for a limited\
        \ period."
      translations:
        fr:
          description: "Des mesures de s\xE9curit\xE9 de s\xE9curit\xE9 sont mis en\
            \ oeuvre sur tous les appareils informatiques, y compris les appareils\
            \ appartenant \xE0 l'entreprise et aux employ\xE9s, qui se connectent\
            \ \xE0 la fois aux r\xE9seaux non fiables (y compris Internet) et au CDE,\
            \ de la mani\xE8re suivante :\n\u2022 Des param\xE8tres de configuration\
            \ sp\xE9cifiques sont d\xE9finis afin d'emp\xEAcher l'introduction de\
            \ menaces dans le r\xE9seau de l'entit\xE9.\n\u2022 Les mesures de s\xE9\
            curit\xE9 de s\xE9curit\xE9 sont activ\xE9es et en cours d'ex\xE9cution.\n\
            \u2022 Les mesures de s\xE9curit\xE9 de s\xE9curit\xE9 ne sont pas modifiables\
            \ par les utilisateurs des appareils informatiques, \xE0 moins qu'ils\
            \ ne soient sp\xE9cifiquement document\xE9s et autoris\xE9s par la direction\
            \ au cas par cas pour une p\xE9riode limit\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:build-and-maintain-a-secure-network-and-systems
      ref_id: '2'
      name: Requirement 2
      description: Apply Secure Configurations to All System Components
      translations:
        fr:
          name: Exigence 2
          description: "Appliquer des Configurations S\xE9curis\xE9es \xE0 tous les\
            \ Composants Syst\xE8me"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2
      ref_id: '2.1'
      description: Processes and mechanisms for applying secure configurations to
        all system components are defined and understood.
      translations:
        fr:
          description: "Les processus et m\xE9canismes d'application de configurations\
            \ s\xE9curis\xE9es \xE0 tous les composants syst\xE8me sont d\xE9finis\
            \ et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.1
      ref_id: 2.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 2 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties.'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 2 sont :\n\u2022 Document\xE9\
            es.\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.1
      ref_id: 2.1.2
      description: Roles and responsibilities for performing activities in Requirement
        2 are documented, assigned, and understood.
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s li\xE9es aux activit\xE9\
            s de l'exigence 2 sont document\xE9s, attribu\xE9s et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2
      ref_id: '2.2'
      description: System components are configured and managed securely.
      translations:
        fr:
          description: "Les composants syst\xE8me sont configur\xE9s et g\xE9r\xE9\
            s en toute s\xE9curit\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2
      ref_id: 2.2.1
      description: 'Configuration standards are developed, implemented, and maintained
        to:

        - Cover all system components.

        - Be consistent with industry-accepted system hardening standards or vendor
        hardening recommendations.

        - Be updated as new vulnerability issues are identified, as defined in Requirement
        6.3.1.

        - Be applied when new systems are configured and verified as in place before
        or immediately after a system component is connected to a production environment.'
      translations:
        fr:
          description: "Les standards de configuration sont \xE9labor\xE9es, mises\
            \ en oeuvre et maintenues pour :\n\u2022 Couvrir tous les composants syst\xE8\
            me.\n\u2022 Corriger toutes les vuln\xE9rabilit\xE9s de s\xE9curit\xE9\
            \ connues.\n\u2022 Se conformer aux standards relatifs \xE0 la s\xE9curit\xE9\
            \ renforc\xE9e des syst\xE8mes agr\xE9\xE9s par l'industrie ou aux recommandations\
            \ pour une s\xE9curit\xE9 renforc\xE9e des fournisseurs.\n\u2022 Se tenir\
            \ inform\xE9 des nouvelles vuln\xE9rabilit\xE9s identifi\xE9es, comme\
            \ d\xE9fini dans l'exigence 6.3.1.\n\u2022 \xCAtre appliqu\xE9es lorsque\
            \ de nouveaux syst\xE8mes sont configur\xE9s et v\xE9rifi\xE9s comme \xE9\
            tant en place avant ou imm\xE9diatement apr\xE8s la connexion d'un composant\
            \ syst\xE8me \xE0 un environnement de production."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2
      ref_id: 2.2.2
      description: 'Vendor default accounts are managed as follows:

        - If the vendor default account(s) will be used, the default password is changed
        per Requirement 8.3.6.

        - If the vendor default account(s) will not be used, the account is removed
        or disabled.'
      translations:
        fr:
          description: "Les comptes par d\xE9faut du fournisseur sont g\xE9r\xE9s\
            \ comme suit :\n\u2022 Si le ou les comptes par d\xE9faut du fournisseur\
            \ sont utilis\xE9s, le mot de passe par d\xE9faut est modifi\xE9 conform\xE9\
            ment \xE0 l'exigence 8.3.6.\n\u2022 Si le ou les comptes par d\xE9faut\
            \ du fournisseur ne sont pas utilis\xE9s, le compte est supprim\xE9 ou\
            \ d\xE9sactiv\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2
      ref_id: 2.2.3
      description: "Primary functions requiring different security levels are managed\
        \ as follows: \n- Only one primary function exists on a system component.\n\
        OR \n- Primary functions with differing security levels that exist on the\
        \ same system component are isolated from each other.\nOR\n- Primary functions\
        \ with differing security levels on the same system component are all secured\
        \ to the level required by the function with the highest security need."
      translations:
        fr:
          description: "Les fonctions principales n\xE9cessitant diff\xE9rents niveaux\
            \ de s\xE9curit\xE9 sont g\xE9r\xE9es de la mani\xE8re suivante :\n\u2022\
            \ Une seule fonction principale existe sur un composant syst\xE8me,\n\
            OU\n\u2022 Les fonctions principales avec des niveaux de s\xE9curit\xE9\
            \ diff\xE9rents qui existent sur le m\xEAme composant syst\xE8me sont\
            \ isol\xE9es les unes des autres,\nOU\n\u2022 Les fonctions principales\
            \ avec des niveaux de s\xE9curit\xE9 diff\xE9rents sur le m\xEAme composant\
            \ syst\xE8me sont toutes s\xE9curis\xE9es au niveau exig\xE9 par la fonction\
            \ ayant le besoin de s\xE9curit\xE9 le plus \xE9lev\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2
      ref_id: 2.2.4
      description: Only necessary services, protocols, daemons, and functions are
        enabled, and all unnecessary functionality is removed or disabled.
      translations:
        fr:
          description: "Seuls les services, protocoles, d\xE9mons et fonctions n\xE9\
            cessaires sont activ\xE9s et toutes les fonctionnalit\xE9s inutiles sont\
            \ supprim\xE9es ou d\xE9sactiv\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2
      ref_id: 2.2.5
      description: 'If any insecure services, protocols, or daemons are present:

        - business justification is documented.

        - additional security features are documented and implemented that reduce
        the risk of using insecure services, protocols, or daemons.'
      translations:
        fr:
          description: "Si des services, protocoles ou d\xE9mons non s\xE9curis\xE9\
            s sont pr\xE9sents :\n\u2022 La justification m\xE9tier est document\xE9\
            e.\n\u2022 Des fonctionnalit\xE9s de s\xE9curit\xE9 suppl\xE9mentaires\
            \ sont document\xE9es et mises en oeuvre afin de r\xE9duire le risque\
            \ d'utilisation de services, de protocoles ou de d\xE9mons non s\xE9curis\xE9\
            s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2
      ref_id: 2.2.6
      description: System security parameters are configured to prevent misuse.
      translations:
        fr:
          description: "Les param\xE8tres de s\xE9curit\xE9 du syst\xE8me sont configur\xE9\
            s afin d'\xE9viter toute utilisation abusive."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.2
      ref_id: 2.2.7
      description: All non-console administrative access is encrypted using strong
        cryptography.
      translations:
        fr:
          description: "Tous les acc\xE8s d\u2019administration non-console sont chiffr\xE9\
            s \xE0 l'aide d'une cryptographie robuste."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2
      ref_id: '2.3'
      description: Wireless environments are configured and managed securely.
      translations:
        fr:
          description: "Les environnements sans fil sont configur\xE9s et g\xE9r\xE9\
            s en toute s\xE9curit\xE9"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.3
      ref_id: 2.3.1
      description: "For wireless environments connected to the CDE or transmitting\
        \ account data, all wireless vendor defaults are changed at installation or\
        \ are confirmed to be secure, including but not limited to: \_\n- Default\
        \ wireless encryption keys.\n- Default wireless encryption keys.\n- Passwords\
        \ on wireless access points.\n- SNMP defaults.\n- Any other security-related\
        \ wireless vendor defaults."
      translations:
        fr:
          description: "Pour les environnements sans fil connect\xE9s au CDE ou transmettant\
            \ des donn\xE9es de carte, toutes les valeurs par d\xE9faut du fournisseur\
            \ sans fil sont modifi\xE9es lors de l'installation ou sont confirm\xE9\
            es comme \xE9tant s\xE9curis\xE9es, y compris, sans toutefois s'y limiter\
            \ :\n\u2022 Cl\xE9s cryptographiques sans fil par d\xE9faut.\n\u2022 Mots\
            \ de passe par d\xE9faut des points d'acc\xE8s sans fil.\n\u2022 Valeurs\
            \ SNMP par d\xE9faut.\n\u2022 Toute autre valeur par d\xE9faut du fournisseur\
            \ sans fil li\xE9e \xE0 la s\xE9curit\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:2.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:2.3
      ref_id: 2.3.2
      description: 'For wireless environments connected to the CDE or transmitting
        account data, wireless encryption keys are changed as follows:

        - Whenever personnel with knowledge of the key leave the company or the role
        for which the knowledge was necessary.

        - Whenever a key is suspected of or known to be compromised.'
      translations:
        fr:
          description: "Pour les environnements sans fil connect\xE9s au CDE ou transmettant\
            \ des donn\xE9es de carte, les cl\xE9s cryptographiques sans fil sont\
            \ modifi\xE9es comme suit :\n\u2022 Chaque fois que le personnel connaissant\
            \ la cl\xE9 quitte l'entreprise ou le r\xF4le pour lequel la connaissance\
            \ de la cl\xE9 \xE9tait n\xE9cessaire.\n\u2022 Chaque fois qu'une cl\xE9\
            \ est soup\xE7onn\xE9e ou av\xE9r\xE9e \xEAtre compromise."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:protect-account-data
      assessable: false
      depth: 1
      name: Protect Account Data
      translations:
        fr:
          name: "Prot\xE9ger les Donn\xE9es de Carte Stock\xE9es"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:protect-account-data
      ref_id: '3'
      name: Requirement 3
      description: Protect Stored Account Data
      translations:
        fr:
          name: Exigence 3
          description: "Prot\xE9ger les Donn\xE9es de Carte Stock\xE9es"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3
      ref_id: '3.1'
      description: Processes and mechanisms for protecting stored account data are
        defined and understood.
      translations:
        fr:
          description: "Les processus et m\xE9canismes de protection des donn\xE9\
            es de carte stock\xE9es sont d\xE9finis et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.1
      ref_id: 3.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 3 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties.'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 3 sont :\n\u2022 Document\xE9\
            es.\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.1
      ref_id: 3.1.2
      description: Roles and responsibilities for performing activities in Requirement
        3 are documented, assigned, and understood.
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s li\xE9es aux activit\xE9\
            s de l'exigence 3 sont document\xE9s, attribu\xE9s et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3
      ref_id: '3.2'
      description: Storage of account data is kept to a minimum.
      translations:
        fr:
          description: "Le stockage des donn\xE9es de carte est r\xE9duit au minimum."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.2
      ref_id: 3.2.1
      description: 'Account data storage is kept to a minimum through implementation
        of data retention and disposal policies, procedures, and processes that include
        at least the following:

        - Coverage for all locations of stored account data.

        - Coverage for any sensitive authentication data (SAD) stored prior to completion
        of authorization. This bullet is a best practice until its effective date;
        refer to Applicability Notes below for details.

        - Limiting data storage amount and retention time to that which is required
        for legal or regulatory, and/or business requirements.

        - Specific retention requirements for stored account data that defines length
        of retention period and includes a documented business justification.

        - Processes for secure deletion or rendering account data unrecoverable when
        no longer

        needed per the retention policy.

        - A process for verifying, at least once every three months, that stored account
        data exceeding the defined retention period has been securely deleted or rendered
        unrecoverable.'
      translations:
        fr:
          description: "Le stockage des donn\xE9es de carte est r\xE9duit au minimum\
            \ gr\xE2ce \xE0 la mise en oeuvre de politiques, proc\xE9dures et processus\
            \ de conservation et d'\xE9limination des donn\xE9es qui incluent au moins\
            \ les \xE9l\xE9ments suivants :\n\u2022 Couverture de tous les emplacements\
            \ des donn\xE9es de carte stock\xE9es.\n\u2022 Couverture de toutes les\
            \ donn\xE9es d'authentification sensibles (SAD) stock\xE9es avant la fin\
            \ de l'autorisation. Ce point est une Bonne Pratique jusqu'\xE0 sa date\
            \ d'entr\xE9e en vigueur ; se reporter aux Notes D\u2019applicabilit\xE9\
            \ ci-dessous pour plus de d\xE9tails.\n\u2022 Limiter la quantit\xE9 de\
            \ stockage des donn\xE9es et la dur\xE9e de conservation \xE0 ce qui est\
            \ requis pour les exigences l\xE9gales ou r\xE9glementaires et/ou m\xE9\
            tier.\n\u2022 Des exigences de r\xE9tention sp\xE9cifiques pour les donn\xE9\
            es de carte stock\xE9es qui d\xE9finissent la dur\xE9e de la p\xE9riode\
            \ de conservation et incluent une justification m\xE9tier document\xE9\
            e.\n\u2022 Des processus de suppression s\xE9curis\xE9e ou pour rendre\
            \ les donn\xE9es de carte irr\xE9cup\xE9rables lorsqu'elles ne sont plus\
            \ n\xE9cessaires conform\xE9ment \xE0 la politique de conservation.\n\u2022\
            \ Un processus pour v\xE9rifier, au moins une fois tous les trois mois,\
            \ que les donn\xE9es de carte stock\xE9es d\xE9passant la p\xE9riode de\
            \ conservation d\xE9finie ont \xE9t\xE9 supprim\xE9es en toute s\xE9curit\xE9\
            \ ou rendues irr\xE9cup\xE9rables."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3
      ref_id: '3.3'
      description: Sensitive authentication data (SAD) is not stored after authorization.
      translations:
        fr:
          description: "Les donn\xE9es d'authentification sensibles (SAD) ne sont\
            \ pas stock\xE9es apr\xE8s autorisation."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3
      ref_id: 3.3.1
      description: SAD is not retained after authorization, even if encrypted. All
        sensitive authentication data received is rendered unrecoverable upon completion
        of the authorization process.
      translations:
        fr:
          description: "Les SAD ne sont pas conserv\xE9es apr\xE8s autorisation, m\xEA\
            me si elles sont chiffr\xE9es. Toutes les donn\xE9es d'authentification\
            \ sensibles re\xE7ues sont rendues irr\xE9cup\xE9rables \xE0 la fin du\
            \ processus d'autorisation."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3.1
      ref_id: 3.3.1.1
      description: The full contents of any track are not retained upon completion
        of the authorization process.
      translations:
        fr:
          description: "Le contenu complet d'une piste n'est pas conserv\xE9 \xE0\
            \ la fin du processus d'autorisation."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3.1.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3.1
      ref_id: 3.3.1.2
      description: The card verification code is not retained upon completion of the
        authorization process.
      translations:
        fr:
          description: "Le code de v\xE9rification de la carte n'est pas conserv\xE9\
            \ \xE0 la fin du processus d'autorisation."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3.1.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3.1
      ref_id: 3.3.1.3
      description: The personal identification number (PIN) and the PIN block are
        not retained upon completion of the authorization process
      translations:
        fr:
          description: "Le num\xE9ro d'identification personnel (PIN) et le bloc PIN\
            \ ne sont pas conserv\xE9s \xE0 la fin du processus d'autorisation."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3
      ref_id: 3.3.2
      description: 'SAD that is stored electronically prior to completion of authorization
        is encrypted using

        strong cryptography.'
      translations:
        fr:
          description: "Les SAD qui sont stock\xE9es \xE9lectroniquement avant l'ach\xE8\
            vement de l'autorisation sont chiffr\xE9es \xE0 l'aide d'une cryptographie\
            \ robuste."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.3
      ref_id: 3.3.3
      description: 'Additional requirement for issuers and companies that support
        issuing services and store sensitive authentication data: Any storage of sensitive
        authentication data is:

        - Limited to that which is needed for a legitimate issuing business need and
        is secured.

        - Encrypted using strong cryptography. This bullet is a best practice until
        its effective date.'
      translations:
        fr:
          description: "Exigence suppl\xE9mentaire pour les \xE9metteurs et les entreprises\
            \ qui prennent en charge les services d'\xE9mission et stockent des donn\xE9\
            es d'authentification sensibles : Tout stockage de donn\xE9es d'authentification\
            \ sensibles est :\n\u2022 Limit\xE9 \xE0 ce qui est n\xE9cessaire pour\
            \ un besoin m\xE9tier d'\xE9mission l\xE9gitime, et est s\xE9curis\xE9\
            .\n\u2022 Chiffr\xE9 \xE0 l'aide d'une cryptographie robuste. Ce point\
            \ est une Bonne Pratique jusqu'\xE0 sa date d'entr\xE9e en vigueur ; se\
            \ reporter aux Notes D\u2019applicabilit\xE9 ci-dessous pour plus de d\xE9\
            tails."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3
      ref_id: '3.4'
      description: Access to displays of full PAN and ability to copy cardholder data
        are restricted.
      translations:
        fr:
          description: "L'acc\xE8s aux affichages du PAN complet et la possibilit\xE9\
            \ de copier le PAN sont limit\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.4.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.4
      ref_id: 3.4.1
      description: 'PAN is masked when displayed (the BIN and last four digits are
        the maximum number of digits

        to be displayed), such that only personnel with a legitimate business need
        can see more than the BIN and last four digits of the PAN.'
      translations:
        fr:
          description: "Le PAN est masqu\xE9 lorsqu'il est affich\xE9 (le BIN et les\
            \ quatre derniers chiffres sont le nombre maximum de chiffres \xE0 afficher),\
            \ de sorte que seul le personnel ayant un besoin m\xE9tier l\xE9gitime\
            \ peut voir plus que le BIN et les quatre derniers chiffres du PAN."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.4.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.4
      ref_id: 3.4.2
      description: 'When using remote-access technologies, technical controls prevent
        copy and/or relocation of

        PAN for all personnel, except for those with documented, explicit authorization
        and a legitimate, defined business need.'
      translations:
        fr:
          description: "Lors de l'utilisation de technologies d'acc\xE8s \xE0 distance,\
            \ les mesures de s\xE9curit\xE9 techniques emp\xEAchent la copie et/ou\
            \ la relocalisation du PAN pour tout le personnel, \xE0 l'exception de\
            \ ceux disposant d'une autorisation explicite document\xE9e et d'un besoin\
            \ m\xE9tier l\xE9gitime et d\xE9fini."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.5
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3
      ref_id: '3.5'
      description: Primary account number (PAN) is secured wherever it is stored.
      translations:
        fr:
          description: "Le num\xE9ro de compte primaire (PAN) est s\xE9curis\xE9 partout\
            \ o\xF9 il est stock\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.5.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.5
      ref_id: 3.5.1
      description: "PAN is rendered unreadable anywhere it is stored by using any\
        \ of the following approaches:\n- One-way hashes based on strong cryptography\
        \ of the entire PAN.\n- Truncation (hashing cannot be used to replace the\
        \ truncated segment of PAN).\n\u2013 If hashed and truncated versions of the\
        \ same PAN, or different truncation formats of the same PAN, are present in\
        \ an environment, additional controls are in place such that the different\
        \ versions cannot be correlated to reconstruct the original PAN.\n-  Index\
        \ tokens.\n- Strong cryptography with associated key-management processes\
        \ and procedures."
      translations:
        fr:
          description: "Le PAN est rendu illisible partout o\xF9 il est stock\xE9\
            \ en utilisant l'une des approches suivantes :\n\u2022 Hachage \xE0 sens\
            \ unique bas\xE9 sur une cryptographie robuste de l'int\xE9gralit\xE9\
            \ du PAN.\n\u2022 Troncature (le hachage ne peut pas \xEAtre utilis\xE9\
            \ pour remplacer le segment tronqu\xE9 du PAN).\n\u2013 Si des versions\
            \ hach\xE9es et tronqu\xE9es du m\xEAme PAN, ou des formats de troncature\
            \ diff\xE9rents du m\xEAme PAN, sont pr\xE9sentes dans un environnement,\
            \ des mesures de s\xE9curit\xE9 suppl\xE9mentaires sont en place afin\
            \ que les diff\xE9rentes versions ne puissent pas \xEAtre corr\xE9l\xE9\
            es pour reconstruire le PAN d'origine.\n\u2022 Token d\u2019index.\n\u2022\
            \ Cryptographie robuste avec processus et proc\xE9dures de gestion des\
            \ cl\xE9s associ\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.5.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.5.1
      ref_id: 3.5.1.1
      description: Hashes used to render PAN unreadable (per the first bullet of Requirement
        3.5.1) are keyed cryptographic hashes of the entire PAN, with associated key-management
        processes and procedures in accordance with Requirements 3.6 and 3.7.
      translations:
        fr:
          description: "Les hachages utilis\xE9s pour rendre le PAN illisible (selon\
            \ le premier point de l'exigence 3.5.1) sont des hachages cryptographiques\
            \ de l'ensemble du PAN, avec des processus et proc\xE9dures de gestion\
            \ des cl\xE9s associ\xE9s conformes aux exigences 3.6 et 3.7."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.5.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.5.1
      ref_id: 3.5.1.2
      description: 'If disk-level or partition-level encryption rather than file-,
        column-, or field-level database encryption) is used to render PAN unreadable,
        it is implemented only as follows:

        - On removable electronic media.

        OR

        - If used for non-removable electronic media, PAN is also rendered unreadable
        via another mechanism that meets Requirement 3.5.1.'
      translations:
        fr:
          description: "Si le chiffrement au niveau du disque ou au niveau de la partition\
            \ (plut\xF4t que le chiffrement de la base de donn\xE9es au niveau des\
            \ fichiers, des colonnes ou des champs) est utilis\xE9 pour rendre le\
            \ PAN illisible, il est mis en oeuvre uniquement de la mani\xE8re suivante\
            \ :\n\u2022 Sur des supports \xE9lectroniques amovibles\nOU\n\u2022 S'il\
            \ est utilis\xE9 sur des supports \xE9lectroniques non amovibles, le PAN\
            \ est \xE9galement rendu illisible via un autre m\xE9canisme qui satisfait\
            \ \xE0 l'exigence 3.5.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.5.4
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.5.1
      ref_id: 3.5.1.3
      description: 'If disk-level or partition-level encryption is used (rather than
        file-, column-, or field--level database encryption) to render PAN unreadable,
        it is managed as follows:

        - Logical access is managed separately and independently of native operating
        system authentication and access control mechanisms.

        - Decryption keys are not associated with user accounts.

        - Authentication factors (passwords, passphrases, or cryptographic keys) that
        allow access to - nencrypted data are stored securely.'
      translations:
        fr:
          description: "Si le chiffrement au niveau du disque ou au niveau de la partition\
            \ est utilis\xE9 (plut\xF4t que le chiffrement au niveau de la base de\
            \ donn\xE9es, des fichiers, des colonnes ou des champs) afin de rendre\
            \ le PAN illisible, il est g\xE9r\xE9 de la mani\xE8re suivante :\n\u2022\
            \ L'acc\xE8s logique est g\xE9r\xE9 s\xE9par\xE9ment et ind\xE9pendamment\
            \ de l'authentification du syst\xE8me d'exploitation natif et des m\xE9\
            canismes de contr\xF4le d'acc\xE8s.\n\u2022 Les cl\xE9s cryptographiques\
            \ ne sont pas associ\xE9es aux comptes utilisateur.\n\u2022 Les facteurs\
            \ d'authentification (mots de passe, phrases secr\xE8tes ou cl\xE9s cryptographiques)\
            \ qui permettent l'acc\xE8s aux donn\xE9es non chiffr\xE9es sont stock\xE9\
            s en toute s\xE9curit\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3
      ref_id: '3.6'
      description: Cryptographic keys used to protect stored account data are secured.
      translations:
        fr:
          description: "Les cl\xE9s cryptographiques utilis\xE9es pour prot\xE9ger\
            \ les donn\xE9es de carte stock\xE9es sont s\xE9curis\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6
      ref_id: 3.6.1
      description: 'Procedures are defined and implemented to protect cryptographic
        keys used to protect stored account data against disclosure and misuse that
        include:

        - Access to keys is restricted to the fewest number of custodians necessary.

        - Key-encrypting keys are at least as strong as the data-encrypting keys they
        protect.

        - Key-encrypting keys are stored separately from data-encrypting keys.

        - Keys are stored securely in the fewest possible locations and forms.'
      translations:
        fr:
          description: "Des proc\xE9dures sont d\xE9finies et mises en oeuvre afin\
            \ de prot\xE9ger les cl\xE9s cryptographiques utilis\xE9es pour prot\xE9\
            ger les donn\xE9es de carte stock\xE9es contre la divulgation et l'utilisation\
            \ abusive, notamment :\n\u2022 L'acc\xE8s aux cl\xE9s est limit\xE9 au\
            \ plus petit nombre d\u2019op\xE9rateurs n\xE9cessaire.\n\u2022 Les cl\xE9\
            s de chiffrement des cl\xE9s sont au moins aussi robustes que les cl\xE9\
            s de chiffrement des donn\xE9es qu'elles prot\xE8gent.\n\u2022 Les cl\xE9\
            s de chiffrement des cl\xE9s sont stock\xE9es s\xE9par\xE9ment des cl\xE9\
            s de chiffrement de donn\xE9es.\n\u2022 Les cl\xE9s sont stock\xE9es en\
            \ toute s\xE9curit\xE9 dans le moins d'emplacements et de formes possibles."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6.1
      ref_id: 3.6.1.1
      description: 'Additional requirement for service providers only: A documented
        description of the cryptographic architecture is maintained that includes:

        - Details of all algorithms, protocols, and keys used for the protection of
        stored account data, including key strength and expiry date.

        - Preventing the use of the same cryptographic keys in production and test
        environments. This bullet is a best practice until its effective date.

        - Description of the key usage for each key.

        - Inventory of any hardware security modules (HSMs), key management systems
        (KMS), and other secure cryptographic devices (SCDs) used for key management,
        including type and location of devices, as outlined in Requirement 12.3.4.'
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Une description document\xE9e de l'architecture cryptographique\
            \ est maintenue, et qui comprend :\n\u2022 Les d\xE9tails de tous les\
            \ algorithmes, protocoles et cl\xE9s utilis\xE9s pour la protection des\
            \ donn\xE9es de carte stock\xE9es, y compris la robustesse de la cl\xE9\
            \ et la date d'expiration.\n\u2022 \xC9viter l'utilisation des m\xEAmes\
            \ cl\xE9s cryptographiques dans les environnements de production et de\
            \ test. Ce point est une Bonne Pratique jusqu'\xE0 sa date d'entr\xE9\
            e en vigueur ; se reporter aux Notes D\u2019applicabilit\xE9 ci-dessous\
            \ pour plus de d\xE9tails.\n\u2022 Une description de l'utilisation des\
            \ cl\xE9s pour chaque cl\xE9.\n\u2022 L'inventaire de tous les modules\
            \ de s\xE9curit\xE9 mat\xE9rielle (HSM), syst\xE8mes de gestion de cl\xE9\
            s (KMS) et autres dispositifs cryptographiques s\xE9curis\xE9s (SCD) utilis\xE9\
            s pour la gestion des cl\xE9s, y compris le type et l'emplacement des\
            \ dispositifs, comme indiqu\xE9 dans l'exigence 12.3.4."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6.1.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6.1
      ref_id: 3.6.1.2
      description: 'Secret and private keys used to encrypt/decrypt stored account
        data are stored in one (or more) of the following forms at all times:

        - Encrypted with a key-encrypting key that is at least as strong as the data-encrypting
        key, and that is stored separately from the data-encrypting key.

        - Within a secure cryptographic device (SCD), such as a hardware security
        module (HSM) or PTS-approved point-of-interaction device.

        - As at least two full-length key components or key shares, in accordance
        with an industry-accepted method'
      translations:
        fr:
          description: "Les cl\xE9s secr\xE8tes et priv\xE9es utilis\xE9es pour chiffrer/d\xE9\
            chiffrer les donn\xE9es de carte stock\xE9es sont conserv\xE9es sous l'une\
            \ (ou plusieurs) des formes suivantes \xE0 tout moment :\n\u2022 Chiffr\xE9\
            es avec une cl\xE9 de chiffrement de cl\xE9 qui est au moins aussi robuste\
            \ que la cl\xE9 de chiffrement des donn\xE9es, et qui est stock\xE9e s\xE9\
            par\xE9ment de la cl\xE9 de chiffrement des donn\xE9es.\n\u2022 Dans un\
            \ dispositif cryptographique s\xE9curis\xE9 (SCD), tel qu'un module de\
            \ s\xE9curit\xE9 mat\xE9rielle (HSM) ou un dispositif de point d'interaction\
            \ approuv\xE9 PTS.\n\u2022 Sous forme d'au moins deux composants de cl\xE9\
            \ ou de partages de cl\xE9 de pleine longueur, conform\xE9ment \xE0 une\
            \ m\xE9thode accept\xE9e par l'industrie."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6.1.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6.1
      ref_id: 3.6.1.3
      description: Access to cleartext cryptographic key components is restricted
        to the fewest number of custodians necessary.
      translations:
        fr:
          description: "L'acc\xE8s aux composants de cl\xE9 cryptographique en texte\
            \ clair est limit\xE9 au plus petit nombre d\u2019op\xE9rateurs n\xE9\
            cessaire."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6.1.4
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.6.1
      ref_id: 3.6.1.4
      description: Cryptographic keys are stored in the fewest possible location.
      translations:
        fr:
          description: "Les cl\xE9s cryptographiques sont stock\xE9es dans le moins\
            \ d'emplacements possibles."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3
      ref_id: '3.7'
      description: Where cryptography is used to protect stored account data, key
        management processes and procedures covering all aspects of the key
      translations:
        fr:
          description: "Lorsque la cryptographie est utilis\xE9e pour prot\xE9ger\
            \ les donn\xE9es de carte stock\xE9es, des processus et proc\xE9dures\
            \ de gestion des cl\xE9s couvrant tous les aspects du cycle de vie des\
            \ cl\xE9s sont d\xE9finis et mis en oeuvre."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7
      ref_id: 3.7.1
      description: Key-management policies and procedures are implemented to include
        generation of strong cryptographic keys used to protect stored account data.
      translations:
        fr:
          description: "Des politiques et proc\xE9dures de gestion des cl\xE9s sont\
            \ mises en oeuvre pour inclure la g\xE9n\xE9ration de cl\xE9s cryptographiques\
            \ robustes utilis\xE9es pour prot\xE9ger les donn\xE9es de carte stock\xE9\
            es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7
      ref_id: 3.7.2
      description: Key-management policies and procedures are implemented to include
        secure distribution of cryptographic keys used to protect stored account data.
      translations:
        fr:
          description: "Des politiques et proc\xE9dures de gestion des cl\xE9s sont\
            \ mises en oeuvre pour inclure la distribution de cl\xE9s cryptographiques\
            \ utilis\xE9es pour prot\xE9ger les donn\xE9es de carte stock\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7
      ref_id: 3.7.3
      description: Key-management policies and procedures are implemented to include
        secure storage of cryptographic keys used to protect stored account data.
      translations:
        fr:
          description: "Des politiques et proc\xE9dures de gestion des cl\xE9s sont\
            \ mises en oeuvre pour inclure le stockage de cl\xE9s cryptographiques\
            \ utilis\xE9es pour prot\xE9ger les donn\xE9es de carte stock\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7
      ref_id: 3.7.4
      description: 'Key management policies and procedures are implemented for cryptographic
        key changes for keys that have reached the end of their cryptoperiod, as defined
        by the associated application vendor or key owner, and based on industry best
        practices and guidelines, including the following:

        - A defined cryptoperiod for each key type in use.

