# solenefig-lab/grc-pme-fictive architecture

> Architecture diagram of the GitHub repository solenefig-lab/grc-pme-fictive, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/solenefig-lab/grc-pme-fictive
- Repository: https://github.com/solenefig-lab/grc-pme-fictive

## Overview

This repository is a GRC learning and working portfolio for the fictional SantéConnect health-tech company, rather than a runtime application. Its main user journey is a staged compliance and risk-management programme: establish context and governance, produce privacy and security analyses, then address NIS2 and EBIOS risks. A separate reusable resource library includes an executable RBAC audit tool. The README documents these workstreams; only the audit script’s data flow is supported by sampled source, so links between other deliverables are kept conservative.

Main entry points: [`semaine-1-gouvernance`](https://github.com/solenefig-lab/grc-pme-fictive/tree/main/semaine-1-gouvernance) (Audit and risks), [`ressources/README.md`](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/README.md) (GRC resource library), [`ressources/audit_RBAC_auto/rbac_audit.py`](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/rbac_audit.py) (RBAC audit script), [`semaine-2-rgpd-hds`](https://github.com/solenefig-lab/grc-pme-fictive/tree/main/semaine-2-rgpd-hds) (RGPD and HDS)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_programme["GRC Programme"]
  node_company_context["SantéConnect context"]
  node_governance["Audit and risks"]
end

subgraph group_privacy["Privacy and HDS"]
  node_privacy_work["RGPD and HDS"]
  node_processing_register["Processing register"]
  node_impact_assessment["Privacy impact"]
  node_incident_notice["Incident notification"]
end

subgraph group_security["Security Frameworks"]
  node_iso_security["ISO 27001 controls"]
  node_risk_treatment["Risk treatment"]
  node_nis2["NIS2 analysis"]
  node_continuity["Continuity plans<br/>[pra-pca.md]"]
end

subgraph group_risk["Risk Analysis"]
  node_ebios_scope["EBIOS scoping"]
  node_risk_sources["Risk sources"]
  node_strategic_scenarios["Strategic scenarios"]
  node_chu_api_scenario["CHU API scenario"]
end

subgraph group_library["Reusable Resources"]
  node_resource_catalog["GRC resource library<br/>[README.md]"]
  node_iso_reference["ISO control reference"]
  node_legal_reference["Legal reference"]
  node_incident_template["Incident response plan"]
  node_asset_template["Asset inventory templates"]
  node_rbac_tool["RBAC audit script<br/>[rbac_audit.py]"]
  node_rbac_matrix["RBAC matrix CSV<br/>[MatriceRBAC.csv]"]
  node_user_data["User records CSV<br/>[users.csv]"]
  node_access_log["Access log CSV"]
  node_anomaly_report["Anomaly report CSV"]
end

node_grc_team(("GRC team"))
node_chu(("Partner CHU"))

node_grc_team -->|"defines context"| node_company_context
node_company_context -->|"frames audit"| node_governance
node_governance -->|"sets programme"| node_privacy_work
node_governance -->|"sets programme"| node_iso_security
node_governance -->|"sets programme"| node_nis2
node_governance -->|"sets programme"| node_ebios_scope
node_chu -->|"co-responsibility context"| node_privacy_work
node_privacy_work -->|"documents processing"| node_processing_register
node_privacy_work -->|"assesses impact"| node_impact_assessment
node_privacy_work -->|"defines notification"| node_incident_notice
node_iso_security -->|"records treatment"| node_risk_treatment
node_nis2 -->|"includes continuity"| node_continuity
node_ebios_scope -->|"frames analysis"| node_risk_sources
node_risk_sources -->|"develops scenarios"| node_strategic_scenarios
node_strategic_scenarios -->|"details scenario"| node_chu_api_scenario
node_grc_team -->|"consults resources"| node_resource_catalog
node_resource_catalog -->|"catalogues"| node_iso_reference
node_resource_catalog -->|"catalogues"| node_legal_reference
node_resource_catalog -->|"catalogues"| node_incident_template
node_resource_catalog -->|"catalogues"| node_asset_template
node_grc_team -->|"runs audit"| node_rbac_tool
node_rbac_tool -->|"reads rules"| node_rbac_matrix
node_rbac_tool -->|"reads users"| node_user_data
node_rbac_tool -->|"reads accesses"| node_access_log
node_rbac_tool -->|"writes report"| node_anomaly_report

