How solenefig-lab/grc-pme-fictive works
This repository is a GRC learning and working portfolio for the fictional SantéConnect health-tech company, rather than a runtime application. Its main user journey is a staged compliance and risk-management programme: establish context and governance, produce privacy and security analyses, then address NIS2 and EBIOS risks. A separate reusable resource library includes an executable RBAC audit tool. The README documents these workstreams; only the audit script’s data flow is supported by sampled source, so links between other deliverables are kept conservative.
Main entry points: semaine-1-gouvernance Audit and risks · README.md GRC resource library · rbac_audit.py RBAC audit script · semaine-2-rgpd-hds RGPD and HDS
Components 26
GRC Programme
- SantéConnect context
semaine-0-fondamentaux/contexte-santeconnect.md - Audit and risks
semaine-1-gouvernance
Privacy and HDS
- RGPD and HDS
semaine-2-rgpd-hds - Processing register
semaine-2-rgpd-hds/registre-traitements/registre_traitement.md - Privacy impact
semaine-2-rgpd-hds/aipd-synthetique.md - Incident notification
semaine-2-rgpd-hds/procedure-incident-notification.md
Security Frameworks
- ISO 27001 controls
semaine-3-iso27001 - Risk treatment
semaine-3-iso27001/plan-traitement-risques.md - NIS2 analysis
semaine-4-nis2 - Continuity plans
semaine-4-nis2/pra-pca.md
Risk Analysis
- EBIOS scoping
semaine-5-ebios-rm/1-ebios-rm-santeconnect-cadrage.md - Risk sources
semaine-5-ebios-rm/2-sources-risque.md - Strategic scenarios
semaine-5-ebios-rm/3-scenarios-strategiques.md - CHU API scenario
semaine-5-ebios-rm/4-compromission-chu-api.md
Reusable Resources
- GRC resource library
ressources/README.md - ISO control reference
ressources/ISO 27001_Liste_Controle.md - Legal reference
ressources/Referentiel_legal_simplifie.md - Incident response plan
ressources/plan_reponse_incidents.md - Asset inventory templates
ressources/grc-asset-inventory-template-pme.xlsx - RBAC audit script
ressources/audit_RBAC_auto/rbac_audit.py - RBAC matrix CSV
ressources/audit_RBAC_auto/MatriceRBAC.csv - User records CSV
ressources/audit_RBAC_auto/users.csv - Access log CSV
ressources/audit_RBAC_auto/user_access_log.csv - Anomaly report CSV
ressources/audit_RBAC_auto/20260630_232208_rapport_anomalies.csv
Other components
- GRC team
- Partner CHU
Connections 25
- GRC team → SantéConnect context: defines context
- SantéConnect context → Audit and risks: frames audit
- Audit and risks → RGPD and HDS: sets programme
- Audit and risks → ISO 27001 controls: sets programme
- Audit and risks → NIS2 analysis: sets programme
- Audit and risks → EBIOS scoping: sets programme
- Partner CHU → RGPD and HDS: co-responsibility context
- RGPD and HDS → Processing register: documents processing
- RGPD and HDS → Privacy impact: assesses impact
- RGPD and HDS → Incident notification: defines notification
- ISO 27001 controls → Risk treatment: records treatment
- NIS2 analysis → Continuity plans: includes continuity
- EBIOS scoping → Risk sources: frames analysis
- Risk sources → Strategic scenarios: develops scenarios
- Strategic scenarios → CHU API scenario: details scenario
- GRC team → GRC resource library: consults resources
- GRC resource library → ISO control reference: catalogues
- GRC resource library → Legal reference: catalogues
- GRC resource library → Incident response plan: catalogues
- GRC resource library → Asset inventory templates: catalogues
- GRC team → RBAC audit script: runs audit
- RBAC audit script → RBAC matrix CSV: reads rules
- RBAC audit script → User records CSV: reads users
- RBAC audit script → Access log CSV: reads accesses
- RBAC audit script → Anomaly report CSV: writes report