        - A process for key changes at the end of the defined cryptoperiod.'
      translations:
        fr:
          description: "Les politiques et proc\xE9dures de gestion des cl\xE9s sont\
            \ mises en oeuvre pour les changements de cl\xE9s cryptographiques pour\
            \ les cl\xE9s qui ont atteint la fin de leur cryptop\xE9riode, telles\
            \ que d\xE9finies par le fournisseur d'applications associ\xE9 ou le propri\xE9\
            taire de la cl\xE9, et bas\xE9es sur les meilleures pratiques et directives\
            \ de l'industrie, y compris ce qui suit :\n\u2022 Une cryptop\xE9riode\
            \ d\xE9finie pour chaque type de cl\xE9 utilis\xE9.\n\u2022 Un processus\
            \ pour les changements de cl\xE9 \xE0 la fin de la cryptop\xE9riode d\xE9\
            finie."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7
      ref_id: 3.7.5
      description: 'Key management policies procedures are implemented to include
        the retirement, replacement, or destruction of keys used to protect stored
        account data, as deemed necessary when:

        - The key has reached the end of its defined cryptoperiod.

        - The integrity of the key has been weakened, including when personnel with
        knowledge of a cleartext key component leaves the company, or the role for
        which the key component was known.

        - The key is suspected of or known to be compromised.

        - Retired or replaced keys are not used for encryption operations.'
      translations:
        fr:
          description: "Les proc\xE9dures et politiques de gestion des cl\xE9s sont\
            \ mises en oeuvre pour inclure le retrait, le remplacement ou la destruction\
            \ des cl\xE9s utilis\xE9es pour prot\xE9ger les donn\xE9es de carte stock\xE9\
            es, comme jug\xE9 n\xE9cessaire lorsque :\n\u2022 La cl\xE9 a atteint\
            \ la fin de sa cryptop\xE9riode d\xE9finie.\n\u2022 L'int\xE9grit\xE9\
            \ de la cl\xE9 a \xE9t\xE9 affaiblie, notamment lorsque le personnel connaissant\
            \ un composant de cl\xE9 en texte clair quitte l'entreprise ou le r\xF4\
            le pour lequel le composant de cl\xE9 \xE9tait connu.\n\u2022 La cl\xE9\
            \ est suspect\xE9e ou av\xE9r\xE9e \xEAtre compromise.\nLes cl\xE9s retir\xE9\
            es ou remplac\xE9es ne sont pas utilis\xE9es pour les op\xE9rations de\
            \ chiffrement."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7
      ref_id: 3.7.6
      description: Where manual cleartext cryptographic key-management operations
        are performed by personnel, key-management policies and procedures are implemented
        include managing these operations using split knowledge and dual control.
      translations:
        fr:
          description: "Lorsque les op\xE9rations manuelles de gestion des cl\xE9\
            s cryptographiques en texte clair sont effectu\xE9es par le personnel,\
            \ les politiques et proc\xE9dures de gestion des cl\xE9s sont mises en\
            \ oeuvre, notamment la gestion de ces op\xE9rations \xE0 l'aide du fractionnement\
            \ des connaissances et du double contr\xF4le."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7
      ref_id: 3.7.7
      description: Key management policies and procedures are implemented to include
        the prevention of unauthorized substitution of cryptographic keys.
      translations:
        fr:
          description: "Des politiques et proc\xE9dures de gestion des cl\xE9s sont\
            \ mises en oeuvre pour inclure la pr\xE9vention de la substitution non\
            \ autoris\xE9e de cl\xE9s cryptographiques."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7.8
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7
      ref_id: 3.7.8
      description: Key management policies and procedures are implemented to include
        that cryptographic key custodians formally acknowledge (in writing or electronically)
        that they understand and accept their key-custodian responsibilities.
      translations:
        fr:
          description: "Des politiques et proc\xE9dures de gestion des cl\xE9s sont\
            \ mises en oeuvre pour inclure que les op\xE9rateurs de cl\xE9s cryptographiques\
            \ reconnaissent formellement (par \xE9crit ou par voie \xE9lectronique)\
            \ qu'ils comprennent et acceptent leurs responsabilit\xE9s d'op\xE9rateurs\
            \ de cl\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7.9
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:3.7
      ref_id: 3.7.9
      description: "Additional testing procedure for service provider assessments\
        \ only: If the service provider shares cryptographic keys with its customers\
        \ for transmission or storage of account data, examine the documentation that\
        \ the service provider provides to its customers to verify it includes guidance\
        \ on how to securely transmit, store, and update customers\u2019 keys in accordance\
        \ with all elements specified in Requirements 3.7.1 through 3.7.8 above."
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Lorsqu'un prestataire de services partage des cl\xE9s cryptographiques\
            \ avec ses clients pour la transmission ou le stockage de donn\xE9es de\
            \ carte, des conseils sur la transmission, le stockage et la mise \xE0\
            \ jour s\xE9curis\xE9s de ces cl\xE9s sont document\xE9s et distribu\xE9\
            s aux clients des prestataires de services."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:protect-account-data
      ref_id: '4'
      name: Requirement 4
      description: Protect Cardholder Data with Strong Cryptography During Transmission
        Over Open, Public Networks
      translations:
        fr:
          name: Exigence 4
          description: "Prot\xE9ger les Donn\xE9es des Titulaires de Cartes Gr\xE2\
            ce \xE0 une Cryptographie Robuste Lors de la Transmission sur des R\xE9\
            seaux Publics Ouverts"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:4.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:4
      ref_id: '4.1'
      description: Processes and mechanisms for protecting cardholder data with strong
        cryptography during transmission over open, public networks are defined and
        documented.
      translations:
        fr:
          description: "Des processus et des m\xE9canismes de protection des donn\xE9\
            es des titulaires de carte avec une cryptographie robuste lors de la transmission\
            \ sur des r\xE9seaux publics ouverts, sont d\xE9finis et document\xE9\
            s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:4.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:4.1
      ref_id: 4.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 4 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 4 sont :\n\u2022 Document\xE9\
            es.\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:4.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:4.1
      ref_id: 4.1.2
      description: Roles and responsibilities for performing activities in Requirement
        4 are documented, assigned, and understood.
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s li\xE9es aux activit\xE9\
            s de l'exigence 4 sont document\xE9s, attribu\xE9s et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:4.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:4
      ref_id: '4.2'
      description: PAN is protected with strong cryptography during transmission.
      translations:
        fr:
          description: "Le PAN est prot\xE9g\xE9 par une cryptographie robuste pendant\
            \ la transmission."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:4.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:4.2
      ref_id: 4.2.1
      description: 'Strong cryptography and security protocols are implemented as
        follows to safeguard PAN during transmission over open, public networks:

        - Only trusted keys and certificates are accepted.

        - Certificates used to safeguard PAN during transmission over open, public
        networks are confirmed as valid and are not expired or revoked. This bullet
        is a best practice until its effective date; refer to applicability notes
        below for details.

        - The protocol in use supports only secure versions or configurations and
        does not support fallback to, or use of insecure versions, algorithms, key
        sizes, or implementations.

        - The encryption strength is appropriate for the encryption methodology in
        use.'
      translations:
        fr:
          description: "Des protocoles de chiffrement et de s\xE9curit\xE9 robustes\
            \ sont mis en oeuvre comme suit afin de prot\xE9ger le PAN pendant la\
            \ transmission sur des r\xE9seaux publics ouverts :\n\u2022 Seuls les\
            \ cl\xE9s et certificats de confiance sont accept\xE9s.\n\u2022 Les certificats\
            \ utilis\xE9s pour prot\xE9ger le PAN lors de la transmission sur des\
            \ r\xE9seaux publics ouverts sont confirm\xE9s comme valides et ne sont\
            \ ni expir\xE9s ni r\xE9voqu\xE9s. Ce point est une Bonne Pratique jusqu'\xE0\
            \ sa date d'entr\xE9e en vigueur ; se reporter aux Notes D\u2019applicabilit\xE9\
            \ ci-dessous pour plus de d\xE9tails.\n\u2022 Le protocole utilis\xE9\
            \ ne prend en charge que les versions ou configurations s\xE9curis\xE9\
            es et ne prend pas en charge le basculement ou l'utilisation de versions,\
            \ d'algorithmes, de tailles de cl\xE9 ou de mises en oeuvre non s\xE9\
            curis\xE9s.\n\u2022 La robustesse du chiffrement est ad\xE9quate pour\
            \ la m\xE9thodologie de chiffrement utilis\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:4.2.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:4.2.1
      ref_id: 4.2.1.1
      description: "An inventory of the entity\u2019s trusted keys and certificates\
        \ used to protect PAN during transmission is maintained."
      translations:
        fr:
          description: "Un inventaire des cl\xE9s et des certificats approuv\xE9s\
            \ par l'entit\xE9 utilis\xE9s pour prot\xE9ger le PAN pendant la transmission,\
            \ est maintenu."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:4.2.1.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:4.2.1
      ref_id: 4.2.1.2
      description: Wireless networks transmitting PAN or connected to the CDE use
        industry best practices to implement strong cryptography for authentication
        and transmission.
      translations:
        fr:
          description: "Les r\xE9seaux sans fil transmettant le PAN ou connect\xE9\
            s au CDE utilisent les meilleures pratiques de l'industrie pour mettre\
            \ en oeuvre une cryptographie robuste pour l'authentification et la transmission."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:4.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:4.2
      ref_id: 4.2.2
      description: PAN is secured with strong cryptography whenever it is sent via
        end-user messaging technologies.
      translations:
        fr:
          description: "Le PAN est s\xE9curis\xE9 avec une cryptographie robuste chaque\
            \ fois qu'il est envoy\xE9 via les technologies de messagerie des utilisateurs\
            \ finaux."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:maintain-a-vulnerability-management-program
      assessable: false
      depth: 1
      name: Maintain a Vulnerability Management Program
      translations:
        fr:
          name: "Maintenir un programme de gestion des vuln\xE9rabilit\xE9s"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:maintain-a-vulnerability-management-program
      ref_id: '5'
      name: Requirement 5
      description: Protect All Systems and Networks from Malicious Software
      translations:
        fr:
          name: Exigence 5
          description: "Prot\xE9ger Tous les Syst\xE8mes et R\xE9seaux Contre les\
            \ Logiciels Malveillants"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5
      ref_id: '5.1'
      description: Processes and mechanisms for protecting all systems and networks
        from malicious software are defined and understood.
      translations:
        fr:
          description: "Les processus et m\xE9canismes de protection de tous les syst\xE8\
            mes et r\xE9seaux contre les logiciels malveillants sont d\xE9finis et\
            \ compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.1
      ref_id: 5.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 5 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties.'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 5 sont :\n\u2022 Document\xE9\
            es.\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.1
      ref_id: 5.1.2
      description: Roles and responsibilities for performing activities in Requirement
        5 are documented, assigned, and understood.
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s li\xE9es aux activit\xE9\
            s de l'exigence 5 sont document\xE9s, attribu\xE9s et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5
      ref_id: '5.2'
      description: Malicious software (malware) is prevented, or detected and addressed.
      translations:
        fr:
          description: "Les logiciels malveillants (malware) sont emp\xEAch\xE9s ou\
            \ d\xE9tect\xE9s et trait\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.2
      ref_id: 5.2.1
      description: An anti-malware solution(s) is deployed on all system components,
        except for those system components identified in periodic evaluations per
        Requirement 5.2.3 that concludes the system components are not at risk from
        malware.
      translations:
        fr:
          description: "Une ou plusieurs solutions anti-programmes malveillants sont\
            \ d\xE9ploy\xE9es sur tous les composants syst\xE8me, \xE0 l'exception\
            \ des composants syst\xE8mes identifi\xE9s dans les \xE9valuations p\xE9\
            riodiques conform\xE9ment \xE0 l'exigence 5.2.3 qui conclut que les composants\
            \ syst\xE8me ne sont pas \xE0 risque de logiciels malveillants."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.2
      ref_id: 5.2.2
      description: 'The deployed anti-malware solution(s):

        - Detects all known types of malware.

        - Removes, blocks, or contains all known types of malware.'
      translations:
        fr:
          description: "La ou les solutions anti-programmes malveillants d\xE9ploy\xE9\
            es :\n\u2022 D\xE9tecte tous les types connus de logiciels malveillants.\n\
            \u2022 Supprime, bloque ou contient tous les types connus de logiciels\
            \ malveillants."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.2.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.2
      ref_id: 5.2.3
      description: 'Any system components that are not at risk for malware are evaluated
        periodically to include the following:

        - A documented list of all system components not at risk for malware.

        - Identification and evaluation of evolving malware threats for those system
        components.

        - Confirmation whether such system components continue to not require anti-malware
        protection.'
      translations:
        fr:
          description: "Tous les composants syst\xE8me qui ne pr\xE9sentent pas de\
            \ risque de logiciels malveillants sont \xE9valu\xE9s p\xE9riodiquement\
            \ pour inclure les \xE9l\xE9ments suivants :\n\u2022 Une liste document\xE9\
            e de tous les composants syst\xE8me ne pr\xE9sentant pas de risque de\
            \ logiciels malveillants.\n\u2022 Identification et \xE9valuation des\
            \ menaces de logiciels malveillants en \xE9volution pour ces composants\
            \ syst\xE8me.\n\u2022 Confirmation indiquant si ces composants syst\xE8\
            me continuent de ne pas n\xE9cessiter de protection anti-programmes malveillants."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.2.3.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.2.3
      ref_id: 5.2.3.1
      description: "The frequency of periodic evaluations of system components identified\
        \ as not at risk for malware is defined in the entity\u2019s targeted risk\
        \ analysis, which is performed according to all elements specified in Requirement\
        \ 12.3.1."
      translations:
        fr:
          description: "La fr\xE9quence des \xE9valuations p\xE9riodiques des composants\
            \ syst\xE8mes identifi\xE9s comme ne pr\xE9sentant pas de risque de logiciels\
            \ malveillants est d\xE9finie dans l'analyse de risque cibl\xE9e de l'entit\xE9\
            , qui est effectu\xE9e selon tous les \xE9l\xE9ments sp\xE9cifi\xE9s dans\
            \ l'exigence 12.3.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5
      ref_id: '5.3'
      description: Anti-malware mechanisms and processes are active, maintained, and
        monitored.
      translations:
        fr:
          description: "Les m\xE9canismes et processus anti-programmes malveillants\
            \ sont actifs, maintenus et surveill\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3
      ref_id: 5.3.1
      description: The anti-malware solution(s) is kept current via automatic updates.
      translations:
        fr:
          description: "La ou les solutions anti-programmes malveillants sont tenues\
            \ \xE0 jour via des mises \xE0 jour automatiques."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3
      ref_id: 5.3.2
      description: "The anti-malware solution(s):\n- Performs periodic scans and active\
        \ or real-time scans. \nOR\n- Performs continuous behavioral analysis of systems\
        \ or processes."
      translations:
        fr:
          description: "La ou les solutions anti-programmes malveillants :\n\u2022\
            \ Effectue des analyses p\xE9riodiques et des analyses actives ou en temps\
            \ r\xE9el,\nOU\n\u2022 Effectue une analyse comportementale continue des\
            \ syst\xE8mes ou des processus."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3.2.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3.2
      ref_id: 5.3.2.1
      description: "If periodic malware scans are performed to meet Requirement 5.3.2,\
        \ the frequency of scans is defined in the entity\u2019s targeted risk analysis,\
        \ which is performed according to all elements specified in Requirement 12.3.1."
      translations:
        fr:
          description: "Si des analyses p\xE9riodiques de logiciels malveillants sont\
            \ effectu\xE9es pour r\xE9pondre \xE0 l'exigence 5.3.2, la fr\xE9quence\
            \ des analyses est d\xE9finie dans l'analyse de risque cibl\xE9e de l'entit\xE9\
            , qui est effectu\xE9e conform\xE9ment \xE0 tous les \xE9l\xE9ments sp\xE9\
            cifi\xE9s dans l'exigence 12.3.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3
      ref_id: 5.3.3
      description: 'For removable electronic media, the anti-malware solution(s):

        - Performs automatic scans of when the media is inserted, connected, or logically
        mounted,

        OR

        - Performs continuous behavioral analysis of systems or processes when the
        media is inserted, connected, or logically mounted.'
      translations:
        fr:
          description: "Pour les supports \xE9lectroniques amovibles, la solution\
            \ anti-programmes malveillants :\n\u2022 Effectue des analyses automatiques\
            \ lorsque le support est ins\xE9r\xE9, connect\xE9 ou mont\xE9 logiquement,\n\
            OU\n\u2022 Effectue une analyse comportementale continue des syst\xE8\
            mes ou des processus lorsque le support est ins\xE9r\xE9, connect\xE9\
            \ ou mont\xE9 logiquement."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3
      ref_id: 5.3.4
      description: Audit logs for the anti-malware solution(s) are enabled and retained
        in accordance with Requirement 10.5.1.
      translations:
        fr:
          description: "Les journaux d\u2019audit pour la solution anti-programmes\
            \ malveillants sont activ\xE9s et conserv\xE9s conform\xE9ment \xE0 l'exigence\
            \ 10.5.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.3
      ref_id: 5.3.5
      description: Anti-malware mechanisms cannot be disabled or altered by users,
        unless specifically documented, and authorized by management on a case-by-case
        basis for a limited time period.
      translations:
        fr:
          description: "Les m\xE9canismes anti-programmes malveillants ne peuvent\
            \ pas \xEAtre d\xE9sactiv\xE9s ou modifi\xE9s par les utilisateurs, \xE0\
            \ moins qu'ils ne soient sp\xE9cifiquement document\xE9s et autoris\xE9\
            s par la direction au cas par cas pour une dur\xE9e limit\xE9e dans le\
            \ temps."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5
      ref_id: '5.4'
      description: Anti-phishing mechanisms protect users against phishing attacks.
      translations:
        fr:
          description: "Les m\xE9canismes anti-hame\xE7onnage prot\xE8gent les utilisateurs\
            \ contre les attaques par hame\xE7onnage."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:5.4.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:5.4
      ref_id: 5.4.1
      description: Processes and automated mechanisms are in place to detect and protect
        personnel against phishing attacks.
      translations:
        fr:
          description: "Des processus et des m\xE9canismes automatis\xE9s sont en\
            \ place pour d\xE9tecter et prot\xE9ger le personnel contre les attaques\
            \ d'hame\xE7onnage."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:maintain-a-vulnerability-management-program
      ref_id: '6'
      name: Requirement 6
      description: Develop and Maintain Secure Systems and Software
      translations:
        fr:
          name: Exigence 6
          description: "D\xE9velopper et Maintenir des Syst\xE8mes et des Logiciels\
            \ S\xE9curis\xE9s"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6
      ref_id: '6.1'
      description: Processes and mechanisms for developing and maintaining secure
        systems and software are defined and understood.
      translations:
        fr:
          description: "Les processus et m\xE9canismes de d\xE9veloppement et de maintenance\
            \ de syst\xE8mes et de logiciels s\xE9curis\xE9s sont d\xE9finis et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.1
      ref_id: 6.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 6 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties.'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 6 sont :\n\u2022 Document\xE9\
            es.\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.1
      ref_id: 6.1.2
      description: Roles and responsibilities for performing activities in Requirement
        6 are documented, assigned, and understood.
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s li\xE9es aux activit\xE9\
            s de l'exigence 6 sont document\xE9s, attribu\xE9s et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6
      ref_id: '6.2'
      description: Bespoke and custom software are developed securely.
      translations:
        fr:
          description: "Les logiciels sur mesure et personnalis\xE9s sont d\xE9velopp\xE9\
            s de mani\xE8re s\xE9curis\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2
      ref_id: 6.2.1
      description: 'Bespoke and custom software are developed

        securely, as follows:

        - Based on industry standards and/or best practices for secure development.

        - In accordance with PCI DSS (for example, secure authentication and logging).

        - Incorporating consideration of information security issues during each stage
        of the software development lifecycle.'
      translations:
        fr:
          description: "Les logiciels sur mesure et personnalis\xE9s sont d\xE9velopp\xE9\
            s de mani\xE8re s\xE9curis\xE9e comme suit :\n\u2022 Sur la base des normes\
            \ et standards de l'industrie et/ou des meilleures pratiques pour un d\xE9\
            veloppement s\xE9curis\xE9.\n\u2022 Conform\xE9ment au standard PCI DSS\
            \ (par exemple, authentification et journalisation s\xE9curis\xE9es).\n\
            \u2022 Int\xE9gration de la prise en compte des probl\xE8mes de s\xE9\
            curit\xE9 de l'information \xE0 chaque \xE9tape du cycle de vie du d\xE9\
            veloppement logiciel."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2
      ref_id: 6.2.2
      description: 'Software development personnel working on bespoke and custom software
        are trained at least once every 12 months as follows:

        - On software security relevant to their job function and development languages.

        - Including secure software design and secure coding techniques.

        - Including, if security testing tools are used, how to use the tools for
        detecting vulnerabilities in software.'
      translations:
        fr:
          description: "Le personnel d\xE9veloppeur de logiciels travaillant sur des\
            \ logiciels sur mesure et personnalis\xE9s est form\xE9 au moins une fois\
            \ tous les 12 mois comme suit :\n\u2022 Sur la s\xE9curit\xE9 des logiciels\
            \ en rapport avec leur fonction et leurs langages de d\xE9veloppement.\n\
            \u2022 Inclure la conception de logiciels s\xE9curis\xE9s et les techniques\
            \ de codage s\xE9curis\xE9.\n\u2022 Inclure, si des outils de test de\
            \ s\xE9curit\xE9 sont utilis\xE9s, la mani\xE8re d'utiliser les outils\
            \ pour d\xE9tecter les vuln\xE9rabilit\xE9s dans les logiciels."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2
      ref_id: 6.2.3
      description: 'Bespoke and custom software is reviewed prior to being released
        into production or to customers, to identify and correct potential coding
        vulnerabilities, as follows:

        - Code reviews ensure code is developed according to secure coding guidelines.

        - Code reviews look for both existing and emerging software vulnerabilities.

        - Appropriate corrections are implemented prior to release.'
      translations:
        fr:
          description: "Les logiciels sur mesure et personnalis\xE9s sont examin\xE9\
            s avant d'\xEAtre mis en production ou envoy\xE9s aux clients, afin d'identifier\
            \ et de corriger les vuln\xE9rabilit\xE9s de codage potentielles, comme\
            \ suit :\n\u2022 Les examens de code garantissent que le code est d\xE9\
            velopp\xE9 conform\xE9ment aux directives de codage s\xE9curis\xE9.\n\u2022\
            \ Les examens de code recherchent les vuln\xE9rabilit\xE9s logicielles\
            \ existantes et \xE9mergentes.\n\u2022 Des corrections appropri\xE9es\
            \ sont mises en oeuvre avant la publication."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2.3.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2.3
      ref_id: 6.2.3.1
      description: 'If manual code reviews are performed for bespoke and custom software
        prior to release to production, code changes are:

        - Reviewed by individuals other than the originating code author, and who
        are knowledgeable about code-review techniques

        and secure coding practices.

        - Reviewed and approved by management prior to release.'
      translations:
        fr:
          description: "Si des examens manuels du code sont effectu\xE9s sur des logiciels\
            \ sur mesure et personnalis\xE9s avant la mise en production, les modifications\
            \ de code sont :\n\u2022 Examin\xE9es par des personnes autres que l'auteur\
            \ du code d'origine, et qui connaissent les techniques d'examen du code\
            \ et les pratiques de codage s\xE9curis\xE9.\n\u2022 Examin\xE9es et approuv\xE9\
            es par la direction avant la publication."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.2
      ref_id: 6.2.4
      description: "Software engineering techniques or other methods are defined and\
        \ in use by software development personnel to prevent or mitigate common software\
        \ attacks and related vulnerabilities in bespoke and custom software, including\
        \ but not limited to the following:\n- Injection attacks, including SQL, LDAP,\
        \ XPath, or other command, parameter, object, fault, or injection-type flaws.\n\
        - Attacks on data and data structures, including attempts to manipulate buffers,\
        \ pointers, input data, or shared data.\n- Attacks on cryptography usage,\
        \ including attempts to exploit weak, insecure, or inappropriate cryptographic\
        \ implementations, algorithms, cipher suites, or modes of operation.\n- Attacks\
        \ on business logic, including attempts to abuse or bypass application features\
        \ and functionalities through the manipulation of APIs, communication protocols\
        \ and channels, client-side functionality, or other system/application functions\
        \ and resources. This includes cross-site scripting (XSS) and cross-site request\
        \ forgery (CSRF).\n-  Attacks on access control mechanisms, including attempts\
        \ to bypass or abuse identification, authentication, or authorization mechanisms,\
        \ or attempts to exploit weaknesses in the implementation of such mechanisms.\n\
        - Attacks via any \u201Chigh-risk\u201D vulnerabilities identified in the\
        \ vulnerability identification process, as defined in Requirement 6.3.1."
      translations:
        fr:
          description: "Des techniques d'ing\xE9nierie logicielle ou d'autres m\xE9\
            thodes sont d\xE9finies et utilis\xE9es par le personnel de d\xE9veloppement\
            \ de logiciels afin de pr\xE9venir ou d'att\xE9nuer les attaques logicielles\
            \ courantes et les vuln\xE9rabilit\xE9s associ\xE9es, y compris, sans\
            \ toutefois s'y limiter :\n\u2022 Attaques par injection, y compris SQL,\
            \ LDAP, XPath ou d'autres failles de type commande, param\xE8tre, objet,\
            \ erreur ou injection.\n\u2022 Attaques ciblant les donn\xE9es et les\
            \ structures de donn\xE9es, y compris les tentatives de manipulation de\
            \ tampons, de pointeurs, de donn\xE9es d'entr\xE9e ou de donn\xE9es partag\xE9\
            es.\n\u2022 Attaques ciblant l'utilisation de la cryptographie, y compris\
            \ les tentatives d'exploitation d'impl\xE9mentations cryptographiques,\
            \ d'algorithmes, de suites de chiffrement ou de modes de fonctionnement\
            \ faibles, non s\xE9curis\xE9s ou inad\xE9quats.\n\u2022 Attaques contre\
            \ la logique m\xE9tier, y compris les tentatives d'abus ou de contournement\
            \ des caract\xE9ristiques et fonctionnalit\xE9s des applications via la\
            \ manipulation d'API, de protocoles et de canaux de communication, de\
            \ fonctionnalit\xE9s c\xF4t\xE9 consommateur ou d'autres fonctions et\
            \ ressources du syst\xE8me ou de l'application. Cela comprend les scripts\
            \ de site \xE0 site (XSS) et les alt\xE9rations de requ\xEAtes de site\
            \ \xE0 site (CSRF).\n\u2022 Attaques contre les m\xE9canismes de contr\xF4\
            le d'acc\xE8s, y compris les tentatives pour contourner ou d'abuser des\
            \ \xAB credentials \xBB, de l'authentification ou des m\xE9canismes d'autorisation,\
            \ ou des tentatives d'exploiter les faiblesses de la mise en oeuvre de\
            \ ces m\xE9canismes.\n\u2022 Attaques via toutes les vuln\xE9rabilit\xE9\
            s \xAB \xE0 haut risque \xBB identifi\xE9es dans le processus d'identification\
            \ des vuln\xE9rabilit\xE9s, telles qu'elles sont d\xE9finies dans l'exigence\
            \ 6.3.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6
      ref_id: '6.3'
      description: Security vulnerabilities are identified and addressed.
      translations:
        fr:
          description: "Les vuln\xE9rabilit\xE9s de s\xE9curit\xE9 sont identifi\xE9\
            es et corrig\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.3
      ref_id: 6.3.1
      description: 'Security vulnerabilities are identified and managed as follows:

        - New security vulnerabilities are identified using industry-recognized sources
        for security vulnerability information, including alerts from international
        and national computer emergency response teams (CERTs).

        - Vulnerabilities are assigned a risk ranking based on industry best practices
        and consideration of potential impact.

        - Risk rankings identify, at a minimum, all vulnerabilities considered to
        be a high-risk or critical to the environment.

        - Vulnerabilities for bespoke and custom, and third-party software (for example
        operating systems and databases) are covered.'
      translations:
        fr:
          description: "Les vuln\xE9rabilit\xE9s de s\xE9curit\xE9 sont identifi\xE9\
            es et g\xE9r\xE9es de la mani\xE8re suivante :\n\u2022 Les nouvelles vuln\xE9\
            rabilit\xE9s de s\xE9curit\xE9 sont identifi\xE9es \xE0 l'aide de sources\
            \ reconnues par l'industrie pour les informations sur les vuln\xE9rabilit\xE9\
            s de s\xE9curit\xE9, y compris les alertes des \xE9quipes internationales\
            \ et nationales d'intervention en cas d'urgence informatique (CERT).\n\
            \u2022 Les vuln\xE9rabilit\xE9s se voient attribuer un classement de risques\
            \ bas\xE9 sur les meilleures pratiques de l'industrie et la prise en compte\
            \ de l'incidence potentielle.\n\u2022 Les classements des risques identifient,\
            \ au minimum, toutes les vuln\xE9rabilit\xE9s consid\xE9r\xE9es comme\
            \ \xE0 haut risque ou critiques pour l'environnement.\n\u2022 Les vuln\xE9\
            rabilit\xE9s des logiciels sur mesure et personnalis\xE9s et des logiciels\
            \ de tiers (par exemple les syst\xE8mes d'exploitation et les bases de\
            \ donn\xE9es) sont couvertes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.3
      ref_id: 6.3.2
      description: An inventory of bespoke and custom software, and third-party software
        components incorporated into bespoke and custom software is maintained to
        facilitate vulnerability and patch management.
      translations:
        fr:
          description: "Un inventaire des logiciels sur mesure et personnalis\xE9\
            s ainsi que des composants logiciels tiers int\xE9gr\xE9s dans des logiciels\
            \ sur mesure et personnalis\xE9s est conserv\xE9 afin de faciliter la\
            \ gestion des vuln\xE9rabilit\xE9s et des correctifs."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.3.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.3
      ref_id: 6.3.3
      description: 'All system components are protected from known vulnerabilities
        by installing applicable security patches/updates as follows:

        - Critical or high-security patches/updates (identified according to the risk
        ranking process at Requirement 6.3.1) are installed within one month of release.