click node_company_context "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-0-fondamentaux/contexte-santeconnect.md"
click node_governance "https://github.com/solenefig-lab/grc-pme-fictive/tree/main/semaine-1-gouvernance"
click node_privacy_work "https://github.com/solenefig-lab/grc-pme-fictive/tree/main/semaine-2-rgpd-hds"
click node_processing_register "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-2-rgpd-hds/registre-traitements/registre_traitement.md"
click node_impact_assessment "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-2-rgpd-hds/aipd-synthetique.md"
click node_incident_notice "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-2-rgpd-hds/procedure-incident-notification.md"
click node_iso_security "https://github.com/solenefig-lab/grc-pme-fictive/tree/main/semaine-3-iso27001"
click node_risk_treatment "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-3-iso27001/plan-traitement-risques.md"
click node_nis2 "https://github.com/solenefig-lab/grc-pme-fictive/tree/main/semaine-4-nis2"
click node_continuity "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-4-nis2/pra-pca.md"
click node_ebios_scope "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-5-ebios-rm/1-ebios-rm-santeconnect-cadrage.md"
click node_risk_sources "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-5-ebios-rm/2-sources-risque.md"
click node_strategic_scenarios "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-5-ebios-rm/3-scenarios-strategiques.md"
click node_chu_api_scenario "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-5-ebios-rm/4-compromission-chu-api.md"
click node_resource_catalog "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/README.md"
click node_iso_reference "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/ISO%2027001_Liste_Controle.md"
click node_legal_reference "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/Referentiel_legal_simplifie.md"
click node_incident_template "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/plan_reponse_incidents.md"
click node_asset_template "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/grc-asset-inventory-template-pme.xlsx"
click node_rbac_tool "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/rbac_audit.py"
click node_rbac_matrix "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/MatriceRBAC.csv"
click node_user_data "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/users.csv"
click node_access_log "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/user_access_log.csv"
click node_anomaly_report "https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/20260630_232208_rapport_anomalies.csv"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_company_context,node_governance toneBlue
class node_privacy_work,node_processing_register,node_impact_assessment,node_incident_notice toneAmber
class node_iso_security,node_risk_treatment,node_nis2,node_continuity toneMint
class node_ebios_scope,node_risk_sources,node_strategic_scenarios,node_chu_api_scenario toneRose
class node_resource_catalog,node_iso_reference,node_legal_reference,node_incident_template,node_asset_template,node_rbac_tool,node_rbac_matrix,node_user_data,node_access_log,node_anomaly_report,node_grc_team,node_chu toneIndigo
```

## Components

### GRC Programme

- [SantéConnect context](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-0-fondamentaux/contexte-santeconnect.md): `semaine-0-fondamentaux/contexte-santeconnect.md`
- [Audit and risks](https://github.com/solenefig-lab/grc-pme-fictive/tree/main/semaine-1-gouvernance): `semaine-1-gouvernance`

### Privacy and HDS

- [RGPD and HDS](https://github.com/solenefig-lab/grc-pme-fictive/tree/main/semaine-2-rgpd-hds): `semaine-2-rgpd-hds`
- [Processing register](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-2-rgpd-hds/registre-traitements/registre_traitement.md): `semaine-2-rgpd-hds/registre-traitements/registre_traitement.md`
- [Privacy impact](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-2-rgpd-hds/aipd-synthetique.md): `semaine-2-rgpd-hds/aipd-synthetique.md`
- [Incident notification](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-2-rgpd-hds/procedure-incident-notification.md): `semaine-2-rgpd-hds/procedure-incident-notification.md`