        - All other applicable security patches/updates are installed within an appropriate
        time frame as determined by the entity (for example, within three months of
        release).'
      translations:
        fr:
          description: "Tous les composants syst\xE8me sont prot\xE9g\xE9s contre\
            \ les vuln\xE9rabilit\xE9s connues en installant les correctifs/mises\
            \ \xE0 jour de s\xE9curit\xE9 applicables comme suit :\n\u2022 Les correctifs/mises\
            \ \xE0 jour critiques ou de haute s\xE9curit\xE9 (identifi\xE9s selon\
            \ le processus de classement des risques \xE9nonc\xE9 \xE0 l'exigence\
            \ 6.3.1) sont install\xE9s dans le mois suivant leur publication.\n\u2022\
            \ Tous les autres correctifs/mises \xE0 jour de s\xE9curit\xE9 applicables\
            \ sont install\xE9s dans un d\xE9lai appropri\xE9 d\xE9termin\xE9 par\
            \ l'entit\xE9 (par exemple, dans les trois mois suivant leur publication)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6
      ref_id: '6.4'
      description: Public-facing web applications are protected against attacks.
      translations:
        fr:
          description: "Les applications Web destin\xE9es au public sont prot\xE9\
            g\xE9es contre les attaques."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.4.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.4
      ref_id: 6.4.1
      description: "For public-facing web applications, new threats and vulnerabilities\
        \ are addressed on an ongoing basis and these applications are protected against\
        \ known attacks as follows:\n-  Reviewing public-facing web applications via\
        \ manual or automated application vulnerability security assessment tools\
        \ or methods as follows:\n    \u2013 At least once every 12 months and after\
        \ significant changes.\n    \u2013 By an entity that specializes in application\
        \ security.\n    \u2013 Including, at a minimum, all common software attacks\
        \ in Requirement 6.2.4.\n    \u2013 All vulnerabilities are ranked in accordance\
        \ with requirement 6.3.1.\n    \u2013 All vulnerabilities are corrected.\n\
        \    \u2013 The application is re-evaluated after the corrections\nOR\n- Installing\
        \ an automated technical solution(s) that continually detects and prevents\
        \ web-based attacks as follows:\n    \u2013 Installed in front of public-facing\
        \ web applications to detect and prevent web-based attacks.\n    \u2013 Actively\
        \ running and up to date as applicable.\n    \u2013 Generating audit logs.\n\
        \    \u2013 Configured to either block web-based attacks or generate an alert\
        \ that is immediately investigated."
      translations:
        fr:
          description: "Pour les applications Web destin\xE9es au public, les nouvelles\
            \ menaces et vuln\xE9rabilit\xE9s sont trait\xE9es en permanence, et ces\
            \ applications sont prot\xE9g\xE9es contre les attaques connues comme\
            \ suit :\n\u2022 Examiner les applications Web accessibles au public gr\xE2\
            ce \xE0 des outils ou des m\xE9thodes manuels ou automatis\xE9s d'\xE9\
            valuation de la s\xE9curit\xE9 des vuln\xE9rabilit\xE9s des applications,\
            \ comme suit :\n\u2013 Au moins une fois tous les 12 mois et apr\xE8s\
            \ des modifications importantes.\n\u2013 Par une entit\xE9 sp\xE9cialis\xE9\
            e dans la s\xE9curit\xE9 des applications.\n\u2013 Y compris, au minimum,\
            \ toutes les attaques logicielles courantes \xE9nonc\xE9es dans l'exigence\
            \ 6.2.4.\n\u2013 Toutes les vuln\xE9rabilit\xE9s sont class\xE9es conform\xE9\
            ment \xE0 l'exigence 6..3.1.\n\u2013 Toutes les vuln\xE9rabilit\xE9s sont\
            \ corrig\xE9es.\n\u2013 L'application est r\xE9\xE9valu\xE9e apr\xE8s\
            \ les corrections\nOU\n\u2022 L'installation d'une ou plusieurs solutions\
            \ techniques automatis\xE9es qui d\xE9tectent et emp\xEAchent en permanence\
            \ les attaques bas\xE9es sur le Web, comme suit :\n\u2013 Install\xE9\
            \ devant les applications Web destin\xE9es au public afin de d\xE9tecter\
            \ et emp\xEAcher les attaques Web.\n\u2013 En ex\xE9cution active et \xE0\
            \ jour, le cas \xE9ch\xE9ant.\n\u2013 G\xE9n\xE9ration de journaux d'audit.\n\
            \u2013 Configur\xE9 pour bloquer les attaques Web ou g\xE9n\xE9rer une\
            \ alerte qui est imm\xE9diatement examin\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.4.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.4
      ref_id: 6.4.2
      description: 'For public-facing web applications, an automated technical solution
        is deployed that continually detects and prevents web-based attacks, with
        at least the following:

        - Is installed in front of public-facing web applications and is configured
        to detect and prevent web-based attacks.

        - Actively running and up to date as applicable.

        - Generating audit logs.

        - Configured to either block web-based attacks or generate an alert that is
        immediately investigated.'
      translations:
        fr:
          description: "Pour les applications Web destin\xE9es au public, une solution\
            \ technique automatis\xE9e est d\xE9ploy\xE9e qui d\xE9tecte et emp\xEA\
            che en permanence les attaques Web, avec au moins les \xE9l\xE9ments suivants\
            \ :\n\u2022 Est install\xE9e devant les applications Web destin\xE9es\
            \ au public et configur\xE9e afin de d\xE9tecter et emp\xEAcher les attaques\
            \ Web.\n\u2022 En ex\xE9cution active et \xE0 jour, le cas \xE9ch\xE9\
            ant.\n\u2022 G\xE9n\xE9ration de journaux d'audit.\n\u2022 Configur\xE9\
            e pour bloquer les attaques Web ou g\xE9n\xE9rer une alerte qui est imm\xE9\
            diatement examin\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.4.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.4
      ref_id: 6.4.3
      description: "All payment page scripts that are loaded and executed in the consumer\u2019\
        s browser are managed as follows:\n\u2022 A method is implemented to confirm\
        \ that each script is authorized.\n\u2022 A method is implemented to assure\
        \ the integrity of each script.\n\u2022 An inventory of all scripts is maintained\
        \ with written justification as to why each is necessary."
      translations:
        fr:
          description: "Tous les scripts de la page de paiement qui sont charg\xE9\
            s et ex\xE9cut\xE9s dans le navigateur du consommateur sont g\xE9r\xE9\
            s comme suit :\n\u2022 Une m\xE9thode est mise en oeuvre pour confirmer\
            \ que chaque script est autoris\xE9.\n\u2022 Une m\xE9thode est mise en\
            \ oeuvre pour assurer l'int\xE9grit\xE9 de chaque script.\n\u2022 Un inventaire\
            \ de tous les scripts est maintenu avec une justification \xE9crite expliquant\
            \ pourquoi chacun est n\xE9cessaire."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6
      ref_id: '6.5'
      description: Changes to all system components are managed securely.
      translations:
        fr:
          description: "Les modifications apport\xE9es \xE0 tous les composants syst\xE8\
            me sont g\xE9r\xE9es de mani\xE8re s\xE9curis\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5
      ref_id: 6.5.1
      description: 'Changes to all system components in the production environment
        are made according to established procedures that include:

        - Reason for, and description of, the change.

        - Documentation of security impact.

        - Documented change approval by authorized parties.

        - Testing to verify that the change does not adversely impact system security.

        - For bespoke and custom software changes, all updates are tested for compliance
        with Requirement 6.2.4 before being deployed into production.

        - Procedures to address failures and return to a secure state.'
      translations:
        fr:
          description: "Les modifications apport\xE9es \xE0 tous les composants syst\xE8\
            me dans l'environnement de production sont effectu\xE9es conform\xE9ment\
            \ aux proc\xE9dures \xE9tablies qui comportent :\n\u2022 Raison et description\
            \ du changement.\n\u2022 Documentation de l'impact sur la s\xE9curit\xE9\
            .\n\u2022 Approbation des changements document\xE9e par les parties autoris\xE9\
            es.\n\u2022 Tests pour v\xE9rifier que le changement n'a pas d'incidence\
            \ n\xE9gative sur la s\xE9curit\xE9 du syst\xE8me.\n\u2022 Pour les changements\
            \ apport\xE9s aux logiciels sur mesure et personnalis\xE9s, toutes les\
            \ mises \xE0 jour sont test\xE9es afin de v\xE9rifier leur conformit\xE9\
            \ \xE0 l'exigence 6.2.4 avant d'\xEAtre d\xE9ploy\xE9es en production.\n\
            \u2022 Proc\xE9dures pour la r\xE9solution des \xE9checs et le retour\
            \ \xE0 un \xE9tat s\xE9curis\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5
      ref_id: 6.5.2
      description: Upon completion of a significant change, all applicable PCI DSS
        requirements are confirmed to be in place on all new or changed systems and
        networks, and documentation is updated as applicable.
      translations:
        fr:
          description: "Suite \xE0 modifications importantes, toutes les exigences\
            \ applicables du standard PCI DSS sont confirm\xE9es \xEAtre en place\
            \ sur tous les syst\xE8mes et r\xE9seaux nouveaux ou modifi\xE9s, et la\
            \ documentation est mise \xE0 jour, le cas \xE9ch\xE9ant."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5
      ref_id: 6.5.3
      description: Pre-production environments are separated from production environments
        and the separation is enforced with access controls.
      translations:
        fr:
          description: "Les environnements de pr\xE9-production sont s\xE9par\xE9\
            s des environnements de production et la s\xE9paration est appliqu\xE9\
            e avec des mesures de s\xE9curit\xE9 d'acc\xE8s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5
      ref_id: 6.5.4
      description: Roles and functions are separated between production and pre-production
        environments to provide accountability such that only reviewed and approved
        changes are deployed.
      translations:
        fr:
          description: "Les r\xF4les et les fonctions sont s\xE9par\xE9s entre les\
            \ environnements de production et de pr\xE9-production afin d'assurer\
            \ la responsabilit\xE9 de sorte que seules les modifications examin\xE9\
            es et approuv\xE9es soient d\xE9ploy\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5
      ref_id: 6.5.5
      description: Live PANs are not used in pre-production environments, except where
        those environments are included in the CDE and protected in accordance with
        all applicable PCI DSS requirements.
      translations:
        fr:
          description: "Les PAN actifs ne sont pas utilis\xE9s dans les environnements\
            \ de pr\xE9-production, sauf lorsque ces environnements sont inclus dans\
            \ le CDE et prot\xE9g\xE9s conform\xE9ment \xE0 toutes les exigences applicables\
            \ du standard PCI DSS."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:6.5
      ref_id: 6.5.6
      description: Test data and test accounts are removed from system components
        before the system goes into production.
      translations:
        fr:
          description: "Les donn\xE9es de test et les comptes de test sont supprim\xE9\
            s des composants syst\xE8me avant que le syst\xE8me ne passe en production."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:implement-strong-access-control-measures
      assessable: false
      depth: 1
      name: Implement Strong Access Control Measures
      translations:
        fr:
          name: "Mettre en \u0153uvre des mesures strictes de contr\xF4le d\u2019\
            acc\xE8s"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:implement-strong-access-control-measures
      ref_id: '7'
      name: Requirement 7
      description: Restrict Access to System Components and Cardholder Data by Business
        Need to Know
      translations:
        fr:
          name: Exigence 7
          description: "Limiter L'acc\xE8s aux Composants Syst\xE8me et aux Donn\xE9\
            es des Titulaires de Cartes en Fonction des Besoins de L'entreprise"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7
      ref_id: '7.1'
      description: Processes and mechanisms for restricting access to system components
        and cardholder data by business need to know are defined and understood.
      translations:
        fr:
          description: "Les processus et les m\xE9canismes de restriction de l'acc\xE8\
            s aux composants syst\xE8me et aux donn\xE9es des titulaires de cartes\
            \ par l'entreprise doivent \xEAtre d\xE9finis et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.1
      ref_id: 7.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 7 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties.'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 7 sont :\n\u2022 Document\xE9\
            es.\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.1
      ref_id: 7.1.2
      description: Roles and responsibilities for performing activities in Requirement
        7 are documented, assigned, and understood.
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s li\xE9es aux activit\xE9\
            s de l'exigence 7 sont document\xE9s, attribu\xE9s et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7
      ref_id: '7.2'
      description: Access to system components and data is appropriately defined and
        assigned.
      translations:
        fr:
          description: "L'acc\xE8s aux composants syst\xE8me et aux donn\xE9es du\
            \ syst\xE8me est d\xE9fini et attribu\xE9 de mani\xE8re ad\xE9quate."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2
      ref_id: 7.2.1
      description: "An access control model is defined and includes granting access\
        \ as follows:\n- Appropriate access depending on the entity\u2019s business\
        \ and access needs.\n- Access to system components and data resources that\
        \ is based on users\u2019 job classification and functions.\n- The least privileges\
        \ required (for example, user, administrator) to perform a job function."
      translations:
        fr:
          description: "Un mod\xE8le de contr\xF4le d'acc\xE8s est d\xE9fini et inclut\
            \ l'octroi d'acc\xE8s comme suit :\n\u2022 Acc\xE8s appropri\xE9 en fonction\
            \ de l'activit\xE9 de l'entit\xE9 et des besoins d'acc\xE8s.\n\u2022 Acc\xE8\
            s aux composants syst\xE8me et aux ressources de donn\xE9es en fonction\
            \ de la classification et des fonctions des utilisateurs.\n\u2022 Les\
            \ moindres privil\xE8ges requis (par exemple, utilisateur, administrateur)\
            \ pour ex\xE9cuter une fonction."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2
      ref_id: 7.2.2
      description: 'Access is assigned to users, including privileged users, based
        on:

        - Job classification and function.

        - Least privileges necessary to perform job responsibilities.'
      translations:
        fr:
          description: "L'acc\xE8s est attribu\xE9 aux utilisateurs, y compris les\
            \ utilisateurs privil\xE9gi\xE9s, selon :\n\u2022 La classification du\
            \ poste et de la fonction.\n\u2022 Les moindres privil\xE8ges n\xE9cessaires\
            \ pour exercer les responsabilit\xE9s de la t\xE2che."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2
      ref_id: 7.2.3
      description: Required privileges are approved by authorized personnel.
      translations:
        fr:
          description: "Les privil\xE8ges requis sont approuv\xE9s par un personnel\
            \ autoris\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2
      ref_id: 7.2.4
      description: 'All user accounts and related access privileges, including third-party/vendor
        accounts, are reviewed as follows:

        - At least once every six months.

        - To ensure user accounts and access remain appropriate based on job function.

        - Any inappropriate access is addressed.

        - Management acknowledges that access remains appropriate.'
      translations:
        fr:
          description: "Tous les comptes et les privil\xE8ges d'acc\xE8s associ\xE9\
            s, y compris les comptes tiers/fournisseurs, sont examin\xE9s comme suit\
            \ :\n\u2022 Au moins une fois tous les six mois.\n\u2022 Pour garantir\
            \ que les comptes d'utilisateurs et l'acc\xE8s restent appropri\xE9s selon\
            \ la fonction du poste.\n\u2022 Tout acc\xE8s inappropri\xE9 est trait\xE9\
            .\n\u2022 La direction reconna\xEEt que l'acc\xE8s demeure appropri\xE9\
            ."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2
      ref_id: 7.2.5
      description: 'All application and system accounts and related access privileges
        are assigned and managed as follows:

        - Based on the least privileges necessary for the operability of the system
        or application.

        - Access is limited to the systems, applications, or processes that specifically
        require their use.'
      translations:
        fr:
          description: "Tous les comptes d'applications et syst\xE8me et les privil\xE8\
            ges d'acc\xE8s associ\xE9s sont attribu\xE9s et g\xE9r\xE9s comme suit\
            \ :\n\u2022 Bas\xE9 sur les moindres privil\xE8ges n\xE9cessaires \xE0\
            \ l'op\xE9rabilit\xE9 du syst\xE8me ou de l'application.\n\u2022 L'acc\xE8\
            s est limit\xE9 aux syst\xE8mes, applications ou processus qui n\xE9cessitent\
            \ sp\xE9cifiquement leur utilisation."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2.5.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2.5
      ref_id: 7.2.5.1
      description: "All access by application and system accounts and related access\
        \ privileges are reviewed as follows:\n- Periodically (at the frequency defined\
        \ in the entity\u2019s targeted risk analysis, which is performed according\
        \ to all elements specified in Requirement 12.3.1).\n- The application/system\
        \ access remains appropriate for the function being performed.\n- Any inappropriate\
        \ access is addressed.\n- Management acknowledges that access remains appropriate."
      translations:
        fr:
          description: "Tous les acc\xE8s par comptes d'applications et syst\xE8me\
            \ et les privil\xE8ges d'acc\xE8s associ\xE9s sont examin\xE9s comme suit\
            \ :\n\u2022 P\xE9riodiquement, (\xE0 la fr\xE9quence d\xE9finie dans l'analyse\
            \ de risques cibl\xE9e de l'entit\xE9, qui est r\xE9alis\xE9e selon tous\
            \ les \xE9l\xE9ments sp\xE9cifi\xE9s dans l'exigence 12.3.1).\n\u2022\
            \ L'acc\xE8s \xE0 l'application ou au syst\xE8me reste appropri\xE9 pour\
            \ la fonction ex\xE9cut\xE9e.\n\u2022 Tout acc\xE8s inappropri\xE9 est\
            \ trait\xE9.\n\u2022 La direction reconna\xEEt que l'acc\xE8s demeure\
            \ appropri\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.2
      ref_id: 7.2.6
      description: 'All user access to query repositories of stored cardholder data
        is restricted as follows:

        - Via applications or other programmatic methods, with access and allowed
        actions based on user roles and least privileges.

        - Only the responsible administrator(s) can directly access or query repositories
        of stored CHD.'
      translations:
        fr:
          description: "Tout acc\xE8s utilisateur pour envoyer aux r\xE9f\xE9rentiels\
            \ des requ\xEAtes de donn\xE9es de titulaires de cartes stock\xE9es est\
            \ limit\xE9 comme suit :\n\u2022 Via des applications ou d'autres m\xE9\
            thodes programmatiques, avec acc\xE8s et actions autoris\xE9es en fonction\
            \ des r\xF4les d'utilisateur et des moindres privil\xE8ges.\n\u2022 Seuls\
            \ les administrateurs responsables peuvent acc\xE9der directement ou envoyer\
            \ des requ\xEAtes aux r\xE9f\xE9rentiels de CHD stock\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7
      ref_id: '7.3'
      description: Access to system components and data is managed via an access control
        system(s).
      translations:
        fr:
          description: "L'acc\xE8s aux composants et aux donn\xE9es syst\xE8me est\
            \ g\xE9r\xE9 via un ou plusieurs syst\xE8mes de contr\xF4le d'acc\xE8\
            s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.3
      ref_id: 7.3.1
      description: "An access control system(s) is in place that restricts access\
        \ based on a user\u2019s need to know and covers all system components."
      translations:
        fr:
          description: "Un ou plusieurs syst\xE8mes de contr\xF4le d'acc\xE8s sont\
            \ en place qui limitent l'acc\xE8s en fonction du besoin d\u2019en conna\xEE\
            tre de l'utilisateur et couvrent tous les composants syst\xE8me."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.3
      ref_id: 7.3.2
      description: The access control system(s) is configured to enforce permissions
        assigned to individuals, applications, and systems based on job classification
        and function.
      translations:
        fr:
          description: "Le ou les syst\xE8mes de contr\xF4le d'acc\xE8s sont configur\xE9\
            s pour appliquer les autorisations attribu\xE9es aux personnes, aux applications\
            \ et aux syst\xE8mes sur la base de la classification et la fonction des\
            \ t\xE2ches."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:7.3.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:7.3
      ref_id: 7.3.3
      description: "The access control system(s) is set to \u201Cdeny all\u201D by\
        \ default."
      translations:
        fr:
          description: "Le ou les syst\xE8mes de contr\xF4le d'acc\xE8s sont d\xE9\
            finis par d\xE9faut pour \xAB refuser tout le monde \xBB."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:implement-strong-access-control-measures
      ref_id: '8'
      name: Requirement 8
      description: Identify Users and Authenticate Access to System Components
      translations:
        fr:
          name: Exigence 8
          description: "Identifier les Utilisateurs et Authentifier L'acc\xE8s aux\
            \ Composants Syst\xE8me"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8
      ref_id: '8.1'
      description: Processes and mechanisms for identifying users and authenticating
        access to system components are defined and understood.
      translations:
        fr:
          description: "Les processus et m\xE9canismes d'identification des utilisateurs\
            \ et d'authentification des acc\xE8s aux composants syst\xE8me sont d\xE9\
            finis et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.1
      ref_id: 8.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 8 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties.'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 8 sont :\n\u2022 Document\xE9\
            es\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.1
      ref_id: 8.1.2
      description: Roles and responsibilities for performing activities in Requirement
        8 are documented, assigned, and understood.
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s li\xE9es aux activit\xE9\
            s de l'exigence 8 sont document\xE9s, attribu\xE9s et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8
      ref_id: '8.2'
      description: "User identification and related accounts for users and administrators\
        \ are strictly managed throughout an account\u2019s lifecycle."
      translations:
        fr:
          description: "L'identification des utilisateurs et les comptes associ\xE9\
            s pour les utilisateurs et les administrateurs sont strictement g\xE9\
            r\xE9s tout au long du cycle de vie d'un compte."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2
      ref_id: 8.2.1
      description: All users are assigned a unique ID before access to system components
        or cardholder data is allowed.
      translations:
        fr:
          description: "Tous les utilisateurs re\xE7oivent un identifiant unique avant\
            \ d\u2019\xEAtre autoris\xE9 \xE0 acc\xE9der aux composants syst\xE8me\
            \ ou aux donn\xE9es des titulaires de cartes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2
      ref_id: 8.2.2
      description: 'Group, shared, or generic accounts, or other shared authentication
        credentials are only used when necessary on an exception basis, and are managed
        as follows:

        -  Account use is prevented unless needed for an exceptional circumstance.

        - Use is limited to the time needed for the exceptional circumstance.

        - Business justification for use is documented.

        - Use is explicitly approved by management.

        - Individual user identity is confirmed before access to an account is granted.

        - Every action taken is attributable to an individual user.'
      translations:
        fr:
          description: "Les comptes de groupe, partag\xE9s ou g\xE9n\xE9riques, ou\
            \ d'autres identifiants d'authentification partag\xE9s ne sont utilis\xE9\
            s que lorsque cela est n\xE9cessaire, \xE0 titre exceptionnel, et sont\
            \ g\xE9r\xE9s comme suit :\n\u2022 L'utilisation du compte est interdite\
            \ \xE0 moins que cela ne soit n\xE9cessaire dans des circonstances exceptionnelles.\n\
            \u2022 L'utilisation est limit\xE9e au temps n\xE9cessaire \xE0 la circonstance\
            \ exceptionnelle.\n\u2022 La justification m\xE9tier de l\u2019utilisation\
            \ est document\xE9e.\n\u2022 L'utilisation est explicitement approuv\xE9\
            e par la direction.\n\u2022 L'identit\xE9 de l'utilisateur est confirm\xE9\
            e avant que l'acc\xE8s au compte ne soit accord\xE9.\n\u2022 Chaque action\
            \ effectu\xE9e est attribuable \xE0 un utilisateur."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2
      ref_id: 8.2.3
      description: 'Additional requirement for service providers only: Service providers
        with remote access to customer premises use unique authentication factors
        for each customer premises.'
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Les prestataires de services acc\xE9dant \xE0 distance\
            \ \xE0 l\u2019environnement des clients utilisent des facteurs d'authentification\
            \ diff\xE9rents pour chaque consommateur."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2
      ref_id: 8.2.4
      description: 'Addition, deletion, and modification of user IDs, authentication
        factors, and other identifier objects are managed as follows:

        - Authorized with the appropriate approval.

        - Implemented with only the privileges specified on the documented approval.'
      translations:
        fr:
          description: "L'ajout, la suppression et la modification des identifiants\
            \ utilisateur, des facteurs d'authentification et d'autres objets identifiants\
            \ sont g\xE9r\xE9s comme suit :\n\u2022 Autoris\xE9s avec l'approbation\
            \ appropri\xE9e.\n\u2022 Mis en oeuvre avec uniquement les privil\xE8\
            ges sp\xE9cifi\xE9s sur l'approbation document\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2
      ref_id: 8.2.5
      description: Access for terminated users is immediately revoked.
      translations:
        fr:
          description: "L'acc\xE8s des utilisateurs dont le contrat a \xE9t\xE9 r\xE9\
            sili\xE9 est imm\xE9diatement r\xE9voqu\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2
      ref_id: 8.2.6
      description: Inactive user accounts are removed or disabled within 90 days of
        inactivity.
      translations:
        fr:
          description: "Les comptes utilisateur inactifs depuis 90 jours sont supprim\xE9\
            s ou d\xE9sactiv\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2
      ref_id: 8.2.7
      description: 'Accounts used by third parties to access, support, or maintain
        system components via remote access are managed as follows:

        - Enabled only during the time period needed and disabled when not in use.

        - Use is monitored for unexpected activity.'
      translations:
        fr:
          description: "Les comptes utilis\xE9s par les tiers pour acc\xE9der, prendre\
            \ en charge ou maintenir les composants syst\xE8me via un acc\xE8s \xE0\
            \ distance sont g\xE9r\xE9s comme suit :\n\u2022 Activ\xE9s uniquement\
            \ pendant la p\xE9riode d\u2019intervention et d\xE9sactiv\xE9s en dehors\
            \ de la p\xE9riode.\n\u2022 L'utilisation est surveill\xE9e pour d\xE9\
            tecter toute activit\xE9 inhabituelle."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2.8
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.2
      ref_id: 8.2.8
      description: If a user session has been idle for more than 15 minutes, the user
        is required to re-authenticate to re-activate the terminal or session.
      translations:
        fr:
          description: "Si une session utilisateur est inactive pendant plus de 15\
            \ minutes, l'utilisateur doit s'authentifier \xE0 nouveau pour r\xE9activer\
            \ le terminal ou la session."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8
      ref_id: '8.3'
      description: Strong authentication for users and administrators is established
        and managed.
      translations:
        fr:
          description: "L\u2019authentification forte des utilisateurs et des administrateurs\
            \ est impl\xE9ment\xE9e et g\xE9r\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.1
      description: "All user access to system components for users and administrators\
        \ is authenticated via at least one of the following authentication factors:\n\
        \u2022 Something you know, such as a password or passphrase.\n\u2022 Something\
        \ you have, such as a token device or smart card.\n\u2022 Something you are,\
        \ such as a biometric element."
      translations:
        fr:
          description: "Tous les acc\xE8s utilisateur et administrateurs aux composants\
            \ syst\xE8me sont authentifi\xE9s via au moins l'un des facteurs d'authentification\
            \ suivants :\n\u2022 Quelque chose que vous connaissez, comme un mot de\
            \ passe ou une phrase secr\xE8te.\n\u2022 Quelque chose que vous poss\xE9\
            dez, comme un jeton d\u2019authentification ou une carte \xE0 puce.\n\u2022\
            \ Quelque chose que vous \xEAtes, comme un \xE9l\xE9ment biom\xE9trique."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.2
      description: Strong cryptography is used to render all authentication factors
        unreadable during transmission and storage on all system components.
      translations:
        fr:
          description: "Une cryptographie robuste est utilis\xE9e pour rendre tous\
            \ les facteurs d'authentification illisibles pendant la transmission et\
            \ le stockage sur tous les composants syst\xE8me."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.3
      description: User identity is verified before modifying any authentication factor.
      translations:
        fr:
          description: "L'identit\xE9 de l'utilisateur est v\xE9rifi\xE9e avant de\
            \ modifier tout facteur d'authentification."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.4
      description: "Invalid authentication attempts are limited by:\n- Locking out\
        \ the user ID after not more than 10 attempts.\n- Setting the lockout duration\
        \ to a minimum of 30 minutes or until the user\u2019s identity is confirmed."
      translations:
        fr:
          description: "Les tentatives d'authentification infructueuses sont limit\xE9\
            es par :\n\u2022 Le verrouillage de l'identifiant utilisateur apr\xE8\
            s 10 tentatives \xE9chou\xE9es maximum.\n\u2022 Le r\xE9glage de la dur\xE9\
            e de verrouillage \xE0 30 minutes minimum ou jusqu'\xE0 la confirmation\
            \ de l'identit\xE9 de l'utilisateur."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.5
      description: 'If passwords/passphrases are used as authentication factors to
        meet Requirement 8.3.1, they are set and reset for each user as follows:

        - Set to a unique value for first-time use and upon reset.

        - Forced to be changed immediately after the first use.'
      translations:
        fr:
          description: "Si des mots de passe/phrases secr\xE8tes sont utilis\xE9s\
            \ comme facteurs d'authentification pour r\xE9pondre \xE0 l'exigence 8.3.1,\
            \ ils sont d\xE9finis et r\xE9initialis\xE9s pour chaque utilisateur comme\
            \ suit :\n\u2022 D\xE9finis sur une valeur unique pour chaque premi\xE8\
            re utilisation et lors de la r\xE9initialisation.\n\u2022 Doivent \xEA\
            tre modifi\xE9s imm\xE9diatement apr\xE8s la premi\xE8re utilisation."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.6
      description: 'If passwords/passphrases are used as authentication factors to
        meet Requirement 8.3.1, they meet the following minimum level of complexity:

        - A minimum length of 12 characters (or IF the system does not support 12
        characters, a minimum length of eight characters).

        - Contain both numeric and alphabetic characters.'
      translations:
        fr:
          description: "Si des mots de passe/phrases secr\xE8tes sont utilis\xE9s\
            \ comme facteurs d'authentification pour r\xE9pondre \xE0 l'exigence 8.3.1,\
            \ ils doivent r\xE9pondre au niveau de complexit\xE9 minimum suivant :\n\
            \u2022 Une longueur minimale de 12 caract\xE8res (ou 8 caract\xE8res si\
            \ le syst\xE8me ne prend pas en charge les 12 caract\xE8res).\n\u2022\
            \ Contenir \xE0 la fois des caract\xE8res num\xE9riques et alphab\xE9\
            tiques."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.7
      description: Individuals are not allowed to submit a new password/passphrase
        that is the same as any of the last four passwords/passphrases used.
      translations:
        fr:
          description: "Les utilisateurs ne sont pas autoris\xE9s \xE0 soumettre un\
            \ nouveau mot de passe/phrase secr\xE8te correspondant \xE0 l\u2019un\
            \ des quatre derniers mots de passe/phrase secr\xE8tes utilis\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.8
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.8
      description: 'Authentication policies and procedures are documented and communicated
        to all users including:

        - Guidance on selecting strong authentication factors.

        - Guidance for how users should protect their authentication factors.

        - Instructions not to reuse previously used passwords/passphrases.

        - Instructions to change passwords/passphrases if there is any suspicion or
        knowledge that the password/passphrases have been compromised and how to report
        the incident.'
      translations:
        fr:
          description: "Les politiques et proc\xE9dures d'authentification sont document\xE9\
            es et communiqu\xE9es \xE0 tous les utilisateurs, notamment :\n\u2022\
            \ Des conseils sur le choix de facteurs d'authentification robustes.\n\
            \u2022 Des conseils sur la fa\xE7on dont les utilisateurs doivent prot\xE9\
            ger leurs facteurs d'authentification.\n\u2022 Des instructions pour ne\
            \ pas r\xE9utiliser les mots de passe/phrases secr\xE8tes pr\xE9c\xE9\
            demment utilis\xE9s.\n\u2022 Des instructions pour modifier les mots de\
            \ passe/phrases secr\xE8tes en cas de soup\xE7on ou en sachant que les\
            \ mots de passe/phrases secr\xE8tes ont \xE9t\xE9 compromis et comment\
            \ signaler l'incident."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.9
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.9
      description: "If passwords/passphrases are used as the only authentication factor\
        \ for user access (i.e., in any single-factor authentication implementation)\
        \ then either:\n\u2022 Passwords/passphrases are changed at least once every\
        \ 90 days,\nOR\n\u2022 The security posture of accounts is dynamically analyzed,\
        \ and real-time access to resources is automatically determined accordingly."
      translations:
        fr:
          description: "Si les mots de passe/phrases secr\xE8tes sont utilis\xE9s\
            \ comme seul facteur d'authentification pour l'acc\xE8s utilisateur (c'est-\xE0\
            -dire dans le cas d'authentification \xE0 un seul facteur), alors soit\
            \ :\n\u2022 Les mots de passe/phrases secr\xE8tes sont modifi\xE9s au\
            \ moins une fois tous les 90 jours,\nOU\n\u2022 La posture de s\xE9curit\xE9\
            \ des comptes est analys\xE9e de mani\xE8re dynamique et l'acc\xE8s aux\
            \ ressources est r\xE9alis\xE9 en temps-r\xE9el et est d\xE9termin\xE9\
            \ automatiquement en cons\xE9quence."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.10
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.10
      description: 'Additional requirement for service providers only: If passwords/passphrases
        are used as the only authentication factor for customer user access to cardholder
        data (i.e., in any single- factor authentication implementation), then guidance
        is provided to customer users including:

        - Guidance for customers to change their user passwords/passphrases periodically.

        - Guidance as to when, and under what circumstances, passwords/passphrases
        are to be changed.'
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Si des mots de passe/phrases secr\xE8tes sont utilis\xE9\
            s comme seul facteur d'authentification pour l'acc\xE8s des utilisateurs\
            \ consommateur aux donn\xE9es des titulaires de cartes (c'est-\xE0-dire\
            \ dans toute mise en oeuvre d'authentification \xE0 facteur unique), des\
            \ conseils sont fournis aux utilisateurs clients, notamment :\n\u2022\
            \ Des conseils aux clients pour modifier p\xE9riodiquement leurs mots\
            \ de passe/phrases secr\xE8te d'utilisateur.\n\u2022 Des conseils sur\
            \ quand et dans quelles circonstances les mots de passe/phrases secr\xE8\
            tes sont modifi\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.10.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.10
      ref_id: 8.3.10.1
      description: "Additional requirement for service providers only: If passwords/passphrases\
        \ are used as the only authentication factor for customer user access (i.e.,\
        \ in any single-factor authentication implementation) then either:\n\u2022\
        \ Passwords/passphrases are changed at least once every 90 days,\nOR\n\u2022\
        \ The security posture of accounts is dynamically analyzed, and real-time\
        \ access to resources is automatically determined accordingly."
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Si les mots de passe/phrases secr\xE8tes sont utilis\xE9\
            s comme seul facteur d'authentification pour l'acc\xE8s aux utilisateurs\
            \ consommateur (c'est-\xE0-dire dans toute mise en oeuvre d'authentification\
            \ \xE0 un seul facteur), alors soit :\n\u2022 Les mots de passe/phrases\
            \ secr\xE8tes sont modifi\xE9s au moins une fois tous les 90 jours,\n\
            OU\n\u2022 La posture de s\xE9curit\xE9 des comptes est analys\xE9e de\
            \ mani\xE8re dynamique et l'acc\xE8s en temps r\xE9el aux ressources est\
            \ automatiquement d\xE9termin\xE9 en cons\xE9quence."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3.11
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.3
      ref_id: 8.3.11
      description: 'Where authentication factors such as physical or logical security
        tokens, smart cards, or certificates are used:

        - Factors are assigned to an individual user and not shared among multiple
        users.

        - Physical and/or logical controls ensure only the intended user can use that
        factor to gain access.'
      translations:
        fr:
          description: "Lorsque des facteurs d'authentification tels que des tokens\
            \ physiques ou logiques, des cartes \xE0 point ou des certificats sont\
            \ utilis\xE9s :\n\u2022 Les facteurs sont attribu\xE9s \xE0 un utilisateur\
            \ individuel et ne sont pas partag\xE9s entre plusieurs utilisateurs.\n\
            \u2022 Les mesures physiques et/ou logiques garantissent que seul l'utilisateur\
            \ pr\xE9vu peut utiliser ce facteur pour obtenir l'acc\xE8s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8
      ref_id: '8.4'
      description: Multi-factor authentication (MFA) is implemented to secure access
        into the CDE.
      translations:
        fr:
          description: "L'authentification multifacteur (MFA) est mise en oeuvre pour\
            \ s\xE9curiser l'acc\xE8s au CDE."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.4.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.4
      ref_id: 8.4.1
      description: MFA is implemented for all non-console access into the CDE for
        personnel with administrative access.
      translations:
        fr:
          description: "Le MFA est mis en oeuvre pour tous les acc\xE8s non-console\
            \ dans le CDE pour le personnel avec des acc\xE8s d\u2019administration."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.4.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.4
      ref_id: 8.4.2
      description: MFA is implemented for all access into the CDE.
      translations:
        fr:
          description: "L'authentification MFA est mise en oeuvre pour tous les acc\xE8\
            s au CDE."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.4.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.4
      ref_id: 8.4.3
      description: "MFA is implemented for all remote network access originating from\
        \ outside the entity\u2019s network that could access or impact the CDE as\
        \ follows:\n- All remote access by all personnel, both users and administrators,\
        \ originating from outside the entity\u2019s network.\n- All remote access\
        \ by third parties and vendors."
      translations:
        fr:
          description: "L'authentification MFA est mise en oeuvre pour tous les acc\xE8\
            s r\xE9seau distants provenant de l'ext\xE9rieur du r\xE9seau de l'entit\xE9\
            \ qui pourraient acc\xE9der ou avoir une incidence sur le CDE comme suit\
            \ :\n\u2022 Tous les acc\xE8s \xE0 distance par tout le personnel, utilisateurs\
            \ et administrateurs, provenant de l'ext\xE9rieur du r\xE9seau de l'entit\xE9\
            .\n\u2022 Tous les acc\xE8s \xE0 distance par des tiers et des fournisseurs."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.5
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8
      ref_id: '8.5'
      description: Multi-factor authentication (MFA) systems are configured to prevent
        misuse.
      translations:
        fr:
          description: "Les syst\xE8mes d'authentification multifacteurs (MFA) sont\
            \ configur\xE9s de sorte \xE0 ne pas pouvoir \xEAtre contourn\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.5.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.5
      ref_id: 8.5.1
      description: 'MFA systems are implemented as follows:

        - The MFA system is not susceptible to replay attacks.

        - MFA systems cannot be bypassed by any users, including administrative users
        unless specifically documented, and authorized by management on an exception
        basis, for a limited time period.

        - At least two different types of authentication factors are used.

        - Success of all authentication factors is required before access is granted.'
      translations:
        fr:
          description: "Les syst\xE8mes MFA sont mis en oeuvre comme suit :\n\u2022\
            \ Le syst\xE8me MFA n'est pas sensible aux attaques par rejeu.\n\u2022\
            \ Les syst\xE8mes MFA ne peuvent pas \xEAtre contourn\xE9s par aucun utilisateur,\
            \ y compris les administrateurs, \xE0 moins que cela ne soit sp\xE9cifiquement\
            \ document\xE9 et autoris\xE9 par la direction \xE0 titre exceptionnel,\
            \ pour une p\xE9riode limit\xE9e.\n\u2022 Au moins deux types diff\xE9\
            rents de facteurs d'authentification sont utilis\xE9s.\n\u2022 La r\xE9\
            ussite de tous les facteurs d'authentification est obligatoire avant que\
            \ l'acc\xE8s ne soit accord\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.6
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8
      ref_id: '8.6'
      description: Use of application and system accounts and associated authentication
        factors is strictly managed.
      translations:
        fr:
          description: "Les comptes applicatifs, les comptes syst\xE8mes et les facteurs\
            \ d'authentification associ\xE9s est g\xE9r\xE9s rigoureusement."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.6.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.6
      ref_id: 8.6.1
      description: 'If accounts used by systems or applications can be used for interactive
        login, they are managed as follows:

        - Interactive use is prevented unless needed for an exceptional circumstance.

        - Interactive use is limited to the time needed for the exceptional circumstance.

        - Business justification for interactive use is documented.

        - Interactive use is explicitly approved by management.

        - Individual user identity is confirmed before access to account is granted.

        - Every action taken is attributable to an individual user.'
      translations:
        fr:
          description: "Si les comptes utilis\xE9s par les syst\xE8mes ou les applications\
            \ peuvent \xEAtre utilis\xE9s pour la connexion interactive, ils sont\
            \ g\xE9r\xE9s comme suit :\n\u2022 L'utilisation interactive est interdite\
            \ \xE0 moins que cela ne soit n\xE9cessaire dans des circonstances exceptionnelles.\n\
            \u2022 L'utilisation interactive est limit\xE9e au temps n\xE9cessaire\
            \ \xE0 la circonstance exceptionnelle.\n\u2022 La justification m\xE9\
            tier de l\u2019utilisation interactive est document\xE9e.\n\u2022 L'utilisation\
            \ interactive est explicitement approuv\xE9e par la direction.\n\u2022\
            \ L'identit\xE9 de l'utilisateur individuel est confirm\xE9e avant que\
            \ l'acc\xE8s au compte ne soit accord\xE9.\n\u2022 Chaque action entreprise\
            \ est attribuable \xE0 un utilisateur individuel."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.6.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.6
      ref_id: 8.6.2
      description: Passwords/passphrases for any application and system accounts that
        can be used for interactive login are not hard coded in scripts, configuration/property
        files, or bespoke and custom source code.
      translations:
        fr:
          description: "Les mots de passe/phrases secr\xE8tes pour tous les comptes\
            \ applicatifs et syst\xE8me qui peuvent \xEAtre utilis\xE9s pour la connexion\
            \ interactive ne sont pas cod\xE9s en dur dans les scripts, les fichiers\
            \ de configuration/de propri\xE9t\xE9 ou le code source sur mesure et\
            \ personnalis\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:8.6.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:8.6
      ref_id: 8.6.3
      description: "Passwords/passphrases for any application and system accounts\
        \ are protected against misuse as follows:\n- Passwords/passphrases are changed\
        \ periodically (at the frequency defined in the entity\u2019s targeted risk\
        \ analysis, which is performed according to all elements specified in Requirement\
        \ 12.3.1) and upon suspicion or confirmation of compromise.\n- Passwords/passphrases\
        \ are constructed with sufficient complexity appropriate for how frequently\
        \ the entity changes the passwords/passphrases."
      translations:
        fr:
          description: "Les mots de passe/phrases secr\xE8tes pour tous les comptes\
            \ applicatifs et syst\xE8me sont prot\xE9g\xE9s contre les abus comme\
            \ suit :\n\u2022 Les mots de passe/phrases secr\xE8tes sont modifi\xE9\
            s p\xE9riodiquement (\xE0 la fr\xE9quence d\xE9finie dans l'analyse de\
            \ risques cibl\xE9e de l'entit\xE9, qui est effectu\xE9e conform\xE9ment\
            \ \xE0 tous les \xE9l\xE9ments sp\xE9cifi\xE9s dans l'exigence 12.3.1)\
            \ et en cas de soup\xE7on ou de confirmation de compromission.\n\u2022\
            \ Les mots de passe/phrases secr\xE8tes sont construits avec une complexit\xE9\
            \ suffisante adapt\xE9e \xE0 la fr\xE9quence \xE0 laquelle l'entit\xE9\
            \ modifie les mots de passe/phrases secr\xE8tes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:implement-strong-access-control-measures
      ref_id: '9'
      name: Requirement 9
      description: Restrict Physical Access to Cardholder Data
      translations:
        fr:
          name: Exigence 9
          description: "Limiter L'acc\xE8s Physique aux Donn\xE9es des Titulaires\
            \ de Cartes"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9
      ref_id: '9.1'
      description: Processes and mechanisms for restricting physical access to cardholder
        data are defined and undood.
      translations:
        fr:
          description: "Les processus et m\xE9canismes de restriction de l'acc\xE8\
            s physique aux donn\xE9es des titulaires de cartes sont d\xE9finis et\
            \ compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.1
      ref_id: 9.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 9 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties.'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 9 sont :\n\u2022 Document\xE9\
            es.\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.1
      ref_id: 9.1.2
      description: Roles and responsibilities for performing activities in Requirement
        9 are documented, assigned, and understood.
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s li\xE9es aux activit\xE9\
            s de l'exigence 9 sont document\xE9s, attribu\xE9s et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9
      ref_id: '9.2'
      description: Physical access controls manage entry into facilities and systems
        containing cardholder data.
      translations:
        fr:
          description: "Les mesures de s\xE9curit\xE9 d'acc\xE8s physiques g\xE8rent\
            \ l'entr\xE9e dans les installations et les syst\xE8mes contenant les\
            \ donn\xE9es des titulaires de cartes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2
      ref_id: 9.2.1
      description: Appropriate facility entry controls are in place to restrict physical
        access to systems in the CDE.
      translations:
        fr:
          description: "Des mesures de s\xE9curit\xE9 d'acc\xE8s aux installations\
            \ appropri\xE9s sont en place pour limiter l'acc\xE8s physique aux syst\xE8\
            mes du CDE."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2.1
      ref_id: 9.2.1.1
      description: 'Individual physical access to sensitive areas within the CDE is
        monitored with either video cameras or physical access control mechanisms
        (or both) as follows:

        - Entry and exit points to/from sensitive areas within the CDE are monitored.

        - Monitoring devices or mechanisms are protected from tampering or disabling.

        - Collected data is reviewed and correlated with other entries.

        - Collected data is stored for at least three months, unless otherwise restricted
        by law.'
      translations:
        fr:
          description: "L'acc\xE8s physique individuel aux zones sensibles au sein\
            \ du CDE est surveill\xE9 \xE0 l'aide de cam\xE9ras vid\xE9o ou de m\xE9\
            canismes de contr\xF4le d'acc\xE8s physique (ou les deux), des mani\xE8\
            res suivantes :\n\u2022 Les points d'entr\xE9e et de sortie des zones\
            \ sensibles du CDE sont surveill\xE9s.\n\u2022 Les dispositifs ou m\xE9\
            canismes de surveillance sont prot\xE9g\xE9s contre l'alt\xE9ration ou\
            \ la d\xE9sactivation.\n\u2022 Les donn\xE9es recueillies sont examin\xE9\
            es et corr\xE9l\xE9es avec d'autres entr\xE9es.\n\u2022 Les donn\xE9es\
            \ recueillies sont conserv\xE9es pendant au moins trois mois, sauf restriction\
            \ l\xE9gale contraire."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2
      ref_id: 9.2.2
      description: Physical and/or logical controls are implemented to restrict use
        of publicly accessible network jacks within the facility.
      translations:
        fr:
          description: "Des mesures de s\xE9curit\xE9 physiques et/ou logiques sont\
            \ mis en oeuvre pour limiter l'utilisation des prises r\xE9seaux accessibles\
            \ au public au sein de l'installation."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2
      ref_id: 9.2.3
      description: Physical access to wireless access points, gateways, networking/communications
        hardware, and telecommunication lines within the facility is restricted.
      translations:
        fr:
          description: "L'acc\xE8s physique aux points d'acc\xE8s sans fil, aux passerelles,\
            \ au mat\xE9riel de mise en r\xE9seau/de communication et aux lignes de\
            \ t\xE9l\xE9communication au sein de l'installation est limit\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.2
      ref_id: 9.2.4
      description: Access to consoles in sensitive areas is restricted via locking
        when not in use.
      translations:
        fr:
          description: "L'acc\xE8s aux consoles dans les zones sensibles est limit\xE9\
            \ par un syst\xE8me de verrouillage lorsqu'elles ne sont pas utilis\xE9\
            es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9
      ref_id: '9.3'
      description: Physical access for personnel and visitors is authorized and managed.
      translations:
        fr:
          description: "L'acc\xE8s physique du personnel et des visiteurs est autoris\xE9\
            \ et g\xE9r\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3
      ref_id: 9.3.1
      description: "Procedures are implemented for authorizing and managing physical\
        \ access of personnel to the CDE, including:\n- Identifying personnel.\n-\
        \ Managing changes to an individual\u2019s physical access requirements.\n\
        - Revoking or terminating personnel identification.\n- Limiting access to\
        \ the identification process or system to authorized personnel"
      translations:
        fr:
          description: "Des proc\xE9dures sont mises en oeuvre pour autoriser et g\xE9\
            rer l'acc\xE8s physique du personnel au CDE, notamment :\n\u2022 Identification\
            \ du personnel.\n\u2022 L\u2019exigence de g\xE9rer les modifications\
            \ d'acc\xE8s physique d'une personne.\n\u2022 R\xE9voquer ou mettre fin\
            \ \xE0 l'identification du personnel.\n\u2022 Limiter l'acc\xE8s au processus\
            \ ou au syst\xE8me d'identification au personnel autoris\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3.1
      ref_id: 9.3.1.1
      description: 'Physical access to sensitive areas within the CDE for personnel
        is controlled as follows:

        - Access is authorized and based on individual job function.

        - Access is revoked immediately upon termination.

        - All physical access mechanisms, such as keys, access cards, etc., are returned
        or disabled upon termination.'
      translations:
        fr:
          description: "L'acc\xE8s physique aux zones sensibles au sein du CDE pour\
            \ le personnel est contr\xF4l\xE9 comme suit :\n\u2022 L'acc\xE8s est\
            \ autoris\xE9 et bas\xE9 sur la fonction individuelle du poste.\n\u2022\
            \ L'acc\xE8s est r\xE9voqu\xE9 imm\xE9diatement apr\xE8s la r\xE9siliation\
            \ du contrat de travail.\n\u2022 Tous les m\xE9canismes d'acc\xE8s physiques,\
            \ tels que les cl\xE9s, les cartes d'acc\xE8s, etc., sont retourn\xE9\
            s ou d\xE9sactiv\xE9s lors de la r\xE9siliation du contrat."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3
      ref_id: 9.3.2
      description: 'Procedures are implemented for authorizing and managing visitor
        access to the CDE, including:

        - Visitors are authorized before entering.

        - Visitors are escorted at all times.

        - Visitors are clearly identified and given a badge or other identification
        that expires.

        - Visitor badges or other identification visibly distinguishes visitors from
        personnel.'
      translations:
        fr:
          description: "Des proc\xE9dures sont mises en oeuvre afin d'autoriser et\
            \ g\xE9rer l'acc\xE8s des visiteurs au CDE, notamment :\n\u2022 Les visiteurs\
            \ sont autoris\xE9s avant d'entrer.\n\u2022 Les visiteurs sont escort\xE9\
            s en tout temps.\n\u2022 Les visiteurs sont clairement identifi\xE9s et\
            \ re\xE7oivent un badge ou autre moyen les identifiants, ayant un d\xE9\
            lai d\u2019expiration.\n\u2022 Les badges de visiteur ou autre moyen d\u2019\
            identification distinguent visiblement les visiteurs du personnel."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3
      ref_id: 9.3.3
      description: Visitor badges or identification are surrendered or deactivated
        before visitors leave the facility or at the date of expiration.
      translations:
        fr:
          description: "Les badges ou les pi\xE8ces d'identit\xE9 des visiteurs sont\
            \ remis ou d\xE9sactiv\xE9s avant que les visiteurs ne quittent l'\xE9\
            tablissement ou \xE0 la date d'expiration."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.3
      ref_id: 9.3.4
      description: "A visitor log is used to maintain a physical record of visitor\
        \ activity within the facility and within sensitive areas, including:\n- The\
        \ visitor\u2019s name and the organization represented.\n- The date and time\
        \ of the visit.\n- The name of the personnel authorizing physical access.\n\
        - Retaining the log for at least three months, unless otherwise restricted\
        \ by law."
      translations:
        fr:
          description: "Un journal des visiteurs est utilis\xE9 pour conserver un\
            \ enregistrement physique de l'activit\xE9 des visiteurs au sein de l'installation\
            \ et dans les zones sensibles, y compris :\n\u2022 Le nom du visiteur\
            \ et l'organisation repr\xE9sent\xE9e.\n\u2022 La date et l'heure de la\
            \ visite.\n\u2022 Le nom du personnel autorisant l'acc\xE8s physique.\n\
            \u2022 Conserver le journal pendant au moins trois mois, sauf restriction\
            \ l\xE9gale contraire."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9
      ref_id: '9.4'
      description: Media with cardholder data is securely stored, accessed, distributed,
        and destroyed.
      translations:
        fr:
          description: "Les supports contenant les donn\xE9es des titulaires de carte\
            \ sont stock\xE9s, consult\xE9s, distribu\xE9s et d\xE9truits de mani\xE8\
            re s\xE9curis\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4
      ref_id: 9.4.1
      description: All media with cardholder data is physically secured.
      translations:
        fr:
          description: "Tous les supports contenants les donn\xE9es des titulaires\
            \ de cartes sont physiquement s\xE9curis\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.1
      ref_id: 9.4.1.1
      description: Offline media backups with cardholder data are stored in a secure
        location.
      translations:
        fr:
          description: "Les sauvegardes hors ligne des supports contenants les donn\xE9\
            es des titulaires de cartes sont stock\xE9es dans un emplacement s\xE9\
            curis\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.1.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.1
      ref_id: 9.4.1.2
      description: The security of the offline media backup location(s) with cardholder
        data is reviewed at least once every 12 months.
      translations:
        fr:
          description: "La s\xE9curit\xE9 des emplacements de sauvegarde hors ligne\
            \ des supports contenant les donn\xE9es des titulaires de cartes est examin\xE9\
            e au moins une fois tous les 12 mois."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4
      ref_id: 9.4.2
      description: All media with cardholder data is classified in accordance with
        the sensitivity of the data.
      translations:
        fr:
          description: "Tous les supports contenant des donn\xE9es de titulaires de\
            \ cartes sont class\xE9s en fonction de la sensibilit\xE9 des donn\xE9\
            es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4
      ref_id: 9.4.3
      description: 'Media with cardholder data sent outside the facility is secured
        as follows:

        - Media sent outside the facility is logged.

        - Media is sent by secured courier or other delivery method that can be accurately
        tracked.

        - Offsite tracking logs include details about media location.'
      translations:
        fr:
          description: "Les supports avec les donn\xE9es des titulaires de cartes\
            \ envoy\xE9es \xE0 l'ext\xE9rieur de l'installation sont s\xE9curis\xE9\
            s comme suit :\n\u2022 Les supports envoy\xE9s \xE0 l'ext\xE9rieur de\
            \ l'installation sont document\xE9s.\n\u2022 Les supports sont envoy\xE9\
            s par courrier s\xE9curis\xE9 ou par un autre mode de livraison pouvant\
            \ \xEAtre suivi avec pr\xE9cision.\n\u2022 La documentation de suivi des\
            \ supports hors site inclue des d\xE9tails sur l'emplacement des supports."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4
      ref_id: 9.4.4
      description: Management approves all media with cardholder data that is moved
        outside the facility (including when media is distributed to individuals).
      translations:
        fr:
          description: "La direction approuve tous les supports avec des donn\xE9\
            es de titulaires de cartes qui sont d\xE9plac\xE9s hors de l'installation\
            \ (y compris lorsque les supports sont distribu\xE9s \xE0 des personnes\
            \ individuelles)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4
      ref_id: 9.4.5
      description: Inventory logs of all electronic media with cardholder data are
        maintained.
      translations:
        fr:
          description: "Un inventaire de tous les supports \xE9lectroniques contenant\
            \ les donn\xE9es des titulaires de cartes est conserv\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.5.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.5
      ref_id: 9.4.5.1
      description: Inventories of electronic media with cardholder data are conducted
        at least once every 12 months.
      translations:
        fr:
          description: "Les inventaires des supports \xE9lectroniques avec les donn\xE9\
            es des titulaires de cartes sont r\xE9alis\xE9s au moins une fois tous\
            \ les 12 mois."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4
      ref_id: 9.4.6
      description: "Hard-copy materials with cardholder data are destroyed when no\
        \ longer needed for business or legal reasons, as follows:\n\u2022 Materials\
        \ are cross-cut shredded, incinerated, or pulped so that cardholder data cannot\
        \ be reconstructed.\n\u2022 Materials are stored in secure storage containers\
        \ prior to destruction."
      translations:
        fr:
          description: "Les documents papier contenant les donn\xE9es des titulaires\
            \ de cartes sont d\xE9truits lorsqu'ils ne sont plus n\xE9cessaires pour\
            \ des raisons m\xE9tiers ou juridiques, comme suit :\n\u2022 Les mat\xE9\
            riaux sont d\xE9chiquet\xE9s, incin\xE9r\xE9s ou r\xE9duits en p\xE2te\
            \ afin que les donn\xE9es des titulaires de cartes ne puissent pas \xEA\
            tre reconstitu\xE9es.\n\u2022 Les documents sont stock\xE9s dans des conteneurs\
            \ de stockage s\xE9curis\xE9s avant destruction."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.4
      ref_id: 9.4.7
      description: 'Electronic media with cardholder data is destroyed when no longer
        needed for business or legal reasons via one of the following:

        - The electronic media is destroyed.

        - The cardholder data is rendered unrecoverable so that it cannot be reconstructed.'
      translations:
        fr:
          description: "Les supports \xE9lectroniques contenant les donn\xE9es de\
            \ titulaires de cartes sont d\xE9truits lorsqu'ils ne sont plus n\xE9\
            cessaires pour des raisons m\xE9tier ou juridiques via l'un des \xE9l\xE9\
            ments suivants :\n\u2022 Les supports \xE9lectroniques sont d\xE9truits.\n\
            \u2022 Les donn\xE9es des titulaires de cartes sont rendues irr\xE9cup\xE9\
            rables de sorte qu'elles ne peuvent pas \xEAtre reconstitu\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9
      ref_id: '9.5'
      description: Point of interaction (POI) devices are protected from tampering
        and unauthorized substitution.
      translations:
        fr:
          description: "Les dispositifs de point d'interaction (POI) sont prot\xE9\
            g\xE9s contre l\u2019alt\xE9ration et la substitution non autoris\xE9\
            e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5
      ref_id: 9.5.1
      description: 'POI devices that capture payment card data via direct physical
        interaction with the payment card form factor are protected from tampering
        and unauthorized substitution, including the following:

        - Maintaining a list of POI devices.

        - Periodically inspecting POI devices to look for tampering or unauthorized
        substitution.

        - Training personnel to be aware of suspicious behavior and to report tampering
        or unauthorized substitution of devices.'
      translations:
        fr:
          description: "Les appareils POI qui capturent les donn\xE9es de la carte\
            \ de paiement via une interaction physique directe avec le facteur de\
            \ forme de la carte de paiement sont prot\xE9g\xE9s contre l\u2019alt\xE9\
            ration et la substitution non autoris\xE9e, notamment :\n\u2022 Maintenir\
            \ une liste des p\xE9riph\xE9riques POI.\n\u2022 Inspecter p\xE9riodiquement\
            \ les appareils POI pour rechercher des alt\xE9rations ou des substitutions\
            \ non autoris\xE9es.\n\u2022 Former le personnel \xE0 \xEAtre conscient\
            \ des comportements suspects et \xE0 signaler toute alt\xE9ration ou substitution\
            \ non autoris\xE9e d'appareils."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5.1
      ref_id: 9.5.1.1
      description: 'An up-to-date list of POI devices is maintained, including:

        - Make and model of the device.

        - Location of device.

        - Device serial number or other methods of unique identification.'
      translations:
        fr:
          description: "Une liste \xE0 jour des appareils POI est maintenue, y compris\
            \ :\n\u2022 La marque et le mod\xE8le de l'appareil.\n\u2022 L\u2019emplacement\
            \ de l\u2019appareil.\n\u2022 Num\xE9ro de s\xE9rie de l'appareil ou autres\
            \ m\xE9thodes d'identification uniques."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5.1.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5.1
      ref_id: 9.5.1.2
      description: POI device surfaces are periodically inspected to detect tampering
        and unauthorized substitution.
      translations:
        fr:
          description: "Les surfaces des appareils POI sont inspect\xE9es p\xE9riodiquement\
            \ afin de d\xE9tecter les alt\xE9rations et les substitutions non autoris\xE9\
            es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5.1.2.1
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5.1.2
      ref_id: 9.5.1.2.1
      description: "The frequency of periodic POI device inspections and the type\
        \ of inspections performed is defined in the entity\u2019s targeted risk analysis,\
        \ which is performed according to all elements specified in Requirement 12.3.1."
      translations:
        fr:
          description: "La fr\xE9quence des inspections p\xE9riodiques des appareils\
            \ POI et le type d'inspections effectu\xE9es sont d\xE9finis dans l'analyse\
            \ de risques cibl\xE9e de l'entit\xE9, qui est r\xE9alis\xE9e selon tous\
            \ les \xE9l\xE9ments sp\xE9cifi\xE9s dans l'exigence 12.3.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5.1.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:9.5.1
      ref_id: 9.5.1.3
      description: 'Training is provided for personnel in POI environments to be aware
        of attempted tampering or replacement of POI devices, and includes:

        - Verifying the identity of any third-party persons claiming to be repair
        or maintenance personnel, before granting them access to modify or troubleshoot
        devices.

        - Procedures to ensure devices are not installed, replaced, or returned without
        verification.

        - Being aware of suspicious behavior around devices.