### Security Frameworks

- [ISO 27001 controls](https://github.com/solenefig-lab/grc-pme-fictive/tree/main/semaine-3-iso27001): `semaine-3-iso27001`
- [Risk treatment](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-3-iso27001/plan-traitement-risques.md): `semaine-3-iso27001/plan-traitement-risques.md`
- [NIS2 analysis](https://github.com/solenefig-lab/grc-pme-fictive/tree/main/semaine-4-nis2): `semaine-4-nis2`
- [Continuity plans](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-4-nis2/pra-pca.md): `semaine-4-nis2/pra-pca.md`

### Risk Analysis

- [EBIOS scoping](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-5-ebios-rm/1-ebios-rm-santeconnect-cadrage.md): `semaine-5-ebios-rm/1-ebios-rm-santeconnect-cadrage.md`
- [Risk sources](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-5-ebios-rm/2-sources-risque.md): `semaine-5-ebios-rm/2-sources-risque.md`
- [Strategic scenarios](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-5-ebios-rm/3-scenarios-strategiques.md): `semaine-5-ebios-rm/3-scenarios-strategiques.md`
- [CHU API scenario](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/semaine-5-ebios-rm/4-compromission-chu-api.md): `semaine-5-ebios-rm/4-compromission-chu-api.md`

### Reusable Resources

- [GRC resource library](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/README.md): `ressources/README.md`
- [ISO control reference](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/ISO%2027001_Liste_Controle.md): `ressources/ISO 27001_Liste_Controle.md`
- [Legal reference](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/Referentiel_legal_simplifie.md): `ressources/Referentiel_legal_simplifie.md`
- [Incident response plan](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/plan_reponse_incidents.md): `ressources/plan_reponse_incidents.md`
- [Asset inventory templates](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/grc-asset-inventory-template-pme.xlsx): `ressources/grc-asset-inventory-template-pme.xlsx`
- [RBAC audit script](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/rbac_audit.py): `ressources/audit_RBAC_auto/rbac_audit.py`
- [RBAC matrix CSV](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/MatriceRBAC.csv): `ressources/audit_RBAC_auto/MatriceRBAC.csv`
- [User records CSV](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/users.csv): `ressources/audit_RBAC_auto/users.csv`
- [Access log CSV](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/user_access_log.csv): `ressources/audit_RBAC_auto/user_access_log.csv`
- [Anomaly report CSV](https://github.com/solenefig-lab/grc-pme-fictive/blob/main/ressources/audit_RBAC_auto/20260630_232208_rapport_anomalies.csv): `ressources/audit_RBAC_auto/20260630_232208_rapport_anomalies.csv`

### Other components

- **GRC team**
- **Partner CHU**

## Connections

- GRC team → SantéConnect context: defines context
- SantéConnect context → Audit and risks: frames audit
- Audit and risks → RGPD and HDS: sets programme
- Audit and risks → ISO 27001 controls: sets programme
- Audit and risks → NIS2 analysis: sets programme
- Audit and risks → EBIOS scoping: sets programme
- Partner CHU → RGPD and HDS: co-responsibility context
- RGPD and HDS → Processing register: documents processing
- RGPD and HDS → Privacy impact: assesses impact
- RGPD and HDS → Incident notification: defines notification
- ISO 27001 controls → Risk treatment: records treatment
- NIS2 analysis → Continuity plans: includes continuity
- EBIOS scoping → Risk sources: frames analysis
- Risk sources → Strategic scenarios: develops scenarios
- Strategic scenarios → CHU API scenario: details scenario
- GRC team → GRC resource library: consults resources
- GRC resource library → ISO control reference: catalogues
- GRC resource library → Legal reference: catalogues
- GRC resource library → Incident response plan: catalogues
- GRC resource library → Asset inventory templates: catalogues
- GRC team → RBAC audit script: runs audit
- RBAC audit script → RBAC matrix CSV: reads rules
- RBAC audit script → User records CSV: reads users
- RBAC audit script → Access log CSV: reads accesses
- RBAC audit script → Anomaly report CSV: writes report