        - Reporting suspicious behavior and indications of device tampering or substitution
        to appropriate personnel.'
      translations:
        fr:
          description: "Une formation est dispens\xE9e au personnel des environnements\
            \ POI pour qu'il soit au courant des pratiques d'alt\xE9ration ou de remplacement\
            \ des appareils POI, et comprend :\n\u2022 V\xE9rifier l'identit\xE9 de\
            \ toute personne tierce pr\xE9tendant \xEAtre du personnel de r\xE9paration\
            \ ou de maintenance, avant de leur accorder l'acc\xE8s pour modifier ou\
            \ d\xE9panner les appareils.\n\u2022 Des proc\xE9dures pour garantir que\
            \ les appareils ne sont pas install\xE9s, remplac\xE9s ou retourn\xE9\
            s sans v\xE9rification.\n\u2022 \xCAtre conscient des comportements suspects\
            \ entourant les appareils.\n\u2022 Signaler les comportements suspects\
            \ et les indications d'alt\xE9ration ou de substitution de l'appareil\
            \ au personnel appropri\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:regularly-monitor-and-test-networks
      assessable: false
      depth: 1
      name: Regularly Monitor and Test Networks
      translations:
        fr:
          name: "Surveiller et tester r\xE9guli\xE8rement les r\xE9seaux"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:regularly-monitor-and-test-networks
      ref_id: '10'
      name: Requirement 10
      description: Log and Monitor All Access to System Components and Cardholder
        Data
      translations:
        fr:
          name: Exigence 10
          description: "Enregistrer et Surveiller tous les Acc\xE8s aux Composants\
            \ Syst\xE8me et aux Donn\xE9es des Titulaires de Cartes"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10
      ref_id: '10.1'
      description: Processes and mechanisms for logging and monitoring all access
        to system components and cardholder data are defined and documented.
      translations:
        fr:
          description: "Les processus et m\xE9canismes d'enregistrement et de surveillance\
            \ de tous les acc\xE8s aux composants syst\xE8me et aux donn\xE9es des\
            \ titulaires de cartes sont d\xE9finis et document\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.1
      ref_id: 10.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 10 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties.'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 10 sont :\n\u2022 Document\xE9\
            es.\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.1
      ref_id: 10.1.2
      description: Roles and responsibilities for performing activities in Requirement
        10 are documented, assigned, and understood
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s li\xE9es aux activit\xE9\
            s de l'exigence 10 sont document\xE9s, attribu\xE9s et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10
      ref_id: '10.2'
      description: Audit logs are implemented to support the detection of anomalies
        and suspicious activity, and the forensic analysis of events.
      translations:
        fr:
          description: "Les journaux d'audit sont mis en oeuvre pour prendre en charge\
            \ la d\xE9tection des anomalies et des activit\xE9s suspectes, ainsi que\
            \ l'analyse criminelle des \xE9v\xE9nements."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2
      ref_id: 10.2.1
      description: Audit logs are enabled and active for all system components and
        cardholder data.
      translations:
        fr:
          description: "Les journaux d'audit sont activ\xE9s et actifs pour tous les\
            \ composants syst\xE8me et les donn\xE9es des titulaires de cartes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1
      ref_id: 10.2.1.1
      description: Audit logs capture all individual user access to cardholder data.
      translations:
        fr:
          description: "Les journaux d'audit capturent tous les acc\xE8s des utilisateurs\
            \ individuels aux donn\xE9es des titulaires de cartes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1
      ref_id: 10.2.1.2
      description: Audit logs capture all actions taken by any individual with administrative
        access, including any interactive use of application or system accounts.
      translations:
        fr:
          description: "Les journaux d'audit capturent toutes les actions effectu\xE9\
            es par toute personne disposant d'un acc\xE8s d\u2019administration, y\
            \ compris toute utilisation interactive des comptes d'applications ou\
            \ syst\xE8me."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1
      ref_id: 10.2.1.3
      description: Audit logs capture all access to audit logs.
      translations:
        fr:
          description: "Les journaux d'audit capturent tous les acc\xE8s aux journaux\
            \ d'audit."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1.4
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1
      ref_id: 10.2.1.4
      description: Audit logs capture all invalid logical access attempts.
      translations:
        fr:
          description: "Les journaux d'audit capturent toutes les tentatives d'acc\xE8\
            s logique non valides."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1.5
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1
      ref_id: 10.2.1.5
      description: 'Audit logs capture all changes to identification and authentication
        credentials including, but not limited to:

        - Creation of new accounts.

        - Elevation of privileges.

        - All changes, additions, or deletions to accounts with administrative access.'
      translations:
        fr:
          description: "Les journaux d'audit capturent toutes les modifications apport\xE9\
            es \xE0 l'identification et aux identifiants d'authentification, y compris,\
            \ sans toutefois s'y limiter :\n\u2022 La cr\xE9ation de nouveaux comptes.\n\
            \u2022 L'\xE9l\xE9vation des privil\xE8ges.\n\u2022 Toutes les modifications,\
            \ ajouts ou suppressions de comptes avec acc\xE8s administrateur."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1.6
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1
      ref_id: 10.2.1.6
      description: 'Audit logs capture the following:

        - All initialization of new audit logs, and

        - All starting, stopping, or pausing of the existing audit logs.'
      translations:
        fr:
          description: "Les journaux d'audit capturent les \xE9l\xE9ments suivants\
            \ :\n\u2022 Toutes les initialisations des nouveaux journaux d'audit,\
            \ et\n\u2022 Tous les d\xE9marrages, arr\xEAts ou pauses des journaux\
            \ d'audit existants."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1.7
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.1
      ref_id: 10.2.1.7
      description: Audit logs capture all creation and deletion of system-level objects.
      translations:
        fr:
          description: "es journaux d'audit capturent toutes les cr\xE9ations et suppressions\
            \ d'objets au niveau du syst\xE8me."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.2
      ref_id: 10.2.2
      description: 'Audit logs record the following details for each auditable event:

        - User identification.

        - Type of event.

        - Date and time.

        - Success and failure indication.

        - Origination of event.

        - Identity or name of affected data, system component, resource, or service
        (for example, name and protocol).'
      translations:
        fr:
          description: "Les journaux d'audit enregistrent les d\xE9tails suivants\
            \ pour chaque \xE9v\xE9nement auditable :\n\u2022 Identification de l'utilisateur.\n\
            \u2022 Type d\u2019\xE9v\xE9nement.\n\u2022 Date et heure.\n\u2022 Indication\
            \ de r\xE9ussite et d'\xE9chec.\n\u2022 Origine de l'\xE9v\xE9nement.\n\
            \u2022 Identit\xE9 ou nom des donn\xE9es, composant syst\xE8me, ressource\
            \ ou service touch\xE9s (par exemple, nom et protocole)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10
      ref_id: '10.3'
      description: Audit logs are protected from destruction and unauthorized modifications.
      translations:
        fr:
          description: "Les journaux d'audit sont prot\xE9g\xE9s contre la destruction\
            \ et les modifications non autoris\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.3
      ref_id: 10.3.1
      description: Read access to audit logs files is limited to those with a job-related
        need.
      translations:
        fr:
          description: "L'acc\xE8s en lecture aux fichiers journaux d'audit est limit\xE9\
            \ aux personnes ayant un besoin li\xE9 \xE0 leur poste."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.3
      ref_id: 10.3.2
      description: Audit log files are protected to prevent modifications by individuals.
      translations:
        fr:
          description: "Les fichiers journaux d'audit sont prot\xE9g\xE9s pour emp\xEA\
            cher les modifications par des personnes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.3.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.3
      ref_id: 10.3.3
      description: Audit log files, including those for external-facing technologies,
        are promptly backed up to a secure, central, internal log server(s) or other
        media that is difficult to modify.
      translations:
        fr:
          description: "Les fichiers Journaux d'audit, y compris ceux des technologies\
            \ expos\xE9es en externes, sont rapidement sauvegard\xE9s sur un ou des\
            \ serveurs de journaux internes s\xE9curis\xE9s et centraux ou sur d'autres\
            \ supports difficiles \xE0 modifier."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.3.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.3
      ref_id: 10.3.4
      description: File integrity monitoring or change-detection mechanisms is used
        on audit logs to ensure that existing log data cannot be changed without generating
        alerts.
      translations:
        fr:
          description: "Des m\xE9canismes de surveillance de l'int\xE9grit\xE9 des\
            \ fichiers ou de d\xE9tection des modifications sont utilis\xE9s sur les\
            \ journaux d'audit afin de garantir que les donn\xE9es de journalisation\
            \ existantes ne peuvent pas \xEAtre modifi\xE9es sans g\xE9n\xE9rer d'alertes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10
      ref_id: '10.4'
      description: Audit logs are reviewed to identify anomalies or suspicious activity.
      translations:
        fr:
          description: "Les journaux d'audit sont examin\xE9s pour identifier les\
            \ anomalies ou les activit\xE9s suspectes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4
      ref_id: 10.4.1
      description: 'The following audit logs are reviewed at least once daily:

        - All security events.

        - Logs of all system components that store, process, or transmit CHD and/or
        SAD.

        - Logs of all critical system components.

        - Logs of all servers and system components that perform security functions
        (for example, network security controls, intrusion-detection systems/intrusion-prevention
        systems (IDS/IPS), authentication servers).'
      translations:
        fr:
          description: "Les journaux d'audit suivants sont examin\xE9s au moins une\
            \ fois par jour :\n\u2022 Tous les \xE9v\xE9nements de s\xE9curit\xE9\
            .\n\u2022 Les journaux de tous les composants syst\xE8me qui stockent,\
            \ traitent ou transmettent des CHD et/ou des SAD.\n\u2022 Les journaux\
            \ de tous les composants syst\xE8me critiques.\n\u2022 Les journaux de\
            \ tous les serveurs et composants syst\xE8me qui ex\xE9cutent des fonctions\
            \ de s\xE9curit\xE9 (par exemple, mesures de s\xE9curit\xE9 r\xE9seau,\
            \ syst\xE8mes de d\xE9tection d'intrusion/syst\xE8mes de pr\xE9vention\
            \ d'intrusion (IDS/IPS), serveurs d'authentification)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4.1
      ref_id: 10.4.1.1
      description: Automated mechanisms are used to perform audit log reviews.
      translations:
        fr:
          description: "Des m\xE9canismes automatis\xE9s sont utilis\xE9s pour effectuer\
            \ des examens des journaux d'audit."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4
      ref_id: 10.4.2
      description: Logs of all other system components (those not specified in Requirement
        10.4.1) are reviewed periodically.
      translations:
        fr:
          description: "Les journaux de tous les autres composants syst\xE8me (ceux\
            \ non sp\xE9cifi\xE9s dans l'exigence 10.4.1) sont examin\xE9s p\xE9riodiquement."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4.2.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4.2
      ref_id: 10.4.2.1
      description: "The frequency of periodic log reviews for all other system components\
        \ (not defined in Requirement 10.4.1) is defined in the entity\u2019s targeted\
        \ risk analysis, which is performed according to all elements specified in\
        \ Requirement 12.3.1."
      translations:
        fr:
          description: "La fr\xE9quence des examens p\xE9riodiques des journaux pour\
            \ tous les autres composants syst\xE8me (non d\xE9finis dans l'exigence\
            \ 10.4.1) est d\xE9finie dans l'analyse de risques cibl\xE9e de l'entit\xE9\
            , qui est effectu\xE9e selon tous les \xE9l\xE9ments sp\xE9cifi\xE9s dans\
            \ l'exigence 12.3.1"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.4
      ref_id: 10.4.3
      description: Exceptions and anomalies identified during the review process are
        addressed.
      translations:
        fr:
          description: "Les exceptions et anomalies identifi\xE9es au cours du processus\
            \ d'examen sont trait\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.5
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10
      ref_id: '10.5'
      description: Audit log history is retained and available for analysis.
      translations:
        fr:
          description: "L'historique des journaux d'audit est conserv\xE9 et disponible\
            \ pour analyse."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.5.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.5
      ref_id: 10.5.1
      description: Retain audit log history for at least 12 months, with at least
        the most recent three months immediately available for analysis.
      translations:
        fr:
          description: "Conserver l'historique des journaux d'audit pendant au moins\
            \ 12 mois, avec au moins les trois mois les plus r\xE9cents imm\xE9diatement\
            \ disponibles pour analyse."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.6
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10
      ref_id: '10.6'
      description: Time-synchronization mechanisms support consistent time settings
        across all systems.
      translations:
        fr:
          description: "Les m\xE9canismes de synchronisation temporelle prennent en\
            \ charge des param\xE8tres de temps coh\xE9rents sur tous les syst\xE8\
            mes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.6.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.6
      ref_id: 10.6.1
      description: System clocks and time are synchronized using time-synchronization
        technology.
      translations:
        fr:
          description: "Les horloges syst\xE8me et l'heure sont synchronis\xE9es \xE0\
            \ l'aide de la technologie de synchronisation date/heure."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.6.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.6
      ref_id: 10.6.2
      description: 'Systems are configured to the correct and consistent time as follows:

        - One or more designated time servers are in use.

        - Only the designated central time server(s) receives time from external sources.

        - Time received from external sources is based on International Atomic Time
        or Coordinated Universal Time (UTC).

        - The designated time server(s) accept time updates only from specific industry-accepted
        external sources.

        - Where there is more than one designated time server, the time servers peer
        with one another to keep accurate time.

        - Internal systems receive time information only from designated central time
        server(s).'
      translations:
        fr:
          description: "Les syst\xE8mes sont configur\xE9s pour l'heure correcte et\
            \ coh\xE9rente comme suit :\n\u2022 Un ou plusieurs serveurs de temps\
            \ d\xE9sign\xE9s utilis\xE9s.\n\u2022 Seul le ou seuls les serveurs de\
            \ temps centraux d\xE9sign\xE9s re\xE7oit l'heure de sources externes.\n\
            \u2022 L'heure re\xE7ue de sources externes est bas\xE9e sur le temps\
            \ atomique international ou le temps universel coordonn\xE9 (UTC).\n\u2022\
            \ Le ou les serveurs de temps d\xE9sign\xE9s n'acceptent les mises \xE0\
            \ jour de la date/heure que de sources externes sp\xE9cifiques accept\xE9\
            es par l'industrie.\n\u2022 Lorsqu'il y a plus d'un serveur de temps d\xE9\
            sign\xE9, les serveurs de temps s'\xE9changent les uns avec les autres\
            \ pour garder l'heure exacte.\n\u2022 Les syst\xE8mes internes ne re\xE7\
            oivent des informations de date/heure que du ou des serveurs de temps\
            \ centraux d\xE9sign\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.6.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.6
      ref_id: 10.6.3
      description: 'Time synchronization settings and data are protected as follows:

        - Access to time data is restricted to only personnel with a business need.

        - Any changes to time settings on critical systems are logged, monitored,
        and reviewed.'
      translations:
        fr:
          description: "Les param\xE8tres et les donn\xE9es de synchronisation date/heure\
            \ sont prot\xE9g\xE9s comme suit :\n\u2022 L'acc\xE8s aux donn\xE9es date/heure\
            \ est limit\xE9 au personnel ayant un besoin professionnel.\n\u2022 Toute\
            \ modification des param\xE8tres horaires sur les syst\xE8mes critiques\
            \ est enregistr\xE9e, surveill\xE9e et examin\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.7
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10
      ref_id: '10.7'
      description: Failures of critical security control systems are detected, reported,
        and responded to promptly.
      translations:
        fr:
          description: "Les d\xE9faillances des syst\xE8mes de contr\xF4le de s\xE9\
            curit\xE9 critiques sont d\xE9tect\xE9es, signal\xE9es et trait\xE9es\
            \ rapidement."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.7.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.7
      ref_id: 10.7.1
      description: 'Additional requirement for service providers only: Failures of
        critical security control systems are detected, alerted, and addressed promptly,
        including but not limited to failure of the following critical security control
        systems:

        - Network security controls.

        - IDS/IPS.

        - FIM.

        - Anti-malware solutions.

        - Physical access controls.

        - Logical access controls.

        - Audit logging mechanisms.

        - Segmentation controls (if used).'
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Les d\xE9faillances des syst\xE8mes de contr\xF4le de s\xE9\
            curit\xE9 critiques sont d\xE9tect\xE9es, signal\xE9es et trait\xE9es\
            \ rapidement, y compris, sans toutefois s'y limiter, les d\xE9faillances\
            \ des syst\xE8mes de contr\xF4le de s\xE9curit\xE9 critiques suivants\
            \ :\n\u2022 Les mesures de s\xE9curit\xE9 r\xE9seau\n\u2022 IDS/IPS\n\u2022\
            \ FIM\n\u2022 Les solutions anti-programmes malveillants\n\u2022 Les mesures\
            \ d\u2019acc\xE8s physiques\n\u2022 Les mesures d\u2019acc\xE8s logiques\n\
            \u2022 Les m\xE9canismes de journalisation des audits\n\u2022 Les mesures\
            \ de segmentation (le cas \xE9ch\xE9ant)"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.7.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.7
      ref_id: 10.7.2
      description: 'Failures of critical security control systems are detected, alerted,
        and addressed promptly, including but not limited to failure of the following
        critical security control systems:

        - Network security controls.

        - IDS/IPS.

        - Change-detection mechanisms.

        - Anti-malware solutions.

        - Physical access controls.

        - Logical access controls.

        - Audit logging mechanisms.

        - Segmentation controls (if used).

        - Audit log review mechanisms.

        - Automated security testing tools (if used).'
      translations:
        fr:
          description: "Les d\xE9faillances des syst\xE8mes de contr\xF4le de s\xE9\
            curit\xE9 critiques sont d\xE9tect\xE9es, signal\xE9es et trait\xE9es\
            \ rapidement, y compris, sans toutefois s'y limiter, les d\xE9faillances\
            \ des syst\xE8mes de contr\xF4le de s\xE9curit\xE9 critiques suivants\
            \ :\n\u2022 Les mesures de s\xE9curit\xE9 r\xE9seau\n\u2022 IDS/IPS\n\u2022\
            \ Les m\xE9canismes de d\xE9tection des modifications\n\u2022 Les solutions\
            \ anti-programmes malveillants\n\u2022 Les mesures d\u2019acc\xE8s physiques\n\
            \u2022 Les mesures d\u2019acc\xE8s logiques\n\u2022 Les m\xE9canismes\
            \ de journalisation des audits\n\u2022 Les mesures de segmentation (le\
            \ cas \xE9ch\xE9ant)\n\u2022 Les m\xE9canismes d'examen des Journaux d'audit\n\
            \u2022 Des outils automatis\xE9s de test de la s\xE9curit\xE9 (le cas\
            \ \xE9ch\xE9ant)"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:10.7.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:10.7
      ref_id: 10.7.3
      description: 'Failures of any critical security controls systems are responded
        to promptly, including but not limited to:

        - Restoring security functions.

        - Identifying and documenting the duration (date and time from start to end)
        of the security failure.

        - Identifying and documenting the cause(s) of failure and documenting required
        remediation.

        - Identifying and addressing any security issues that arose during the failure.

        - Determining whether further actions are required as a result of the security
        failure.

        - Implementing controls to prevent the cause of failure from reoccurring.

        - Resuming monitoring of security controls.'
      translations:
        fr:
          description: "Les d\xE9faillances de tout syst\xE8me de contr\xF4le de s\xE9\
            curit\xE9 critique sont trait\xE9es rapidement, y compris, sans toutefois\
            \ s'y limiter :\n\u2022 Restauration des fonctions de s\xE9curit\xE9.\n\
            \u2022 Identifier et documenter la dur\xE9e (date et heure du d\xE9but\
            \ \xE0 la fin) de la d\xE9faillance de s\xE9curit\xE9.\n\u2022 Identifier\
            \ et documenter la ou les causes de la d\xE9faillance et documenter les\
            \ mesures correctives n\xE9cessaires.\n\u2022 Identifier et r\xE9soudre\
            \ tous les probl\xE8mes de s\xE9curit\xE9 survenus lors de la d\xE9faillance.\n\
            \u2022 D\xE9terminer si d'autres mesures est n\xE9cessaires \xE0 la suite\
            \ de la d\xE9faillance de s\xE9curit\xE9.\n\u2022 Mettre en oeuvre des\
            \ mesures afin d'\xE9viter que la cause de la d\xE9faillance ne se reproduise.\n\
            \u2022 Reprendre la surveillance des mesures de s\xE9curit\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:regularly-monitor-and-test-networks
      ref_id: '11'
      name: Requirement 11
      description: Test Security of Systems and Networks Regularly
      translations:
        fr:
          name: Exigence 11
          description: "Tester R\xE9guli\xE8rement la S\xE9curit\xE9 des Syst\xE8\
            mes et des R\xE9seaux"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11
      ref_id: '11.1'
      description: Processes and mechanisms for regularly testing security of systems
        and networks are defined and understood.
      translations:
        fr:
          description: "Les processus et m\xE9canismes pour tester r\xE9guli\xE8rement\
            \ la s\xE9curit\xE9 des syst\xE8mes et des r\xE9seaux sont d\xE9finis\
            \ et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.1
      ref_id: 11.1.1
      description: 'All security policies and operational procedures that are identified
        in Requirement 11 are:

        - Documented.

        - Kept up to date.

        - In use.

        - Known to all affected parties.'
      translations:
        fr:
          description: "Toutes les politiques de s\xE9curit\xE9 et proc\xE9dures op\xE9\
            rationnelles identifi\xE9es dans l'exigence 11 sont :\n\u2022 Document\xE9\
            es.\n\u2022 Tenues \xE0 jour.\n\u2022 Utilis\xE9es.\n\u2022 Connues de\
            \ toutes les parties concern\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.1
      ref_id: 11.1.2
      description: Roles and responsibilities for performing activities in Requirement
        11 are documented, assigned, and understood.
      translations:
        fr:
          description: "Les r\xF4les et les responsabilit\xE9s li\xE9es aux activit\xE9\
            s de l'exigence 11 sont document\xE9s, attribu\xE9s et compris."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11
      ref_id: '11.2'
      description: Wireless access points are identified and monitored, and unauthorized
        wireless access points are addressed.
      translations:
        fr:
          description: "Les points d\u2019acc\xE8s sans fil sont identifi\xE9s et\
            \ surveill\xE9s, et les points d\u2019acc\xE8s sans fil non autoris\xE9\
            s sont trait\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.2
      ref_id: 11.2.1
      description: 'Authorized and unauthorized wireless access points are managed
        as follows:

        - The presence of wireless (Wi-Fi) access points is tested for,

        - All authorized and unauthorized wireless access points are detected and
        identified,

        - Testing, detection, and identification occurs at least once every three
        months.

        - If automated monitoring is used, personnel are notified via generated alerts.'
      translations:
        fr:
          description: "Les points d'acc\xE8s sans fil autoris\xE9s et non autoris\xE9\
            s sont g\xE9r\xE9s de la mani\xE8re suivante :\n\u2022 La pr\xE9sence\
            \ de points d'acc\xE8s sans fil (Wi-Fi) est test\xE9e,\n\u2022 Tous les\
            \ points d'acc\xE8s sans fil autoris\xE9s et non autoris\xE9s sont d\xE9\
            tect\xE9s et identifi\xE9s,\n\u2022 Les tests, la d\xE9tection et l'identification\
            \ sont effectu\xE9s au moins une fois tous les trois mois.\n\u2022 Si\
            \ une surveillance automatis\xE9e est utilis\xE9e, le personnel doit \xEA\
            tre averti via la g\xE9n\xE9ration d\u2019alertes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.2
      ref_id: 11.2.2
      description: An inventory of authorized wireless access points is maintained,
        including a documented business justification.
      translations:
        fr:
          description: "Un inventaire des points d'acc\xE8s sans fil autoris\xE9s\
            \ est conserv\xE9, y compris une justification m\xE9tier document\xE9\
            e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11
      ref_id: '11.3'
      description: External and internal vulnerabilities are regularly identified,
        prioritized, and addressed.
      translations:
        fr:
          description: "Les vuln\xE9rabilit\xE9s externes et internes sont r\xE9guli\xE8\
            rement identifi\xE9es, prioris\xE9es et trait\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3
      ref_id: 11.3.1
      description: "Internal vulnerability scans are performed as follows:\n- At least\
        \ once every three months.\n- High-risk and critical vulnerabilities (per\
        \ the entity\u2019s vulnerability risk rankings defined at Requirement 6.3.1)\
        \ are resolved.\n- Rescans are performed that confirm all high- risk and critical\
        \ vulnerabilities (as noted above) have been resolved.\n- Scan tool is kept\
        \ up to date with latest vulnerability information.\n- Scans are performed\
        \ by qualified personnel and organizational independence of the tester exists."
      translations:
        fr:
          description: "Les scans de vuln\xE9rabilit\xE9s internes sont effectu\xE9\
            es comme suit :\n\u2022 Au moins une fois tous les trois mois.\n\u2022\
            \ Les vuln\xE9rabilit\xE9s \xE0 haut risque et critiques (selon les classements\
            \ de risque des vuln\xE9rabilit\xE9s de l'entit\xE9 d\xE9finis \xE0 l'exigence\
            \ 6.3.1) sont r\xE9solues.\n\u2022 Des rescans sont effectu\xE9s pour\
            \ confirmer que toutes les vuln\xE9rabilit\xE9s \xE0 haut risque et critiques,\
            \ comme indiqu\xE9 ci-dessus, ont \xE9t\xE9 r\xE9solues.\n\u2022 L'outil\
            \ de scan est tenu \xE0 jour avec les derni\xE8res informations sur les\
            \ vuln\xE9rabilit\xE9s.\n\u2022 Les scans sont effectu\xE9s par du personnel\
            \ qualifi\xE9 et l'ind\xE9pendance organisationnelle du testeur existe."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3.1
      ref_id: 11.3.1.1
      description: "All other applicable vulnerabilities (those not ranked as high-risk\
        \ or critical per the entity\u2019s vulnerability risk rankings defined at\
        \ Requirement 6.3.1) are managed as follows:\n- Addressed based on the risk\
        \ defined in the entity\u2019s targeted risk analysis, which is performed\
        \ according to all elements specified in Requirement 12.3.1.\n- Rescans are\
        \ conducted as needed."
      translations:
        fr:
          description: "Toutes les autres vuln\xE9rabilit\xE9s applicables (celles\
            \ qui ne sont pas class\xE9es comme \xE0 haut risque ou critiques (selon\
            \ les classements de risque de vuln\xE9rabilit\xE9 de l'entit\xE9 d\xE9\
            finis \xE0 l'exigence 6.3.1) sont g\xE9r\xE9es comme suit :\n\u2022 Trait\xE9\
            es sur la base du risque d\xE9fini dans l'analyse de risque cibl\xE9e\
            \ de l'entit\xE9, qui est effectu\xE9e selon tous les \xE9l\xE9ments sp\xE9\
            cifi\xE9s dans l'exigence 12.3.1.\n\u2022 Des scans de v\xE9rification\
            \ sont effectu\xE9s si besoin."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3.1.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3.1
      ref_id: 11.3.1.2
      description: 'Internal vulnerability scans are performed via authenticated scanning
        as follows:

        - Systems that are unable to accept credentials for authenticated scanning
        are documented.

        - Sufficient privileges are used for those systems that accept credentials
        for scanning.

        - If accounts used for authenticated scanning can be used for interactive
        login, they are managed in accordance with Requirement 8.2.2.'
      translations:
        fr:
          description: "Les scans de vuln\xE9rabilit\xE9 internes sont effectu\xE9\
            s via un scan authentifi\xE9 comme suit :\n\u2022 Les syst\xE8mes qui\
            \ ne peuvent pas accepter les \xAB credentials \xBB pour le scan authentifi\xE9\
            \ sont document\xE9s.\n\u2022 Des privil\xE8ges suffisants sont utilis\xE9\
            s pour les syst\xE8mes qui acceptent les \xAB credentials \xBB pour le\
            \ scan.\n\u2022 Si les comptes utilis\xE9s pour le scan authentifi\xE9\
            \ peuvent \xEAtre utilis\xE9s pour la connexion interactive, ils sont\
            \ g\xE9r\xE9s conform\xE9ment \xE0 l'exigence 8.2.2."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3.1.3
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3.1
      ref_id: 11.3.1.3
      description: "Internal vulnerability scans are performed after any significant\
        \ change as follows:\n- High-risk and critical vulnerabilities (per the entity\u2019\
        s vulnerability risk rankings defined at Requirement 6.3.1) are resolved.\n\
        - Rescans are conducted as needed.\n- Scans are performed by qualified personnel\
        \ and organizational independence of the tester exists (not required to be\
        \ a QSA or ASV)."
      translations:
        fr:
          description: "Les scans de vuln\xE9rabilit\xE9s internes sont effectu\xE9\
            s apr\xE8s toute modification importante comme suit :\n\u2022 Les vuln\xE9\
            rabilit\xE9s \xE0 haut risque et critiques (selon les classements de risque\
            \ des vuln\xE9rabilit\xE9s de l'entit\xE9 d\xE9finis \xE0 l'exigence 6.3.1)\
            \ sont r\xE9solues.\n\u2022 Des scans de v\xE9rification sont effectu\xE9\
            s au besoin.\n\u2022 Les scans sont effectu\xE9s par du personnel qualifi\xE9\
            \ et l'ind\xE9pendance organisationnelle du testeur existe (il n'est pas\
            \ n\xE9cessaire qu'il soit un QSA ou un ASV)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3
      ref_id: 11.3.2
      description: "External vulnerability scans are performed as follows:\n\u2022\
        \ At least once every three months.\n\u2022 By a PCI SSC Approved Scanning\
        \ Vendor (ASV).\n\u2022 Vulnerabilities are resolved and ASV Program Guide\
        \ requirements for a passing scan are met.\n\u2022 Rescans are performed as\
        \ needed to confirm that vulnerabilities are resolved per the ASV Program\
        \ Guide requirements for a passing scan."
      translations:
        fr:
          description: "Les scans de vuln\xE9rabilit\xE9s externes sont effectu\xE9\
            s comme suit :\n\u2022 Au moins une fois tous les trois mois.\n\u2022\
            \ Par un fournisseur de scan de vuln\xE9rabilit\xE9s agr\xE9\xE9 PCI SSC\
            \ (ASV).\n\u2022 Les vuln\xE9rabilit\xE9s sont r\xE9solues et les exigences\
            \ du guide du programme de l'ASV pour un scan r\xE9ussi sont respect\xE9\
            es.\n\u2022 Des scans de v\xE9rification sont effectu\xE9s si besoin pour\
            \ confirmer que les vuln\xE9rabilit\xE9s sont r\xE9solues conform\xE9\
            ment aux exigences du guide du programme de l'ASV pour un scan r\xE9ussi."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3.2.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.3.2
      ref_id: 11.3.2.1
      description: 'External vulnerability scans are performed after any significant
        change as follows:

        - Vulnerabilities that are scored 4.0 or higher by the CVSS are resolved.

        - Rescans are conducted as needed.

        - Scans are performed by qualified personnel and organizational independence
        of the tester exists (not required to be a QSA or ASV).'
      translations:
        fr:
          description: "Les scans de vuln\xE9rabilit\xE9s externes sont effectu\xE9\
            s apr\xE8s toute modification importante comme suit :\n\u2022 Les vuln\xE9\
            rabilit\xE9s trouv\xE9es avec un CVSS \xE9gal \xE0 4.0 ou plus sont r\xE9\
            solues.\n\u2022 Des scans de v\xE9rification sont effectu\xE9s si besoin.\n\
            \u2022 Les scans sont effectu\xE9s par du personnel qualifi\xE9 et l'ind\xE9\
            pendance organisationnelle du testeur existe (il n'est pas n\xE9cessaire\
            \ qu'il soit un QSA ou un ASV)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11
      ref_id: '11.4'
      description: External and internal penetration testing is regularly performed,
        and exploitable vulnerabilities and security weaknesses are corrected.
      translations:
        fr:
          description: "Des tests d\u2019intrusion externes et internes sont effectu\xE9\
            s r\xE9guli\xE8rement, les vuln\xE9rabilit\xE9s exploitables et les faiblesses\
            \ de s\xE9curit\xE9 sont corrig\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4
      ref_id: 11.4.1
      description: 'A penetration testing methodology is defined, documented, and
        implemented by the entity, and includes:

        - Industry-accepted penetration testing approaches.

        - Coverage for the entire CDE perimeter and critical systems.

        - Testing from both inside and outside the network.

        - Testing to validate any segmentation and scope- reduction controls.

        - Application-layer penetration testing to identify, at a minimum, the vulnerabilities
        listed in Requirement 6.2.4.

        - Network-layer penetration tests that encompass all components that support
        network functions as well as operating systems.

        - Review and consideration of threats and vulnerabilities experienced in the
        last 12 months.

        - Documented approach to assessing and addressing the risk posed by exploitable
        vulnerabilities and security weaknesses found during penetration testing.

        - Retention of penetration testing results and remediation activities results
        for at least 12 months.'
      translations:
        fr:
          description: "Une m\xE9thodologie de test d'intrusion est d\xE9finie, document\xE9\
            e et mise en oeuvre par l'entit\xE9, et comprend :\n\u2022 Des approches\
            \ de test d'intrusion accept\xE9es par l'industrie.\n\u2022 Une couverture\
            \ de l'ensemble du p\xE9rim\xE8tre du CDE et des syst\xE8mes critiques.\n\
            \u2022 Des tests \xE0 la fois \xE0 l'int\xE9rieur et \xE0 l'ext\xE9rieur\
            \ du r\xE9seau.\n\u2022 Des tests pour valider les mesures de segmentation\
            \ et de r\xE9duction du p\xE9rim\xE8tre.\n\u2022 Des tests d'intrusion\
            \ de la couche application pour identifier, au minimum, les vuln\xE9rabilit\xE9\
            s r\xE9pertori\xE9es dans l'exigence 6.2.4.\n\u2022 Des tests d'intrusion\
            \ de la couche r\xE9seau qui englobent tous les composants prenant en\
            \ charge les fonctions r\xE9seau ainsi que les syst\xE8mes d'exploitation.\n\
            \u2022 L\u2019examen et la prise en compte des menaces et des vuln\xE9\
            rabilit\xE9s rencontr\xE9es au cours des 12 derniers mois.\n\u2022 Une\
            \ approche document\xE9e pour \xE9valuer et traiter le risque pos\xE9\
            \ par les vuln\xE9rabilit\xE9s exploitables et les faiblesses de s\xE9\
            curit\xE9 d\xE9tect\xE9es lors des tests d'intrusion.\n\u2022 La conservation\
            \ des r\xE9sultats des tests d'intrusion et des activit\xE9s de correction\
            \ pendant au moins 12 mois."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4
      ref_id: 11.4.2
      description: "Internal penetration testing is performed:\n- Per the entity\u2019\
        s defined methodology.\n- At least once every 12 months.\n- After any significant\
        \ infrastructure or application upgrade or change.\n- By a qualified internal\
        \ resource or qualified external third-party.\n- Organizational independence\
        \ of the tester exists (not required to be a QSA or ASV)."
      translations:
        fr:
          description: "Un test d'intrusion interne est effectu\xE9 :\n\u2022 Selon\
            \ la m\xE9thodologie d\xE9finie par l'entit\xE9,\n\u2022 Au moins une\
            \ fois tous les 12 mois.\n\u2022 Apr\xE8s toute mise \xE0 niveau ou modification\
            \ importante d'une infrastructure ou d'une application\n\u2022 Par une\
            \ ressource interne qualifi\xE9e ou un tiers externe qualifi\xE9\n\u2022\
            \ L'ind\xE9pendance organisationnelle du testeur existe (il n'est pas\
            \ n\xE9cessaire qu'il soit un QSA ou un ASV)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4
      ref_id: 11.4.3
      description: "External penetration testing is performed:\n- Per the entity\u2019\
        s defined methodology.\n- At least once every 12 months.\n- After any significant\
        \ infrastructure or application upgrade or change.\n- By a qualified internal\
        \ resource or qualified external third party.\n- Organizational independence\
        \ of the tester exists (not required to be a QSA or ASV)."
      translations:
        fr:
          description: "Un test d'intrusion externe est effectu\xE9 :\n\u2022 Selon\
            \ la m\xE9thodologie d\xE9finie par l'entit\xE9\n\u2022 Au moins une fois\
            \ tous les 12 mois.\n\u2022 Apr\xE8s toute mise \xE0 niveau ou modification\
            \ importante d'une infrastructure ou d'une application\n\u2022 Par une\
            \ ressource interne qualifi\xE9e ou un tiers externe qualifi\xE9\n\u2022\
            \ L'ind\xE9pendance organisationnelle du testeur existe (il n'est pas\
            \ n\xE9cessaire qu'il soit un QSA ou un ASV)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4
      ref_id: 11.4.4
      description: "Exploitable vulnerabilities and security weaknesses found during\
        \ penetration testing are corrected as follows:\n- In accordance with the\
        \ entity\u2019s assessment of the risk posed by the security issue as defined\
        \ in Requirement 6.3.1.\n- Penetration testing is repeated to verify the corrections."
      translations:
        fr:
          description: "Les vuln\xE9rabilit\xE9s exploitables et les faiblesses de\
            \ s\xE9curit\xE9 d\xE9tect\xE9es lors des tests d'intrusion sont corrig\xE9\
            es comme suit :\n\u2022 Conform\xE9ment \xE0 l'\xE9valuation par l'entit\xE9\
            \ du risque pos\xE9 par le probl\xE8me de s\xE9curit\xE9 tel que d\xE9\
            fini dans l'exigence 6.3.1.\n\u2022 Les tests d'intrusion sont r\xE9p\xE9\
            t\xE9s pour v\xE9rifier les corrections."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4
      ref_id: 11.4.5
      description: "If segmentation is used to isolate the CDE from other networks,\
        \ penetration tests are performed on segmentation controls as follows:\n-\
        \ At least once every 12 months and after any changes to segmentation controls/methods.\n\
        - Covering all segmentation controls/methods in use.\n- According to the entity\u2019\
        s defined penetration testing methodology.\n- Confirming that the segmentation\
        \ controls/methods are operational and effective, and isolate the CDE from\
        \ all out-of-scope systems.\n- Confirming effectiveness of any use of isolation\
        \ to separate systems with differing security levels (see Requirement 2.2.3).\n\
        - Performed by a qualified internal resource or qualified external third party.\n\
        - Organizational independence of the tester exists (not required to be a QSA\
        \ or ASV)."
      translations:
        fr:
          description: "Si la segmentation est utilis\xE9e pour isoler le CDE des\
            \ autres r\xE9seaux, des tests d'intrusion sont effectu\xE9s sur les mesures\
            \ de s\xE9curit\xE9 de segmentation comme suit :\n\u2022 Au moins une\
            \ fois tous les 12 mois et apr\xE8s toute modification des mesures ou\
            \ m\xE9thodes de segmentation\n\u2022 Couvrir toutes les mesures ou m\xE9\
            thodes de segmentation utilis\xE9e.\n\u2022 Conform\xE9ment \xE0 la m\xE9\
            thodologie des tests d'intrusion d\xE9finie par l'entit\xE9.\n\u2022 Confirmer\
            \ que les mesures ou m\xE9thodes de segmentation sont op\xE9rationnels\
            \ et efficaces, et isolent le CDE de tous les syst\xE8mes hors du p\xE9\
            rim\xE8tre.\n\u2022 Confirmer l'efficacit\xE9 de toute utilisation de\
            \ l'isolement pour s\xE9parer les syst\xE8mes avec des niveaux de s\xE9\
            curit\xE9 diff\xE9rents (voir l'exigence 2.2.3).\n\u2022 Effectu\xE9s\
            \ par une ressource interne qualifi\xE9e ou un tiers externe qualifi\xE9\
            \n\u2022 L'ind\xE9pendance organisationnelle du testeur existe (il n'est\
            \ pas n\xE9cessaire qu'il soit un QSA ou un ASV)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4
      ref_id: 11.4.6
      description: "Additional requirement for service providers only: If segmentation\
        \ is used to isolate the CDE from other networks, penetration tests are performed\
        \ on segmentation controls as follows:\n- At least once every six months and\
        \ after any changes to segmentation controls/methods.\n- Covering all segmentation\
        \ controls/methods in use.\n- According to the entity\u2019s defined penetration\
        \ testing methodology.\n- Confirming that the segmentation controls/methods\
        \ are operational and effective, and isolate the CDE from all out-of-scope\
        \ systems.\n- Confirming effectiveness of any use of isolation to separate\
        \ systems with differing security levels (see Requirement 2.2.3).\n- Performed\
        \ by a qualified internal resource or qualified external third party.\n- Organizational\
        \ independence of the tester exists (not required to be a QSA or ASV)."
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Si la segmentation est utilis\xE9e pour isoler le CDE des\
            \ autres r\xE9seaux, des tests d'intrusion sont effectu\xE9s sur les mesures\
            \ de s\xE9curit\xE9 de segmentation comme suit :\n\u2022 Au moins une\
            \ fois tous les six mois et apr\xE8s toute modification des mesures de\
            \ s\xE9curit\xE9 ou m\xE9thodes de segmentation\n\u2022 Couvrir tous les\
            \ mesures ou m\xE9thodes de segmentation utilis\xE9e.\n\u2022 Conform\xE9\
            ment \xE0 la m\xE9thodologie des tests d'intrusion d\xE9finie par l'entit\xE9\
            .\n\u2022 Confirmer que les mesures ou m\xE9thodes de segmentation sont\
            \ op\xE9rationnelles et efficaces, et isolent le CDE de tous les syst\xE8\
            mes hors du p\xE9rim\xE8tre.\n\u2022 Confirmer l'efficacit\xE9 de toute\
            \ utilisation de l'isolement pour s\xE9parer les syst\xE8mes avec des\
            \ niveaux de s\xE9curit\xE9 diff\xE9rents (voir l'exigence 2.2.3).\n\u2022\
            \ Effectu\xE9s par une ressource interne qualifi\xE9e ou un tiers externe\
            \ qualifi\xE9\n\u2022 L'ind\xE9pendance organisationnelle du testeur existe\
            \ (il n'est pas n\xE9cessaire qu'il soit un QSA ou un ASV)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.4
      ref_id: 11.4.7
      description: 'Additional requirement for multi-tenant service providers only:
        Multi-tenant service providers support their customers for external penetration
        testing per Requirement 11.4.3 and 11.4.4.'
      translations:
        fr:
          description: "Exigence suppl\xE9mentaire pour les prestataires de services\
            \ mutualis\xE9s uniquement : Les prestataires de services mutualis\xE9\
            s assistent leurs clients dans les tests d'intrusion externes conform\xE9\
            ment aux exigences 11.4.3 et 11.4.4."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.5
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11
      ref_id: '11.5'
      description: Network intrusions and unexpected file changes are detected and
        responded to.
      translations:
        fr:
          description: "Les intrusions r\xE9seau et les modifications impr\xE9vues\
            \ de fichiers sont d\xE9tect\xE9es et trait\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.5.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.5
      ref_id: 11.5.1
      description: 'Intrusion-detection and/or intrusion- prevention techniques are
        used to detect and/or prevent intrusions into the network as follows:

        - All traffic is monitored at the perimeter of the CDE.

        - All traffic is monitored at critical points in the CDE.

        - Personnel are alerted to suspected compromises.

        - All intrusion-detection and prevention engines, baselines, and signatures
        are kept up to date'
      translations:
        fr:
          description: "Les techniques de d\xE9tection des intrusions et/ou de pr\xE9\
            vention des intrusions sont utilis\xE9es pour d\xE9tecter et/ou emp\xEA\
            cher les intrusions dans le r\xE9seau comme suit :\n\u2022 Tout le trafic\
            \ est surveill\xE9 \xE0 la p\xE9riph\xE9rie du CDE.\n\u2022 Tout le trafic\
            \ est surveill\xE9 aux points critiques du CDE.\n\u2022 Le personnel est\
            \ alert\xE9 des suspicions de compromissions.\n\u2022 Tous les moteurs\
            \ de d\xE9tection et de pr\xE9vention des intrusions, les lignes de base\
            \ et les signatures sont tenus \xE0 jour."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.5.1.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.5.1
      ref_id: 11.5.1.1
      description: 'Additional requirement for service providers only: Intrusion-detection
        and/or intrusion-prevention techniques detect, alert

        on/prevent, and address covert malware communication channels.'
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Les techniques de d\xE9tection et/ou de pr\xE9vention des\
            \ intrusions d\xE9tectent, alertent/pr\xE9viennent et traitent les canaux\
            \ secrets de communication des logiciels malveillants."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.5.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.5
      ref_id: 11.5.2
      description: 'A change-detection mechanism (for example, file integrity monitoring
        tools) is deployed as follows:

        - To alert personnel to unauthorized modification (including changes, additions,
        and deletions) of critical files.

        - To perform critical file comparisons at least once weekly.'
      translations:
        fr:
          description: "Un m\xE9canisme de d\xE9tection des modifications (par exemple,\
            \ des outils de surveillance de l'int\xE9grit\xE9 des fichiers) est d\xE9\
            ploy\xE9 de la fa\xE7on suivante :\n\u2022 Pour alerter le personnel de\
            \ modifications non autoris\xE9es (y compris les modifications, les ajouts\
            \ et les suppressions) de fichiers critiques\n\u2022 Pour effectuer des\
            \ comparaisons de fichiers critiques au moins une fois par semaine."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.6
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11
      ref_id: '11.6'
      description: Unauthorized changes on payment pages are detected and responded
        to.
      translations:
        fr:
          description: "Les modifications non autoris\xE9es sur les pages de paiement\
            \ sont d\xE9tect\xE9es et trait\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:11.6.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:11.6
      ref_id: 11.6.1
      description: "A change- and tamper-detection mechanism is deployed as follows:\n\
        - To alert personnel to unauthorized modification (including indicators of\
        \ compromise, changes, additions, and deletions) to the HTTP headers and the\
        \ contents of payment pages as received by the consumer browser.\n- The mechanism\
        \ is configured to evaluate the received HTTP header and payment page.\n-\
        \ The mechanism functions are performed as follows:\n    \u2013 At least once\
        \ every seven days.\n    OR\n    \u2013 Periodically (at the frequency defined\
        \ in the entity\u2019s targeted risk analysis, which is performed according\
        \ to all elements specified in Requirement 12.3.1)."
      translations:
        fr:
          description: "Un m\xE9canisme de d\xE9tection des changements et des alt\xE9\
            rations est d\xE9ploy\xE9 de la mani\xE8re suivante :\n\u2022 Alerter\
            \ le personnel des modifications non autoris\xE9es (y compris les indicateurs\
            \ de compromission, de changements, d'ajouts et de suppressions) des en-t\xEA\
            tes HTTP et du contenu des pages de paiement comme re\xE7us par le navigateur\
            \ du consommateur.\n\u2022 Le m\xE9canisme est configur\xE9 pour \xE9\
            valuer l'en-t\xEAte HTTP et la page de paiement re\xE7us.\n\u2022 Les\
            \ fonctions des m\xE9canismes sont ex\xE9cut\xE9es comme suit :\n\u2013\
            \ Au moins une fois tous les sept jours\nOU\n\u2013 P\xE9riodiquement,\
            \ (\xE0 la fr\xE9quence d\xE9finie dans l'analyse de risques cibl\xE9\
            e de l'entit\xE9, qui est r\xE9alis\xE9e selon tous les \xE9l\xE9ments\
            \ sp\xE9cifi\xE9s dans l'exigence 12.3.1)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:maintain-an-information-security-policy
      assessable: false
      depth: 1
      name: Maintain an Information Security Policy
      translations:
        fr:
          name: "Maintenir une politique de s\xE9curit\xE9 de l\u2019information"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:maintain-an-information-security-policy
      ref_id: '12'
      name: Requirement 12
      description: Support Information Security with Organizational Policies and Programs
      translations:
        fr:
          name: Exigence 12
          description: "Appuyer la S\xE9curit\xE9 de l\u2019Information sur des Politiques\
            \ et des Programmes Organisationnels"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      ref_id: '12.1'
      description: "A comprehensive information security policy that governs and provides\
        \ direction for protection of the entity\u2019s information assets is known\
        \ and current."
      translations:
        fr:
          description: "Une politique compl\xE8te de s\xE9curit\xE9 de l'information\
            \ qui r\xE9git et fournit une orientation pour la protection des actifs\
            \ informationnels de l'entit\xE9 est connue et \xE0 jour."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.1
      ref_id: 12.1.1
      description: 'An overall information security policy is:

        - Established.

        - Published.

        - Maintained.

        - Disseminated to all relevant personnel, as well as to relevant vendors and
        business partners.'
      translations:
        fr:
          description: "Une politique globale de s\xE9curit\xE9 de l\u2019information\
            \ est :\n\u2022 \xC9tablie.\n\u2022 Publi\xE9e.\n\u2022 Maintenue.\n\u2022\
            \ Diffus\xE9e \xE0 tout le personnel concern\xE9, ainsi qu'aux fournisseurs\
            \ et partenaires commerciaux concern\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.1
      ref_id: 12.1.2
      description: 'The information security policy is:

        - Reviewed at least once every 12 months.

        - Updated as needed to reflect changes to business objectives or risks to
        the environment.'
      translations:
        fr:
          description: "La politique de s\xE9curit\xE9 de l\u2019information est :\n\
            \u2022 Examin\xE9e au moins une fois tous les 12 mois.\n\u2022 Mise \xE0\
            \ jour, si besoin, pour refl\xE9ter les modifications apport\xE9es aux\
            \ objectifs professionnels ou les risques pour l'environnement."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.1.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.1
      ref_id: 12.1.3
      description: The security policy clearly defines information security roles
        and responsibilities for all personnel, and all personnel are aware of and
        acknowledge their information security responsibilities.
      translations:
        fr:
          description: "La politique de s\xE9curit\xE9 d\xE9finit clairement les r\xF4\
            les et les responsabilit\xE9s en mati\xE8re de s\xE9curit\xE9 de l\u2019\
            information pour tout le personnel, et tout le personnel est conscient\
            \ et reconna\xEEt ses responsabilit\xE9s en mati\xE8re de s\xE9curit\xE9\
            \ de l\u2019information."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.1.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.1
      ref_id: 12.1.4
      description: Responsibility for information security is formally assigned to
        a Chief Information Security Officer or other information security knowledgeable
        member of executive management.
      translations:
        fr:
          description: "La responsabilit\xE9 de la s\xE9curit\xE9 de l'information\
            \ est officiellement attribu\xE9e \xE0 un responsable de la s\xE9curit\xE9\
            \ de l'information ou \xE0 un autre membre de la direction comp\xE9tent\
            \ en mati\xE8re de s\xE9curit\xE9 de l'information."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      ref_id: '12.2'
      description: Acceptable use policies for end-user technologies are defined and
        implemented.
      translations:
        fr:
          description: "Des politiques d'utilisation acceptable des technologies de\
            \ l'utilisateur final sont d\xE9finies et mises en oeuvre."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.2
      ref_id: 12.2.1
      description: 'Acceptable use policies for end-user technologies are documented
        and implemented, including:

        - Explicit approval by authorized parties.

        - Acceptable uses of the technology.

        - List of products approved by the company for employee use, including hardware
        and software.'
      translations:
        fr:
          description: "Des politiques d'utilisation acceptable pour les technologies\
            \ d'utilisateur final sont document\xE9es et mises en oeuvre, notamment\
            \ :\n\u2022 Une approbation expresse par les parties autoris\xE9es.\n\u2022\
            \ Des utilisations acceptables de la technologie.\n\u2022 Une liste de\
            \ produits approuv\xE9s par l'entreprise pour une utilisation par les\
            \ employ\xE9s, y compris le mat\xE9riel et les logiciels."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      ref_id: '12.3'
      description: Risks to the cardholder data environment are formally identified,
        evaluated, and managed.
      translations:
        fr:
          description: "Les risques pour l'environnement des donn\xE9es des titulaires\
            \ de cartes sont formellement identifi\xE9s, \xE9valu\xE9s et g\xE9r\xE9\
            s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.3
      ref_id: 12.3.1
      description: 'Each PCI DSS requirement that provides flexibility for how frequently
        it is performed (for example, requirements to be performed periodically) is
        supported by a targeted risk analysis that is documented and includes:

        - Identification of the assets being protected.

        - Identification of the threat(s) that the requirement is protecting against.

        - Identification of factors that contribute to the likelihood and/or impact
        of a threat being realized.

        - Resulting analysis that determines, and includes justification for, how
        frequently the requirement must be performed to minimize the likelihood of
        the threat being realized.

        - Review of each targeted risk analysis at least once every 12 months to determine
        whether the results are still valid or if an updated risk analysis is needed.

        - Performance of updated risk analyses when needed, as determined by the annual
        review.'
      translations:
        fr:
          description: "Chaque exigence du standard PCI DSS qui offre une flexibilit\xE9\
            \ quant \xE0 la fr\xE9quence d'ex\xE9cution (par exemple, les exigences\
            \ \xE0 ex\xE9cuter p\xE9riodiquement) est soutenue par une analyse de\
            \ risque cibl\xE9e qui est document\xE9e et comprend :\n\u2022 L'identification\
            \ des actifs \xE0 prot\xE9ger.\n\u2022 L'identification de la ou des menaces\
            \ contre lesquelles l'exigence prot\xE8ge.\n\u2022 L'identification des\
            \ facteurs qui contribuent \xE0 la probabilit\xE9 et/ou \xE0 l'impact\
            \ d'une menace.\n\u2022 L'analyse r\xE9sultante qui d\xE9termine et inclut\
            \ la justification de la fr\xE9quence \xE0 laquelle l'exigence doit \xEA\
            tre ex\xE9cut\xE9e afin de minimiser la probabilit\xE9 que la menace se\
            \ mat\xE9rialise.\n\u2022 L'examen de chaque analyse de risque cibl\xE9\
            e au moins une fois tous les 12 mois afin de d\xE9terminer si les r\xE9\
            sultats sont toujours valides ou si une analyse de risque mise \xE0 jour\
            \ est n\xE9cessaire.\n\u2022 La r\xE9alisation d'analyses de risques mises\
            \ \xE0 jour au besoin, tel que d\xE9termin\xE9 par l'examen annuel."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.3
      ref_id: 12.3.2
      description: 'A targeted risk analysis is performed for each PCI DSS requirement
        that the entity meets with the customized approach, to include:

        - Documented evidence detailing each element specified in Appendix D: Customized
        Approach (including, at a minimum, a controls matrix and risk analysis).

        - Approval of documented evidence by senior management.

        - Performance of the targeted analysis of risk at least once every 12 months.'
      translations:
        fr:
          description: "Une analyse de risque cibl\xE9e est effectu\xE9e pour chaque\
            \ exigence du standard PCI DSS que l'entit\xE9 satisfait \xE0 l'approche\
            \ personnalis\xE9e, pour inclure :\n\u2022 Une preuve document\xE9e d\xE9\
            taillant chaque \xE9l\xE9ment sp\xE9cifi\xE9 \xE0 l'annexe D : Une approche\
            \ personnalis\xE9e (incluant, au minimum, une matrice de mesures de s\xE9\
            curit\xE9 et une analyse de risques).\n\u2022 Une approbation des preuves\
            \ document\xE9es par la haute direction.\n\u2022 Une r\xE9alisation de\
            \ l'analyse de risque cibl\xE9e au moins une fois tous les 12 mois."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.3.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.3
      ref_id: 12.3.3
      description: 'Cryptographic cipher suites and protocols in use are documented
        and reviewed at least once every 12 months, including at least the following:

        - An up-to-date inventory of all cryptographic cipher suites and protocols
        in use, including purpose and where used.

        - Active monitoring of industry trends regarding continued viability of all
        cryptographic cipher suites and protocols in use.

        - A documented strategy to respond to anticipated changes in cryptographic
        vulnerabilities.'
      translations:
        fr:
          description: "Les suites de chiffrement cryptographiques et les protocoles\
            \ utilis\xE9s sont document\xE9s et examin\xE9s au moins une fois tous\
            \ les 12 mois, y compris au moins les \xE9l\xE9ments suivants :\n\u2022\
            \ Un inventaire tenu \xE0 jour de toutes les suites et protocoles de chiffrement\
            \ cryptographiques utilis\xE9s, y compris le but et le lieu d'utilisation.\n\
            \u2022 Une surveillance active des tendances de l'industrie concernant\
            \ la viabilit\xE9 continue de toutes les suites et protocoles de chiffrement\
            \ cryptographiques utilis\xE9s.\n\u2022 Une strat\xE9gie document\xE9\
            e pour r\xE9pondre aux changements anticip\xE9s des vuln\xE9rabilit\xE9\
            s cryptographiques."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.3.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.3
      ref_id: 12.3.4
      description: "Hardware and software technologies in use are reviewed at least\
        \ once every 12 months, including at least the following:\n\u2022 Analysis\
        \ that the technologies continue to receive security fixes from vendors promptly.\n\
        \u2022 Analysis that the technologies continue to support (and do not preclude)\
        \ the entity\u2019s PCI DSS compliance.\n\u2022 Documentation of any industry\
        \ announcements or trends related to a technology, such as when a vendor has\
        \ announced \u201Cend of life\u201D plans for a technology.\n\u2022 Documentation\
        \ of a plan, approved by senior management, to remediate outdated technologies,\
        \ including those for which vendors have announced \u201Cend of life\u201D\
        \ plans."
      translations:
        fr:
          description: "Les technologies mat\xE9rielles et logicielles utilis\xE9\
            es sont examin\xE9es au moins une fois tous les 12 mois, en incluant au\
            \ moins les \xE9l\xE9ments suivants :\n\u2022 Une analyse d\xE9montrant\
            \ que les technologies continuent de recevoir rapidement des correctifs\
            \ de s\xE9curit\xE9 des fournisseurs.\n\u2022 Une analyse d\xE9montrant\
            \ que les technologies continuent de prendre en charge (et n'emp\xEAchent\
            \ pas) la conformit\xE9 au standard PCI DSS de l'entit\xE9.\n\u2022 Une\
            \ documentation de toute annonce ou tendance de l'industrie li\xE9e \xE0\
            \ une technologie ; par exemple, lorsqu'un fournisseur annonce des plans\
            \ de \xAB fin de vie \xBB pour une technologie.\n\u2022 La documentation\
            \ d'un plan, approuv\xE9 par la haute direction, pour traiter les technologies\
            \ obsol\xE8tes, y compris celles pour lesquelles les fournisseurs ont\
            \ annonc\xE9 des plans de \xAB fin de vie \xBB."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      ref_id: '12.4'
      description: PCI DSS compliance is managed.
      translations:
        fr:
          description: "La conformit\xE9 au standard PCI DSS est g\xE9r\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.4.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.4
      ref_id: 12.4.1
      description: 'Additional requirement for service providers only: Responsibility
        is established by executive management for the protection of cardholder data
        and a PCI DSS compliance program to include:

        - Overall accountability for maintaining PCI DSS compliance.

        - Defining a charter for a PCI DSS compliance program and communication to
        executive management.'
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : La responsabilit\xE9 est \xE9tablie par la direction g\xE9\
            n\xE9rale pour la protection des donn\xE9es des titulaires de cartes et\
            \ un programme de conformit\xE9 PCI DSS incluant :\n\u2022 Responsabilit\xE9\
            \ globale pour le maintien de la conformit\xE9 PCI DSS.\n\u2022 D\xE9\
            finition d'une charte pour un programme de conformit\xE9 PCI DSS et sa\
            \ communication \xE0 la direction g\xE9n\xE9rale."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.4.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.4
      ref_id: 12.4.2
      description: "Additional requirement for service providers only: Reviews are\
        \ performed at least once every three months to confirm that personnel are\
        \ performing their tasks in accordance with all security policies and operational\
        \ procedures. \nReviews are performed by personnel other than those responsible\
        \ for performing the given task and include, but are not limited to, the following\
        \ tasks:\n- Daily log reviews.\n- Configuration reviews for network security\
        \ controls.\n- Applying configuration standards to new systems.\n- Responding\
        \ to security alerts.\n- Change-management processes."
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Des revues sont effectu\xE9es au moins une fois tous les\
            \ trois mois, par du personnel autre que ceux responsables de l'ex\xE9\
            cution de la t\xE2che donn\xE9e afin de confirmer que le personnel ex\xE9\
            cute ses t\xE2ches, conform\xE9ment \xE0 toutes les politiques de s\xE9\
            curit\xE9 et \xE0 toutes les proc\xE9dures op\xE9rationnelles, y compris,\
            \ sans toutefois s'y limiter, les t\xE2ches suivantes :\n\u2022 Examens\
            \ quotidiens des journaux.\n\u2022 Examens des configurations pour les\
            \ mesures de s\xE9curit\xE9 r\xE9seau.\n\u2022 Application des standards\
            \ de configuration aux nouveaux syst\xE8mes.\n\u2022 R\xE9ponse aux alertes\
            \ de s\xE9curit\xE9.\n\u2022 Processus de gestion des changements."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.4.2.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.4.2
      ref_id: 12.4.2.1
      description: 'Additional requirement for service providers only: Reviews conducted
        in accordance with Requirement 12.4.2 are documented to include:

        - Results of the reviews.

        - Documented remediation actions taken for any tasks that were found to not
        be performed at Requirement 12.4.2.

        - Review and sign-off of results by personnel assigned responsibility for
        the PCI DSS compliance program.'
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Les revues effectu\xE9es conform\xE9ment \xE0 l'exigence\
            \ 12.4.2 sont document\xE9es pour inclure :\n\u2022 Les r\xE9sultats des\
            \ revues.\n\u2022 La documentation des mesures correctives prises pour\
            \ toutes les t\xE2ches qui se sont av\xE9r\xE9es non ex\xE9cut\xE9es \xE0\
            \ l'exigence 12.4.2.\n\u2022 Revue et approbation des r\xE9sultats par\
            \ le personnel affect\xE9 \xE0 la responsabilit\xE9 du programme de conformit\xE9\
            \ PCI DSS."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.5
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      ref_id: '12.5'
      description: PCI DSS scope is documented and validated.
      translations:
        fr:
          description: "Le p\xE9rim\xE8tre du standard PCI DSS est document\xE9e et\
            \ valid\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.5.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.5
      ref_id: 12.5.1
      description: An inventory of system components that are in scope for PCI DSS,
        including a description of function/use, is maintained and kept current.
      translations:
        fr:
          description: "Un inventaire des composants syst\xE8me qui sont dans le p\xE9\
            rim\xE8tre PCI DSS, incluant une description de la fonction ou de l'utilisation,\
            \ est maintenu et tenu \xE0 jour."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.5.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.5
      ref_id: 12.5.2
      description: 'PCI DSS scope is documented and confirmed by the entity at least
        once every 12 months and upon significant change to the in-scope environment.
        At a minimum, the scoping validation includes:

        - Identifying all data flows for the various payment stages (for example,
        authorization, capture settlement, chargebacks, and refunds) and acceptance
        channels (for example, card-present, card-not-present, and e-commerce).

        - Updating all data-flow diagrams per Requirement 1.2.4.

        - Identifying all locations where account data is stored, processed, and transmitted,
        including but not limited to: 1) any locations outside of the currently defined
        CDE, 2) applications that process CHD, 3) transmissions between systems and
        networks, and 4) file backups.

        - Identifying all system components in the CDE, connected to the CDE, or that
        could impact security of the CDE.

        - Identifying all segmentation controls in use and the environment(s) from
        which the CDE is segmented, including justification for environments being
        out of scope.

        - Identifying all connections from third-party entities with access to the
        CDE.

        - Confirming that all identified data flows, account data, system components,
        segmentation controls, and connections from third parties with access to the
        CDE are included in scope.'
      translations:
        fr:
          description: "Le p\xE9rim\xE8tre soumis au standard PCI DSS est document\xE9\
            \ et confirm\xE9 par l'entit\xE9 au moins une fois tous les 12 mois et\
            \ en cas de modification importante de l'environnement dans le p\xE9rim\xE8\
            tre. Au minimum, la validation du p\xE9rim\xE8tre comprend :\n\u2022 L\u2019\
            identification tous les flux de donn\xE9es pour les diff\xE9rentes \xE9\
            tapes de paiement (par exemple, l'autorisation, la capture des r\xE8glements,\
            \ les r\xE9trofacturations et les remboursements) et les canaux d'acceptation\
            \ (par exemple, la carte pr\xE9sente, la carte non pr\xE9sente et le commerce\
            \ \xE9lectronique).\n\u2022 La mise \xE0 jour tous les diagrammes de flux\
            \ de donn\xE9es conform\xE9ment \xE0 l'exigence 1.2.4.\n\u2022 L\u2019\
            identification de tous les emplacements o\xF9 les donn\xE9es de carte\
            \ sont stock\xE9es, trait\xE9es et transmises, y compris, sans toutefois\
            \ s'y limiter : 1) tous les emplacements en dehors du CDE actuellement\
            \ d\xE9fini, 2) les applications qui traitent les CHD, 3) les transmissions\
            \ entre les syst\xE8mes et les r\xE9seaux, et 4) les sauvegardes de fichiers.\n\
            \u2022 L\u2019identification de tous les composants syst\xE8me dans le\
            \ CDE, connect\xE9s au CDE, ou qui pourraient avoir une incidence sur\
            \ la s\xE9curit\xE9 du CDE.\n\u2022 L\u2019identification de tous les\
            \ mesures de segmentation utilis\xE9e et le ou les environnements \xE0\
            \ partir desquels le CDE est segment\xE9, y compris la justification des\
            \ environnements hors de port\xE9e.\n\u2022 L\u2019identification de toutes\
            \ les connexions d'entit\xE9s tierces ayant acc\xE8s au CDE.\n\u2022 La\
            \ confirmation que tous les flux de donn\xE9es identifi\xE9s, les donn\xE9\
            es de carte, les composants syst\xE8me, les mesures de segmentation et\
            \ les connexions de tiers ayant acc\xE8s au CDE sont inclus dans le p\xE9\
            rim\xE8tre."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.5.2.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.5.2
      ref_id: 12.5.2.1
      description: 'Additional requirement for service providers only: PCI DSS scope
        is documented and confirmed by the entity at least once every six months and
        upon significant change to the in-scope environment. At a minimum, the scoping
        validation includes all the elements specified in Requirement 12.5.2.'
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Le p\xE9rim\xE8tre PCI DSS est document\xE9 et confirm\xE9\
            \ par l'entit\xE9 au moins une fois tous les 6 mois et en cas de modification\
            \ importante de l'environnement dans le p\xE9rim\xE8tre. Au minimum, la\
            \ validation du p\xE9rim\xE8tre comprend tous les \xE9l\xE9ments sp\xE9\
            cifi\xE9s dans l'exigence 12.5.2."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.5.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.5
      ref_id: 12.5.3
      description: 'Additional requirement for service providers only: Significant
        changes to organizational structure result in a documented (internal) review
        of the impact to PCI DSS scope and applicability of controls, with results
        communicated to executive management.'
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Les modifications importantes apport\xE9es \xE0 la structure\
            \ de l'entreprise entra\xEEnent un examen document\xE9 (interne) de l'impact\
            \ sur le p\xE9rim\xE8tre PCI DSS et l'applicabilit\xE9 des mesures de\
            \ s\xE9curit\xE9, les r\xE9sultats \xE9tant communiqu\xE9s \xE0 la direction\
            \ g\xE9n\xE9rale."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      ref_id: '12.6'
      description: Security awareness education is an ongoing activity.
      translations:
        fr:
          description: "La sensibilisation \xE0 la s\xE9curit\xE9 est une activit\xE9\
            \ continue."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6
      ref_id: 12.6.1
      description: "A formal security awareness program is implemented to make all\
        \ personnel aware of the entity\u2019s information security policy and procedures,\
        \ and their role in protecting the cardholder data."
      translations:
        fr:
          description: "Un programme formel de sensibilisation \xE0 la s\xE9curit\xE9\
            \ est mis en oeuvre pour informer tout le personnel de la politique et\
            \ des proc\xE9dures de s\xE9curit\xE9 des informations de l'entit\xE9\
            , ainsi que de son r\xF4le dans la protection des donn\xE9es des titulaires\
            \ de cartes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6
      ref_id: 12.6.2
      description: "The security awareness program is:\n- Reviewed at least once every\
        \ 12 months, and\n- Updated as needed to address any new threats and vulnerabilities\
        \ that may impact the security of the entity\u2019s CDE, or the information\
        \ provided to personnel about their role in protecting cardholder data."
      translations:
        fr:
          description: "Le programme de sensibilisation \xE0 la s\xE9curit\xE9 est\
            \ :\n\u2022 Revu au moins une fois tous les 12 mois.\n\u2022 Mis \xE0\
            \ jour si n\xE9cessaire pour prendre en compte toute nouvelle menace et\
            \ vuln\xE9rabilit\xE9 susceptible d'avoir une incidence sur la s\xE9curit\xE9\
            \ du CDE de l'entit\xE9, ou les informations fournies au personnel concernant\
            \ son r\xF4le dans la protection des donn\xE9es des porteurs de cartes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6
      ref_id: 12.6.3
      description: 'Personnel receive security awareness training as follows:

        - Upon hire and at least once every 12 months.

        - Multiple methods of communication are used.

        - Personnel acknowledge at least once every 12 months that they have read
        and understood the information security policy and procedures.'
      translations:
        fr:
          description: "Le personnel re\xE7oit une formation de sensibilisation \xE0\
            \ la s\xE9curit\xE9 comme suit :\n\u2022 \xC0 l'embauche et au moins une\
            \ fois tous les 12 mois.\n\u2022 Plusieurs m\xE9thodes de communication\
            \ sont utilis\xE9es.\n\u2022 Le personnel confirme au moins une fois tous\
            \ les 12 mois avoir lu et compris la politique et les proc\xE9dures de\
            \ s\xE9curit\xE9 des informations."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6.3.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6.3
      ref_id: 12.6.3.1
      description: 'Security awareness training includes awareness of threats and
        vulnerabilities that could impact the security of the CDE, including but not
        limited to:

        - Phishing and related attacks.

        - Social engineering.'
      translations:
        fr:
          description: "La formation de sensibilisation \xE0 la s\xE9curit\xE9 comprend\
            \ la sensibilisation aux menaces et aux vuln\xE9rabilit\xE9s qui pourraient\
            \ avoir un impact sur la s\xE9curit\xE9 du CDE, y compris, sans toutefois\
            \ s'y limiter :\n\u2022 L\u2019hame\xE7onnage et attaques associ\xE9es.\n\
            \u2022 L\u2019ing\xE9nierie sociale."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6.3.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.6.3
      ref_id: 12.6.3.2
      description: Security awareness training includes awareness about the acceptable
        use of end-user technologies in accordance with Requirement 12.2.1.
      translations:
        fr:
          description: "La formation de sensibilisation \xE0 la s\xE9curit\xE9 comporte\
            \ la sensibilisation \xE0 l'utilisation acceptable des technologies de\
            \ l'utilisateur final conform\xE9ment \xE0 l'exigence 12.2.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.7
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      ref_id: '12.7'
      description: Personnel are screened to reduce risks from insider threats.
      translations:
        fr:
          description: "Le personnel est contr\xF4l\xE9 afin de r\xE9duire les risques\
            \ d\u2019attaques internes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.7.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.7
      ref_id: 12.7.1
      description: Potential personnel who will have access to the CDE are screened,
        within the constraints of local laws, prior to hire to minimize the risk of
        attacks from internal sources
      translations:
        fr:
          description: "Le candidat \xE0 l\u2019embauche qui aura acc\xE8s au CDE\
            \ fait l\u2019objet d\u2019une v\xE9rification des ant\xE9c\xE9dents,\
            \ dans les limites des lois locales, avant l'embauche afin de minimiser\
            \ le risque d'attaques provenant de sources internes."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      ref_id: '12.8'
      description: Risk to information assets associated with third-party service
        provider (TPSP) relationships is managed.
      translations:
        fr:
          description: "Le risque pour les fonds documentaires associ\xE9s aux relations\
            \ avec les prestataires de services tiers (TPSP) est g\xE9r\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8
      ref_id: 12.8.1
      description: A list of all third-party service providers (TPSPs) with which
        account data is shared or that could affect the security of account data is
        maintained, including a description for each of the services provided.
      translations:
        fr:
          description: "Une liste de tous les prestataires de services tiers (TPSP)\
            \ avec lesquels les donn\xE9es de carte sont partag\xE9es ou qui pourraient\
            \ affecter la s\xE9curit\xE9 des donn\xE9es de carte, comprenant une description\
            \ pour chacun des services fournis est maintenue."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8
      ref_id: 12.8.2
      description: "Written agreements with TPSPs are maintained as follows:\n- Written\
        \ agreements are maintained with all TPSPs with which account data is shared\
        \ or that could affect the security of the CDE.\n- Written agreements include\
        \ acknowledgments from TPSPs that they are responsible for the security of\
        \ account data the TPSPs possess or otherwise store, process, or transmit\
        \ on behalf of the entity, or to the extent that they could impact the security\
        \ of the entity\u2019s CDE."
      translations:
        fr:
          description: "Les accords \xE9crits avec les TPSP sont maintenus comme suit\
            \ :\n\u2022 Des accords \xE9crits sont maintenus avec tous les TPSP avec\
            \ lesquels les donn\xE9es de carte sont partag\xE9es ou qui pourraient\
            \ avoir une incidence la s\xE9curit\xE9 du CDE.\n\u2022 Les accords \xE9\
            crits comprennent des reconnaissances des TPSP qu'ils sont responsables\
            \ de la s\xE9curit\xE9 des donn\xE9es de carte que les TPSP poss\xE8dent\
            \ ou autrement stockent, traitent ou transmettent au nom de l'entit\xE9\
            , ou dans la mesure o\xF9 ils pourraient avoir un impact sur la s\xE9\
            curit\xE9 du CDE de l'entit\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8
      ref_id: 12.8.3
      description: An established process is implemented for engaging TPSPs, including
        proper due diligence prior to engagement.
      translations:
        fr:
          description: "Un processus \xE9tabli est mis en oeuvre pour engager les\
            \ TPSP, y compris des mesures de s\xE9curit\xE9 pr\xE9alables appropri\xE9\
            s avant l'engagement."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8
      ref_id: 12.8.4
      description: "A program is implemented to monitor TPSPs\u2019 PCI DSS compliance\
        \ status at least once every 12 months."
      translations:
        fr:
          description: "Un programme est mis en oeuvre pour surveiller l'\xE9tat de\
            \ conformit\xE9 au standard PCI DSS des TPSP au moins une fois tous les\
            \ 12 mois."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.8
      ref_id: 12.8.5
      description: Information is maintained about which PCI DSS requirements are
        managed by each TPSP, which are managed by the entity, and any that are shared
        between the TPSP and the entity.
      translations:
        fr:
          description: "Des informations sont conserv\xE9es sur les exigences du standard\
            \ PCI DSS qui sont g\xE9r\xE9es par chaque TPSP, celles qui sont g\xE9\
            r\xE9es par l'entit\xE9 et celles qui sont partag\xE9es entre le TPSP\
            \ et l'entit\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.9
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      ref_id: '12.9'
      description: "Third-party service providers (TPSPs) support their customers\u2019\
        \ PCI DSS compliance."
      translations:
        fr:
          description: "Les prestataires de services tiers (TPSP) prennent en charge\
            \ la conformit\xE9 du standard PCI DSS de leurs clients."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.9.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.9
      ref_id: 12.9.1
      description: "Additional requirement for service providers only: TPSPs acknowledge\
        \ in writing to customers that they are responsible for the security of account\
        \ data the TPSP possesses or otherwise stores, processes, or transmits on\
        \ behalf of the customer, or to the extent that they could impact the security\
        \ of the customer\u2019s CDE."
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Les TPSP confirment par \xE9crit aux clients qu'ils sont\
            \ responsables de la s\xE9curit\xE9 des donn\xE9es de carte que le TPSP\
            \ poss\xE8de ou autrement stocke, traite ou transmet au nom du consommateur,\
            \ ou dans la mesure o\xF9 ils pourraient avoir un impact sur la s\xE9\
            curit\xE9 du CDE du consommateur."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.9.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.9
      ref_id: 12.9.2
      description: "Additional requirement for service providers only: TPSPs support\
        \ their customers\u2019 requests for information to meet Requirements 12.8.4\
        \ and 12.8.5 by providing the following upon customer request:\n- PCI DSS\
        \ compliance status information for any service the TPSP performs on behalf\
        \ of customers (Requirement 12.8.4).\n- Information about which PCI DSS requirements\
        \ are the responsibility of the TPSP and which are the responsibility of the\
        \ customer, including any shared responsibilities (Requirement 12.8.5)"
      translations:
        fr:
          description: "Exigences suppl\xE9mentaires pour les prestataires de services\
            \ uniquement : Les TPSP prennent en charge les demandes d'informations\
            \ de leurs clients pour r\xE9pondre aux exigences 12.8.4 et 12.8.5 en\
            \ fournissant, \xE0 la demande du consommateur, ce qui suit :\n\u2022\
            \ Des informations sur l'\xE9tat de conformit\xE9 au standard PCI DSS\
            \ pour tout service que le TPSP effectue pour le compte des clients (exigence\
            \ 12.8.4).\n\u2022 Des informations sur les exigences du standard PCI\
            \ DSS qui rel\xE8vent de la responsabilit\xE9 du TPSP et celles qui rel\xE8\
            vent de la responsabilit\xE9 du consommateur, y compris toute responsabilit\xE9\
            \ partag\xE9e (exigence 12.8.5)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12
      ref_id: '12.10'
      description: Suspected and confirmed security incidents that could impact the
        CDE are responded to immediately.
      translations:
        fr:
          description: "Les incidents de s\xE9curit\xE9 soup\xE7onn\xE9s et confirm\xE9\
            s qui pourraient avoir un impact sur le CDE sont trait\xE9s imm\xE9diatement."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10
      ref_id: 12.10.1
      description: 'An incident response plan exists and is ready to be activated
        in the event of a suspected or confirmed security incident. The plan includes,
        but is not limited to:

        - Roles, responsibilities, and communication and contact strategies in the
        event of a suspected or confirmed security incident, including notification
        of payment brands and acquirers, at a minimum.

        - Incident response procedures with specific containment and mitigation activities
        for different types of incidents.

        - Business recovery and continuity procedures.

        - Data backup processes.

        - Analysis of legal requirements for reporting compromises.

        - Coverage and responses of all critical system components.

        - Reference or inclusion of incident response procedures from the payment
        brands.'
      translations:
        fr:
          description: "Un plan de r\xE9ponse aux incidents existe et est pr\xEAt\
            \ \xE0 \xEAtre activ\xE9 en cas d'incident de s\xE9curit\xE9 soup\xE7\
            onn\xE9 ou av\xE9r\xE9. Le plan comprend, mais n'est pas limit\xE9 \xE0\
            \ :\n\u2022 Les r\xF4les, responsabilit\xE9s et strat\xE9gies de communication\
            \ et de contact en cas d'incident de s\xE9curit\xE9 soup\xE7onn\xE9 ou\
            \ av\xE9r\xE9, y compris la notification des marques de cartes de paiement\
            \ et des acqu\xE9reurs, au minimum.\n\u2022 Les proc\xE9dures de r\xE9\
            ponse aux incidents avec des activit\xE9s de confinement et d'att\xE9\
            nuation sp\xE9cifiques pour diff\xE9rents types d'incidents.\n\u2022 Les\
            \ proc\xE9dures de reprise et de continuit\xE9 de l'activit\xE9.\n\u2022\
            \ Les processus de sauvegarde des donn\xE9es.\n\u2022 L'analyse des exigences\
            \ l\xE9gales en mati\xE8re de signalement des compromissions.\n\u2022\
            \ La couverture et les r\xE9ponses de tous les composants critiques du\
            \ syst\xE8me.\n\u2022 La r\xE9f\xE9rence ou l'inclusion des proc\xE9dures\
            \ de r\xE9ponse aux incidents des marques de carte paiement."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10
      ref_id: 12.10.2
      description: 'At least once every 12 months, the security incident response
        plan is:

        - Reviewed and the content is updated as needed.

        - Tested, including all elements listed in Requirement 12.10.1.'
      translations:
        fr:
          description: "Au moins une fois tous les 12 mois, le plan de r\xE9ponse\
            \ aux incidents de s\xE9curit\xE9 est :\n\u2022 Revu et le contenu est\
            \ mis \xE0 jour si besoin.\n\u2022 Test\xE9, en incluant tous les \xE9\
            l\xE9ments \xE9num\xE9r\xE9s \xE0 l'exigence 12.10.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10
      ref_id: 12.10.3
      description: Specific personnel are designated to be available on a 24/7 basis
        to respond to suspected or confirmed security incidents.
      translations:
        fr:
          description: "Du personnel sp\xE9cifique est d\xE9sign\xE9 pour \xEAtre\
            \ disponible 24h/24 et 7j/7 pour r\xE9pondre aux incidents de s\xE9curit\xE9\
            \ soup\xE7onn\xE9s ou av\xE9r\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10
      ref_id: 12.10.4
      description: Personnel responsible for responding to suspected and confirmed
        security incidents are appropriately and periodically trained on their incident
        response responsibilities.
      translations:
        fr:
          description: "Le personnel charg\xE9 de r\xE9pondre aux incidents de s\xE9\
            curit\xE9 soup\xE7onn\xE9s et av\xE9r\xE9s est form\xE9 de mani\xE8re\
            \ appropri\xE9e et p\xE9riodique sur ses responsabilit\xE9s en mati\xE8\
            re de r\xE9ponse aux incidents."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10.4.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10.4
      ref_id: 12.10.4.1
      description: "The frequency of periodic training for incident response personnel\
        \ is defined in the entity\u2019s targeted risk analysis, which is performed\
        \ according to all elements specified in Requirement 12.3.1."
      translations:
        fr:
          description: "La fr\xE9quence des formations p\xE9riodiques pour le personnel\
            \ d'intervention en cas d'incident est d\xE9finie dans l'analyse de risque\
            \ cibl\xE9e de l'entit\xE9, qui est effectu\xE9e conform\xE9ment \xE0\
            \ tous les \xE9l\xE9ments sp\xE9cifi\xE9s dans l'exigence 12.3.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10
      ref_id: 12.10.5
      description: 'The security incident response plan includes monitoring and responding
        to alerts from security monitoring systems, including but not limited to:

        - Intrusion-detection and intrusion-prevention systems.

        - Network security controls.

        - Change-detection mechanisms for critical files.

        - The change-and tamper-detection mechanism for payment pages. This bullet
        is a best practice until its effective date; refer to Applicability Notes
        below for details.

        - Detection of unauthorized wireless access points.'
      translations:
        fr:
          description: "Le plan de r\xE9ponse aux incidents de s\xE9curit\xE9 comprend\
            \ la surveillance et la r\xE9ponse aux alertes des syst\xE8mes de surveillance\
            \ de la s\xE9curit\xE9, y compris, sans toutefois s'y limiter :\n\u2022\
            \ Syst\xE8mes de d\xE9tection et de pr\xE9vention des intrusions.\n\u2022\
            \ M\xE9canismes de s\xE9curit\xE9 r\xE9seau.\n\u2022 M\xE9canismes de\
            \ d\xE9tection des modifications pour les fichiers critiques.\n\u2022\
            \ M\xE9canisme de d\xE9tection des modifications et des alt\xE9rations\
            \ pour les pages de paiement. Ce point est une Bonne Pratique jusqu'\xE0\
            \ sa date d'entr\xE9e en vigueur ; se r\xE9f\xE9rer aux Notes D\u2019\
            applicabilit\xE9 ci-dessous pour plus de d\xE9tails.\n\u2022 D\xE9tection\
            \ des points d'acc\xE8s sans fil non autoris\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10
      ref_id: 12.10.6
      description: The security incident response plan is modified and evolved according
        to lessons learned and to incorporate industry developments.
      translations:
        fr:
          description: "Le plan de r\xE9ponse aux incidents de s\xE9curit\xE9 est\
            \ modifi\xE9 et mis \xE0 niveau en fonction des le\xE7ons apprises et\
            \ pour int\xE9grer les d\xE9veloppements de l'industrie."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10.7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:12.10
      ref_id: 12.10.7
      description: 'Incident response procedures are in place, to be initiated upon
        the detection of stored PAN anywhere it is not expected, and include:

        - Determining what to do if PAN is discovered outside the CDE, including its
        retrieval, secure deletion, and/or migration into the currently defined CDE,
        as applicable.

        - Identifying whether sensitive authentication data is stored with PAN.

        - Determining where the account data came from and how it ended up where it
        was not expected.

        - Remediating data leaks or process gaps that resulted in the account data
        being where it was not expected.'
      translations:
        fr:
          description: "Des proc\xE9dures d'intervention en cas d'incident sont en\
            \ place, \xE0 d\xE9clencher d\xE8s la d\xE9tection de PAN stock\xE9s l\xE0\
            \ o\xF9 \xE7a n'est pas pr\xE9vu, et inclue :\n\u2022 D\xE9terminer ce\
            \ qu'il faut faire si les PAN sont d\xE9couverts en dehors du CDE, y compris\
            \ leur r\xE9cup\xE9ration, sa suppression s\xE9curis\xE9e et/ou sa migration\
            \ vers le CDE actuellement d\xE9fini, selon le cas.\n\u2022 Identifier\
            \ si des donn\xE9es d'authentification sensibles sont stock\xE9es avec\
            \ les PAN.\n\u2022 D\xE9terminer d'o\xF9 proviennent les donn\xE9es de\
            \ carte et comment elles se sont retrouv\xE9es l\xE0 o\xF9 elles n'\xE9\
            taient pas pr\xE9vues.\n\u2022 Corriger les fuites de donn\xE9es ou les\
            \ lacunes des processus qui ont fait que les donn\xE9es de carte se trouvaient\
            \ l\xE0 o\xF9 elles n'\xE9taient pas pr\xE9vues."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a
      assessable: false
      depth: 1
      ref_id: A
      name: Appendix A
      description: Additional PCI DSS Requirements
      translations:
        fr:
          name: Annexe A
          description: "Exigences PCI DSS suppl\xE9mentaires"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a
      ref_id: A1
      name: Appendix A1
      description: Additional PCI DSS Requirements for Multi-Tenant Service Providers
      translations:
        fr:
          name: Annexe A1
          description: "Exigences PCI DSS suppl\xE9mentaires pour les fournisseurs\
            \ de services mutualis\xE9s"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a1
      ref_id: A1.1
      description: Multi-tenant service providers protect and separate all customer
        environments and data.
      translations:
        fr:
          description: "Les fournisseurs de services mutualis\xE9s prot\xE8gent et\
            \ s\xE9parent logiquement les environnements de chaque client afin d\u2019\
            \xE9viter les fuites de donn\xE9es ou les acc\xE8s non autoris\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.1
      ref_id: A1.1.1
      description: "Logical separation is implemented as follows:\n- The provider\
        \ cannot access its customers\u2019 environments without authorization.\n\
        - Customers cannot access the provider\u2019s environment without authorization."
      translations:
        fr:
          description: "La s\xE9paration logique est mise en \u0153uvre selon les\
            \ principes suivants :\n\u2022 Le fournisseur ne peut pas acc\xE9der aux\
            \ environnements de ses clients sans autorisation pr\xE9alable.\n\u2022\
            \ Les clients ne peuvent pas acc\xE9der \xE0 l\u2019environnement du fournisseur\
            \ sans autorisation pr\xE9alable."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.1
      ref_id: A1.1.2
      description: Controls are implemented such that each customer only has permission
        to access its own cardholder data and CDE.
      translations:
        fr:
          description: "Des contr\xF4les sont mis en place afin que chaque client\
            \ dispose uniquement des autorisations n\xE9cessaires pour acc\xE9der\
            \ \xE0 ses propres donn\xE9es de titulaires de cartes et \xE0 son propre\
            \ environnement de donn\xE9es des titulaires de cartes (CDE)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.1.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.1
      ref_id: A1.1.3
      description: Controls are implemented such that each customer can only access
        resources allocated to them.
      translations:
        fr:
          description: "Des contr\xF4les sont mis en place afin que chaque client\
            \ puisse uniquement acc\xE9der aux ressources qui lui sont allou\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.1.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.1
      ref_id: A1.1.4
      description: The effectiveness of logical separation controls used to separate
        customer environments is confirmed at least once every six months via penetration
        testing.
      translations:
        fr:
          description: "L\u2019efficacit\xE9 des contr\xF4les de s\xE9paration logique\
            \ entre les environnements clients est v\xE9rifi\xE9e au moins tous les\
            \ six mois au moyen de tests d\u2019intrusion."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a1
      ref_id: A1.2
      description: Multi-tenant service providers facilitate logging and incident
        response for all customers.
      translations:
        fr:
          description: "Les fournisseurs de services mutualis\xE9s facilitent la journalisation\
            \ et la gestion des incidents pour l\u2019ensemble de leurs clients."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.2
      ref_id: A1.2.1
      description: "Audit log capability is enabled for each customer\u2019s environment\
        \ that is consistent with PCI DSS Requirement 10, including:\n- Logs are enabled\
        \ for common third-party applications.\n- Logs are active by default.\n- Logs\
        \ are available for review only by the owning customer.\n- Log locations are\
        \ clearly communicated to the owning customer.\n- Log data and availability\
        \ is consistent with PCI DSS Requirement 10."
      translations:
        fr:
          description: "La capacit\xE9 de journalisation est activ\xE9e pour chaque\
            \ environnement client, conform\xE9ment \xE0 l\u2019exigence 10 du PCI\
            \ DSS, notamment :\n\u2022 Les journaux sont activ\xE9s pour les applications\
            \ tierces courantes.\n\u2022 Les journaux sont activ\xE9s par d\xE9faut.\n\
            \u2022 Seul le client propri\xE9taire peut consulter ses journaux.\n\u2022\
            \ L\u2019emplacement des journaux est clairement communiqu\xE9 au client.\n\
            \u2022 Les journaux et leur disponibilit\xE9 sont conformes \xE0 l\u2019\
            exigence 10 du PCI DSS."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.2
      ref_id: A1.2.2
      description: Processes or mechanisms are implemented to support and/or facilitate
        prompt forensic investigations in the event of a suspected or confirmed security
        incident for any customer.
      translations:
        fr:
          description: "Des processus ou m\xE9canismes sont mis en place pour soutenir\
            \ et/ou faciliter les enqu\xEAtes forensiques rapides en cas d\u2019incident\
            \ de s\xE9curit\xE9 suspect\xE9 ou confirm\xE9 concernant un client."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.2.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a1.2
      ref_id: A1.2.3
      description: 'Processes or mechanisms are implemented for reporting and addressing
        suspected or confirmed security incidents and vulnerabilities, including:

        - Customers can securely report security incidents and vulnerabilities to
        the provider.

        - The provider addresses and remediates suspected or confirmed security incidents
        and vulnerabilities according to Requirement 6.3.1.'
      translations:
        fr:
          description: "Des processus ou m\xE9canismes sont mis en place pour signaler\
            \ et traiter les incidents de s\xE9curit\xE9 et vuln\xE9rabilit\xE9s suspect\xE9\
            s ou confirm\xE9s, notamment :\n\u2022 Les clients peuvent signaler de\
            \ mani\xE8re s\xE9curis\xE9e les incidents de s\xE9curit\xE9 et les vuln\xE9\
            rabilit\xE9s au fournisseur.\n\u2022 Le fournisseur traite et corrige\
            \ les incidents de s\xE9curit\xE9 et vuln\xE9rabilit\xE9s suspect\xE9\
            s ou confirm\xE9s conform\xE9ment \xE0 l\u2019exigence 6.3.1."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a
      ref_id: A2
      name: Appendix A2
      description: Additional PCI DSS Requirements for Entities Using SSL/Early TLS
        for Card-Present POS POI Terminal Connections
      translations:
        fr:
          name: Annexe A2
          description: "Exigences PCI DSS suppl\xE9mentaires pour les entit\xE9s utilisant\
            \ SSL/TLS pr\xE9coce pour les connexions terminaux POS/POI en pr\xE9sentiel"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a2.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a2
      ref_id: A2.1
      description: POI terminals using SSL and/or early TLS are confirmed as not susceptible
        to known SSL/TLS exploits.
      translations:
        fr:
          description: "Il est confirm\xE9 que les terminaux POI utilisant SSL et/ou\
            \ TLS ancien ne sont pas vuln\xE9rables aux failles SSL/TLS connues."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a2.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a2.1
      ref_id: A2.1.1
      description: Where POS POI terminals at the merchant or payment acceptance location
        use SSL and/or early TLS, the entity confirms the devices are not susceptible
        to any known exploits for those protocols.
      translations:
        fr:
          description: "Lorsque des terminaux POI de point de vente utilisent SSL\
            \ et/ou TLS ancien sur le site du commer\xE7ant ou du point d\u2019acceptation\
            \ de paiement, l\u2019entit\xE9 confirme que ces dispositifs ne sont pas\
            \ vuln\xE9rables aux failles connues associ\xE9es \xE0 ces protocoles."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a2.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a2.1
      ref_id: A2.1.2
      description: 'Additional requirement for service providers only: All service
        providers with existing connection points to POS POI terminals that use SSL
        and/or early TLS as defined in A2.1 have a formal Risk Mitigation and Migration
        Plan in place that includes:

        - Description of usage, including what data is being transmitted, types and
        number of systems that use and/or support SSL/early TLS, and type of environment.

        - Risk-assessment results and risk-reduction controls in place.

        - Description of processes to monitor for new vulnerabilities associated with
        SSL/early TLS.

        - Description of change control processes that are implemented to ensure SSL/early
        TLS is not implemented into new environments.

        - Overview of migration project plan to replace SSL/early TLS at a future
        date.'
      translations:
        fr:
          description: "Exigence suppl\xE9mentaire uniquement pour les fournisseurs\
            \ de services :\n\u2022 Tous les fournisseurs de services disposant de\
            \ points de connexion existants vers des terminaux POI de point de vente\
            \ utilisant SSL et/ou TLS ancien, tels que d\xE9finis dans l\u2019exigence\
            \ A2.1, disposent d\u2019un plan formel de r\xE9duction des risques et\
            \ de migration, incluant :\n\u2022 Une description de l\u2019usage, pr\xE9\
            cisant les donn\xE9es transmises, les types et le nombre de syst\xE8mes\
            \ utilisant et/ou prenant en charge SSL/TLS ancien, ainsi que le type\
            \ d\u2019environnement concern\xE9.\n\u2022 Les r\xE9sultats de l\u2019\
            \xE9valuation des risques et les mesures de r\xE9duction mises en place.\n\
            \u2022 Une description des processus de surveillance des nouvelles vuln\xE9\
            rabilit\xE9s associ\xE9es \xE0 SSL/TLS ancien.\n\u2022 Une description\
            \ des processus de gestion des changements permettant de garantir que\
            \ SSL/TLS ancien ne soit pas introduit dans de nouveaux environnements.\n\
            \u2022 Un aper\xE7u du plan de migration visant \xE0 remplacer SSL/TLS\
            \ ancien \xE0 une date ult\xE9rieure."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a2.1.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a2.1
      ref_id: A2.1.3
      description: 'Additional requirement for service providers only: All service
        providers provide a secure service offering.'
      translations:
        fr:
          description: "Exigence suppl\xE9mentaire uniquement pour les fournisseurs\
            \ de services : Tous les fournisseurs de services doivent proposer une\
            \ offre de service s\xE9curis\xE9e."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a
      ref_id: A3
      name: Appendix A3
      description: Designated Entities Supplemental Validation (DESV)
      translations:
        fr:
          name: Annexe A3
          description: "Validation suppl\xE9mentaire pour les entit\xE9s d\xE9sign\xE9\
            es (DESV)"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.1
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3
      ref_id: A3.1
      description: A PCI DSS compliance program is implemented.
      translations:
        fr:
          description: "Un programme de conformit\xE9 au PCI DSS est mis en \u0153\
            uvre."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.1.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.1
      ref_id: A3.1.1
      description: 'Responsibility is established by executive management for the
        protection of account data and a PCI DSS compliance program that includes:

        - Overall accountability for maintaining PCI DSS compliance.

        - Defining a charter for a PCI DSS compliance program.

        - Providing updates to executive management and board of directors on PCI
        DSS compliance initiatives and issues, including remediation activities, at
        least once every 12 months.'
      translations:
        fr:
          description: "La responsabilit\xE9 de la protection des donn\xE9es de compte\
            \ et de la conformit\xE9 PCI DSS est \xE9tablie par la direction g\xE9\
            n\xE9rale, et inclut :\n\u2022 Une responsabilit\xE9 globale pour le maintien\
            \ de la conformit\xE9 PCI DSS.\n\u2022 La d\xE9finition d'une charte pour\
            \ un programme de conformit\xE9 PCI DSS.\n\u2022 La fourniture de mises\
            \ \xE0 jour \xE0 la direction g\xE9n\xE9rale et au conseil d'administration\
            \ concernant les initiatives et probl\xE9matiques li\xE9es \xE0 la conformit\xE9\
            \ PCI DSS, y compris les actions correctives, au moins une fois tous les\
            \ 12 mois."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.1.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.1
      ref_id: A3.1.2
      description: 'A formal PCI DSS compliance program is in place that includes:

        - Definition of activities for maintaining and monitoring overall PCI DSS
        compliance, including business-as-usual activities.

        - Annual PCI DSS assessment processes.

        - Processes for the continuous validation of PCI DSS requirements (for example,
        daily, weekly, every three months, as applicable per the requirement).

        - A process for performing business-impact analysis to determine potential
        PCI DSS impacts for strategic business decisions.'
      translations:
        fr:
          description: "Un programme formel de conformit\xE9 PCI DSS est en place,\
            \ incluant :\n\u2022 La d\xE9finition des activit\xE9s de maintien et\
            \ de surveillance de la conformit\xE9 PCI DSS globale, y compris les activit\xE9\
            s courantes (business-as-usual).\n\u2022 Les processus d\u2019\xE9valuation\
            \ annuelle PCI DSS.\n\u2022 Les processus de validation continue des exigences\
            \ PCI DSS (par exemple, quotidienne, hebdomadaire, tous les trois mois,\
            \ selon l\u2019exigence concern\xE9e).\n\u2022 Un processus d\u2019analyse\
            \ d\u2019impact m\xE9tier afin d\u2019\xE9valuer les impacts potentiels\
            \ sur la conformit\xE9 PCI DSS dans le cadre des d\xE9cisions strat\xE9\
            giques."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.1.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.1
      ref_id: A3.1.3
      description: 'PCI DSS compliance roles and responsibilities are specifically
        defined and formally assigned to one or more personnel, including:

        - Managing PCI DSS business-as-usual activities.

        - Managing annual PCI DSS assessments.

        - Managing continuous validation of PCI DSS requirements (for example, daily,
        weekly, every three months, as applicable per the requirement).

        - Managing business-impact analysis to determine potential PCI DSS impacts
        for strategic business decisions.'
      translations:
        fr:
          description: "Les r\xF4les et responsabilit\xE9s li\xE9s \xE0 la conformit\xE9\
            \ PCI DSS sont pr\xE9cis\xE9ment d\xE9finis et formellement attribu\xE9\
            s \xE0 une ou plusieurs personnes, notamment pour :\n\u2022 La gestion\
            \ des activit\xE9s courantes li\xE9es \xE0 la conformit\xE9 PCI DSS.\n\
            \u2022 La gestion des \xE9valuations annuelles PCI DSS.\n\u2022 La gestion\
            \ de la validation continue des exigences PCI DSS (par exemple, quotidienne,\
            \ hebdomadaire, tous les trois mois, selon l\u2019exigence concern\xE9\
            e).\n\u2022 La gestion des analyses d\u2019impact m\xE9tier pour \xE9\
            valuer les effets potentiels sur la conformit\xE9 PCI DSS dans le cadre\
            \ des d\xE9cisions strat\xE9giques."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.1.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.1
      ref_id: A3.1.4
      description: Up-to-date PCI DSS and/or information security training is provided
        at least once every 12 months to personnel with PCI DSS compliance responsibilities
        (as identified in A3.1.3).
      translations:
        fr:
          description: "Une formation \xE0 jour sur la conformit\xE9 PCI DSS et/ou\
            \ la s\xE9curit\xE9 de l\u2019information est dispens\xE9e au moins une\
            \ fois tous les 12 mois aux membres du personnel ayant des responsabilit\xE9\
            s en mati\xE8re de conformit\xE9 PCI DSS (tels qu\u2019identifi\xE9s dans\
            \ l\u2019exigence A3.1.3)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3
      ref_id: A3.2
      description: PCI DSS scope is documented and validated.
      translations:
        fr:
          description: "Le p\xE9rim\xE8tre PCI DSS est document\xE9 et valid\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2
      ref_id: A3.2.1
      description: 'PCI DSS scope is documented and confirmed for accuracy at least
        once every three months and upon significant changes to the in-scope environment.
        At a minimum, the scoping validation includes:

        - Identifying all data flows for the various payment stages (for example,
        authorization, capture, settlement, chargebacks, and refunds) and acceptance
        channels (for example, card-present, card-not-present, and e-commerce).

        - Updating all data-flow diagrams per Requirement 1.2.4.

        - Identifying all locations where account data is stored, processed, and transmitted,
        including but not limited to 1) any locations outside of the currently defined
        CDE, 2) applications that process CHD, 3) transmissions between systems and
        networks, and 4) file backups.

        - For any account data found outside of the currently defined CDE, either
        1) securely delete it, 2) migrate it into the currently defined CDE, or 3)
        expand the currently defined CDE to include it.

        - Identifying all system components in the CDE, connected to the CDE, or that
        could impact security of the CDE.

        - Identifying all segmentation controls in use and the environment(s) from
        which the CDE is segmented, including justification for environments being
        out of scope.

        - Identifying all connections to third-party entities with access to the CDE.

        - Confirming that all identified data flows, account data, system components,
        segmentation controls, and connections from third parties with access to the
        CDE are included in scope.'
      translations:
        fr:
          description: "Le p\xE9rim\xE8tre PCI DSS est document\xE9 et confirm\xE9\
            \ quant \xE0 son exactitude au moins une fois tous les trois mois et \xE0\
            \ chaque changement significatif dans l\u2019environnement concern\xE9\
            . La validation du p\xE9rim\xE8tre inclut, au minimum :\n\u2022 L\u2019\
            identification de tous les flux de donn\xE9es pour les diff\xE9rentes\
            \ \xE9tapes du paiement (par exemple : autorisation, capture, compensation,\
            \ r\xE9trofacturations et remboursements) et les canaux d\u2019acceptation\
            \ (par exemple : paiement en pr\xE9sence de carte, sans carte, e-commerce).\n\
            \u2022 La mise \xE0 jour de tous les diagrammes de flux de donn\xE9es\
            \ conform\xE9ment \xE0 l\u2019exigence 1.2.4.\n\u2022 L\u2019identification\
            \ de tous les emplacements o\xF9 les donn\xE9es de compte sont stock\xE9\
            es, trait\xE9es et transmises, y compris, sans s\u2019y limiter :\n -\
            \ tout emplacement en dehors du CDE actuellement d\xE9fini,\n - les applications\
            \ traitant les donn\xE9es du titulaire de carte (CHD),\n - les transmissions\
            \ entre syst\xE8mes et r\xE9seaux,\n - les sauvegardes de fichiers.\n\u2022\
            \ Pour toute donn\xE9e de compte trouv\xE9e en dehors du CDE actuellement\
            \ d\xE9fini :\n - la supprimer de mani\xE8re s\xE9curis\xE9e,\n - la migrer\
            \ dans le CDE d\xE9fini,\n - ou \xE9largir le CDE pour l\u2019inclure.\n\
            \u2022 L\u2019identification de tous les composants syst\xE8me pr\xE9\
            sents dans le CDE, connect\xE9s au CDE, ou susceptibles d\u2019avoir un\
            \ impact sur sa s\xE9curit\xE9.\n\u2022 L\u2019identification de tous\
            \ les contr\xF4les de segmentation en place ainsi que des environnements\
            \ dont le CDE est segment\xE9, en fournissant une justification pour les\
            \ environnements consid\xE9r\xE9s comme hors p\xE9rim\xE8tre.\n\u2022\
            \ L\u2019identification de toutes les connexions avec des tiers ayant\
            \ acc\xE8s au CDE.\n\u2022 La confirmation que tous les flux de donn\xE9\
            es, donn\xE9es de compte, composants syst\xE8me, contr\xF4les de segmentation\
            \ et connexions tierces identifi\xE9s sont bien inclus dans le p\xE9rim\xE8\
            tre."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2
      ref_id: A3.2.2
      description: 'PCI DSS scope impact for all changes to systems or networks is
        determined, including additions of new systems and new network connections.
        Processes include:

        - Performing a formal PCI DSS impact assessment.

        - Identifying applicable PCI DSS requirements to the system or network.

        - Updating PCI DSS scope as appropriate.

        - Documented sign-off of the results of the impact assessment by responsible
        personnel (as defined in A3.1.3).'
      translations:
        fr:
          description: "L\u2019impact sur le p\xE9rim\xE8tre PCI DSS est \xE9valu\xE9\
            \ pour toute modification des syst\xE8mes ou des r\xE9seaux, y compris\
            \ l\u2019ajout de nouveaux syst\xE8mes ou de nouvelles connexions r\xE9\
            seau. Les processus incluent :\n\u2022 La r\xE9alisation d\u2019une \xE9\
            valuation formelle de l\u2019impact PCI DSS.\n\u2022 L\u2019identification\
            \ des exigences PCI DSS applicables au syst\xE8me ou au r\xE9seau concern\xE9\
            .\n\u2022 La mise \xE0 jour du p\xE9rim\xE8tre PCI DSS, le cas \xE9ch\xE9\
            ant.\n\u2022 La validation document\xE9e des r\xE9sultats de l\u2019\xE9\
            valuation d\u2019impact par le personnel responsable (tel que d\xE9fini\
            \ dans l\u2019exigence A3.1.3)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.2.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.2
      ref_id: A3.2.2.1
      description: Upon completion of a change, all relevant PCI DSS requirements
        are confirmed to be implemented on all new or changed systems and networks,
        and documentation is updated as applicable.
      translations:
        fr:
          description: "Une fois un changement effectu\xE9, toutes les exigences PCI\
            \ DSS pertinentes sont v\xE9rifi\xE9es comme \xE9tant mises en \u0153\
            uvre sur l\u2019ensemble des syst\xE8mes et r\xE9seaux nouveaux ou modifi\xE9\
            s, et la documentation est mise \xE0 jour en cons\xE9quence."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2
      ref_id: A3.2.3
      description: Changes to organizational structure result in a formal (internal)
        review of the impact to PCI DSS scope and applicability of controls.
      translations:
        fr:
          description: "Les changements dans la structure organisationnelle donnent\
            \ lieu \xE0 un examen formel (interne) de l\u2019impact sur le p\xE9rim\xE8\
            tre PCI DSS et sur l\u2019applicabilit\xE9 des contr\xF4les."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.4
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2
      ref_id: A3.2.4
      description: "If segmentation is used, PCI DSS scope is confirmed as follows:\n\
        \u2022 Per the entity\u2019s methodology defined at Requirement 11.4.1.\n\u2022\
        \ Penetration testing is performed on segmentation controls at least once\
        \ every six months and after any changes to segmentation controls/methods.\n\
        \u2022 The penetration testing covers all segmentation controls/methods in\
        \ use.\n\u2022 The penetration testing verifies that segmentation controls/methods\
        \ are operational and effective, and isolate the CDE from all out-of-scope\
        \ systems."
      translations:
        fr:
          description: "Si une segmentation est utilis\xE9e, le p\xE9rim\xE8tre PCI\
            \ DSS est confirm\xE9 selon les modalit\xE9s suivantes :\n\u2022 Conform\xE9\
            ment \xE0 la m\xE9thodologie d\xE9finie par l\u2019entit\xE9 \xE0 l\u2019\
            exigence 11.4.1.\n\u2022 Des tests d\u2019intrusion sont r\xE9alis\xE9\
            s sur les contr\xF4les de segmentation au moins une fois tous les six\
            \ mois et apr\xE8s toute modification des contr\xF4les ou m\xE9thodes\
            \ de segmentation.\n\u2022 Les tests d\u2019intrusion couvrent l\u2019\
            ensemble des contr\xF4les/m\xE9thodes de segmentation en place.\n\u2022\
            \ Les tests d\u2019intrusion v\xE9rifient que les contr\xF4les/m\xE9thodes\
            \ de segmentation sont op\xE9rationnels, efficaces, et qu\u2019ils isolent\
            \ correctement le CDE de tous les syst\xE8mes hors p\xE9rim\xE8tre."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2
      ref_id: A3.2.5
      description: 'A data-discovery methodology is implemented that:

        - Confirms PCI DSS scope.

        - Locates all sources and locations of cleartext PAN at least once every three
        months and upon significant changes to the CDE or processes.

        - Addresses the potential for cleartext PAN to reside on systems and networks
        outside the currently defined CDE'
      translations:
        fr:
          description: "Une m\xE9thodologie de d\xE9couverte des donn\xE9es est mise\
            \ en \u0153uvre afin de :\n\u2022 Confirmer le p\xE9rim\xE8tre PCI DSS.\n\
            \u2022 Identifier toutes les sources et localisations de PAN en clair\
            \ au moins une fois tous les trois mois et \xE0 chaque changement significatif\
            \ du CDE ou des processus.\n\u2022 Traiter le risque de pr\xE9sence de\
            \ PAN en clair sur des syst\xE8mes et r\xE9seaux situ\xE9s en dehors du\
            \ CDE actuellement d\xE9fini."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.5.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.5
      ref_id: A3.2.5.1
      description: 'Data discovery methods are confirmed as follows:

        - Effectiveness of methods is tested.

        - Methods are able to discover cleartext PAN on all types of system components
        and file formats in use.

        - The effectiveness of data-discovery methods is confirmed at least once every
        12 months.'
      translations:
        fr:
          description: "Les m\xE9thodes de d\xE9couverte de donn\xE9es sont valid\xE9\
            es comme suit :\n\u2022 L\u2019efficacit\xE9 des m\xE9thodes est test\xE9\
            e.\n\u2022 Les m\xE9thodes sont capables de d\xE9tecter les PAN en clair\
            \ sur tous les types de composants syst\xE8me et formats de fichiers utilis\xE9\
            s.\n\u2022 L\u2019efficacit\xE9 des m\xE9thodes de d\xE9couverte de donn\xE9\
            es est confirm\xE9e au moins une fois tous les 12 mois."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.5.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.5
      ref_id: A3.2.5.2
      description: 'Response procedures are implemented to be initiated upon the detection
        of cleartext PAN outside the CDE to include:

        - Determining what to do if cleartext PAN is discovered outside the CDE, including
        its retrieval, secure deletion, and/or migration into the currently defined
        CDE, as applicable.

        - Determining how the data ended up outside the CDE.

        - Remediating data leaks or process gaps that resulted in the data being outside
        the CDE.

        - Identifying the source of the data.

        - Identifying whether any track data is stored with the PANs.'
      translations:
        fr:
          description: "Des proc\xE9dures de r\xE9ponse sont mises en \u0153uvre et\
            \ d\xE9clench\xE9es lors de la d\xE9tection de PAN en clair en dehors\
            \ du CDE, comprenant :\n\u2022 La d\xE9termination des actions \xE0 entreprendre\
            \ en cas de d\xE9couverte de PAN en clair hors du CDE, y compris leur\
            \ r\xE9cup\xE9ration, leur suppression s\xE9curis\xE9e et/ou leur migration\
            \ vers le CDE actuellement d\xE9fini, selon le cas.\n\u2022 L\u2019identification\
            \ de la mani\xE8re dont les donn\xE9es se sont retrouv\xE9es en dehors\
            \ du CDE.\n\u2022 La rem\xE9diation des fuites de donn\xE9es ou des d\xE9\
            faillances de processus ayant conduit \xE0 la pr\xE9sence de donn\xE9\
            es hors du CDE.\n\u2022 L\u2019identification de la source des donn\xE9\
            es.\n\u2022 La v\xE9rification de la pr\xE9sence \xE9ventuelle de donn\xE9\
            es de piste stock\xE9es avec les PAN."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2
      ref_id: A3.2.6
      description: 'Mechanisms are implemented for detecting and preventing cleartext
        PAN from leaving the CDE via an unauthorized channel, method, or process,
        including mechanisms that are:

        - Actively running.

        - Configured to detect and prevent cleartext PAN leaving the CDE via an unauthorized
        channel, method, or process.

        - Generating audit logs and alerts upon detection of cleartext PAN leaving
        the CDE via an unauthorized channel, method, or process.'
      translations:
        fr:
          description: "Des m\xE9canismes sont mis en place pour d\xE9tecter et emp\xEA\
            cher la sortie de PAN en clair hors du CDE via un canal, une m\xE9thode\
            \ ou un processus non autoris\xE9, incluant des m\xE9canismes qui :\n\u2022\
            \ Fonctionnent de mani\xE8re active.\n\u2022 Sont configur\xE9s pour d\xE9\
            tecter et emp\xEAcher la sortie de PAN en clair via un canal, une m\xE9\
            thode ou un processus non autoris\xE9.\n\u2022 G\xE9n\xE8rent des journaux\
            \ d\u2019audit et des alertes lorsqu\u2019un PAN en clair est d\xE9tect\xE9\
            \ en train de quitter le CDE par un canal, une m\xE9thode ou un processus\
            \ non autoris\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.6.1
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.2.6
      ref_id: A3.2.6.1
      description: 'Response procedures are implemented to be initiated upon the detection
        of attempts to remove cleartext PAN from the CDE via an unauthorized channel,
        method, or process. Response procedures include:

        - Procedures for the prompt investigation of alerts by responsible personnel.

        - Procedures for remediating data leaks or process gaps, as necessary, to
        prevent any data loss.'
      translations:
        fr:
          description: "Des proc\xE9dures de r\xE9ponse sont mises en \u0153uvre et\
            \ d\xE9clench\xE9es d\xE8s la d\xE9tection de tentatives de sortie de\
            \ PAN en clair hors du CDE via un canal, une m\xE9thode ou un processus\
            \ non autoris\xE9. Les proc\xE9dures de r\xE9ponse incluent :\n\u2022\
            \ Des proc\xE9dures permettant l\u2019investigation rapide des alertes\
            \ par le personnel responsable.\n\u2022 Des proc\xE9dures de rem\xE9diation\
            \ des fuites de donn\xE9es ou des d\xE9faillances de processus, si n\xE9\
            cessaire, afin de pr\xE9venir toute perte de donn\xE9es."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.3
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3
      ref_id: A3.3
      description: PCI DSS is incorporated into business-as-usual (BAU) activities.
      translations:
        fr:
          description: "Le PCI DSS est int\xE9gr\xE9 aux activit\xE9s courantes de\
            \ l\u2019organisation (business-as-usual \u2013 BAU)."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.3.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.3
      ref_id: A3.3.1
      description: 'Failures of critical security control systems are detected, alerted,
        and addressed promptly, including but not limited to failure of:

        - Network security controls

        - IDS/IPS

        - FIM

        - Anti-malware solutions

        - Physical access controls

        - Logical access controls

        - Audit logging mechanisms

        - Segmentation controls (if used)

        - Automated audit log review mechanisms. This bullet is a best practice until
        its effective date.

        - Automated code review tools (if used). This bullet is a best practice until
        its effective date.'
      translations:
        fr:
          description: "Les d\xE9faillances des syst\xE8mes de contr\xF4le de s\xE9\
            curit\xE9 critiques sont d\xE9tect\xE9es, signal\xE9es par alerte et trait\xE9\
            es rapidement. Cela inclut, sans s\u2019y limiter, les d\xE9faillances\
            \ des \xE9l\xE9ments suivants :\n\u2022 Contr\xF4les de s\xE9curit\xE9\
            \ r\xE9seau\n\u2022 Syst\xE8mes de d\xE9tection/pr\xE9vention d\u2019\
            intrusion (IDS/IPS)\n\u2022 Surveillance de l\u2019int\xE9grit\xE9 des\
            \ fichiers (FIM)\n\u2022 Solutions anti-malware\n\u2022 Contr\xF4les d\u2019\
            acc\xE8s physiques\n\u2022 Contr\xF4les d\u2019acc\xE8s logiques\n\u2022\
            \ M\xE9canismes de journalisation des audits\n\u2022 Contr\xF4les de segmentation\
            \ (le cas \xE9ch\xE9ant)\n\u2022 M\xE9canismes automatis\xE9s de r\xE9\
            vision des journaux d\u2019audit (cette exigence est une bonne pratique\
            \ jusqu\u2019\xE0 sa date d\u2019entr\xE9e en vigueur)\n\u2022 Outils\
            \ automatis\xE9s d\u2019analyse de code (cette exigence est une bonne\
            \ pratique jusqu\u2019\xE0 sa date d\u2019entr\xE9e en vigueur)"
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.3.1.2
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.3.1
      ref_id: A3.3.1.2
      description: 'Failures of any critical security control systems are responded
        to promptly. Processes for responding to failures in security control systems
        include:

        - Restoring security functions.

        - Identifying and documenting the duration (date and time from start to end)
        of the security failure.

        - Identifying and documenting the cause(s) of failure, including root cause,
        and documenting remediation required to address the root cause.

        - Identifying and addressing any security issues that arose during the failure.

        - Determining whether further actions are required as a result of the security
        failure.

        - Implementing controls to prevent the cause of failure from reoccurring.

        - Resuming monitoring of security controls.'
      translations:
        fr:
          description: "Les d\xE9faillances de tout syst\xE8me de contr\xF4le de s\xE9\
            curit\xE9 critique font l\u2019objet d\u2019une r\xE9ponse rapide. Les\
            \ processus de r\xE9ponse \xE0 ces d\xE9faillances incluent :\n\u2022\
            \ La restauration des fonctions de s\xE9curit\xE9.\n\u2022 L\u2019identification\
            \ et la documentation de la dur\xE9e de la d\xE9faillance (date et heure\
            \ de d\xE9but et de fin).\n\u2022 L\u2019identification et la documentation\
            \ des causes de la d\xE9faillance, y compris la cause racine, ainsi que\
            \ les mesures correctives n\xE9cessaires pour y rem\xE9dier.\n\u2022 L\u2019\
            identification et le traitement des probl\xE8mes de s\xE9curit\xE9 survenus\
            \ durant la d\xE9faillance.\n\u2022 L\u2019\xE9valuation de la n\xE9cessit\xE9\
            \ d\u2019actions compl\xE9mentaires \xE0 la suite de la d\xE9faillance.\n\
            \u2022 La mise en \u0153uvre de contr\xF4les pour \xE9viter la r\xE9apparition\
            \ de la cause de la d\xE9faillance.\n\u2022 La reprise de la surveillance\
            \ des contr\xF4les de s\xE9curit\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.3.2
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.3
      ref_id: A3.3.2
      description: "Hardware and software technologies are reviewed at least once\
        \ every 12 months to confirm whether they continue to meet the organization\u2019\
        s PCI DSS requirements."
      translations:
        fr:
          description: "Les technologies mat\xE9rielles et logicielles sont r\xE9\
            vis\xE9es au moins une fois tous les 12 mois afin de v\xE9rifier qu\u2019\
            elles r\xE9pondent toujours aux exigences PCI DSS de l\u2019organisation."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.3.3
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.3
      ref_id: A3.3.3
      description: 'Reviews are performed at least once every three months to verify
        BAU activities are being followed. Reviews are performed by personnel assigned
        to the PCI DSS compliance program (as identified in A3.1.3), and include:

        - Confirmation that all BAU activities, including A3.2.2, A3.2.6, and A3.3.1,
        are being performed.

        - Confirmation that personnel are following security policies and operational
        procedures (for example, daily log reviews, ruleset reviews for network security
        controls, configuration standards for new systems).

        - Documenting how the reviews were completed, including how all BAU activities
        were verified as being in place.

        - Collection of documented evidence as required for the annual PCI DSS assessment.

        - Review and sign-off of results by personnel assigned responsibility for
        the PCI DSS compliance program, as identified in A3.1.3.

        - Retention of records and documentation for at least 12 months, covering
        all BAU activities.'
      translations:
        fr:
          description: "Des revues sont effectu\xE9es au moins une fois tous les trois\
            \ mois pour v\xE9rifier que les activit\xE9s courantes (BAU) sont bien\
            \ suivies. Ces revues sont r\xE9alis\xE9es par le personnel d\xE9sign\xE9\
            \ pour le programme de conformit\xE9 PCI DSS (tel qu\u2019identifi\xE9\
            \ dans l\u2019exigence A3.1.3) et incluent :\n\u2022 La confirmation que\
            \ toutes les activit\xE9s BAU, y compris celles d\xE9finies aux exigences\
            \ A3.2.2, A3.2.6 et A3.3.1, sont bien r\xE9alis\xE9es.\n\u2022 La confirmation\
            \ que le personnel applique les politiques de s\xE9curit\xE9 et les proc\xE9\
            dures op\xE9rationnelles (par exemple, les revues de journaux quotidiennes,\
            \ les revues des r\xE8gles des contr\xF4les de s\xE9curit\xE9 r\xE9seau,\
            \ les standards de configuration des nouveaux syst\xE8mes).\n\u2022 La\
            \ documentation des modalit\xE9s de r\xE9alisation des revues, y compris\
            \ la mani\xE8re dont l\u2019ex\xE9cution des activit\xE9s BAU a \xE9t\xE9\
            \ v\xE9rifi\xE9e.\n\u2022 La collecte des \xE9l\xE9ments de preuve document\xE9\
            s n\xE9cessaires \xE0 l\u2019\xE9valuation annuelle PCI DSS.\n\u2022 La\
            \ revue et la validation des r\xE9sultats par le personnel responsable\
            \ du programme de conformit\xE9 PCI DSS, tel qu\u2019identifi\xE9 dans\
            \ A3.1.3.\n\u2022 La conservation des enregistrements et de la documentation\
            \ pendant au moins 12 mois, couvrant l\u2019ensemble des activit\xE9s\
            \ BAU."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.4
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3
      ref_id: A3.4
      description: Logical access to the cardholder data environment is controlled
        and managed.
      translations:
        fr:
          description: "L\u2019acc\xE8s logique \xE0 l\u2019environnement des donn\xE9\
            es de titulaires de cartes est contr\xF4l\xE9 et g\xE9r\xE9."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.4.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.4
      ref_id: A3.4.1
      description: User accounts and access privileges to in-scope system components
        are reviewed at least once every six months to ensure user accounts and access
        privileges remain appropriate based on job function, and that all access is
        authorized.
      translations:
        fr:
          description: "Les comptes utilisateurs et les privil\xE8ges d\u2019acc\xE8\
            s aux composants syst\xE8me inclus dans le p\xE9rim\xE8tre sont revus\
            \ au moins une fois tous les six mois afin de s\u2019assurer qu\u2019\
            ils restent adapt\xE9s aux fonctions exerc\xE9es, et que tous les acc\xE8\
            s sont d\xFBment autoris\xE9s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.5
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3
      ref_id: A3.5
      description: Suspicious events are identified and responded to.
      translations:
        fr:
          description: "Les \xE9v\xE9nements suspects sont identifi\xE9s et trait\xE9\
            s."
    - urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.5.1
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:pcidss-4_0:a3.5
      ref_id: A3.5.1
      description: 'A methodology is implemented for the prompt identification of
        attack patterns and undesirable behavior across systems that includes:

        - Identification of anomalies or suspicious activity as it occurs.

        - Issuance of prompt alerts upon detection of suspicious activity or anomaly
        to responsible personnel.

        - Response to alerts in accordance with documented response procedures.'
      translations:
        fr:
          description: "Une m\xE9thodologie est mise en \u0153uvre pour identifier\
            \ rapidement les sch\xE9mas d\u2019attaque et les comportements ind\xE9\
            sirables \xE0 travers les syst\xE8mes, incluant :\n\u2022 L\u2019identification\
            \ des anomalies ou activit\xE9s suspectes au moment o\xF9 elles se produisent.\n\
            \u2022 L\u2019\xE9mission rapide d\u2019alertes en cas de d\xE9tection\
            \ d\u2019une activit\xE9 suspecte ou d\u2019une anomalie, \xE0 destination\
            \ du personnel responsable.\n\u2022 La r\xE9ponse aux alertes conform\xE9\
            ment aux proc\xE9dures de r\xE9ponse document\xE9es."
