{"id":1460,"date":"2025-12-28T11:48:04","date_gmt":"2025-12-28T10:48:04","guid":{"rendered":"https:\/\/regulated-devsecops.com\/compliance-2\/"},"modified":"2026-07-07T11:13:03","modified_gmt":"2026-07-07T10:13:03","slug":"compliance","status":"publish","type":"page","link":"https:\/\/regulated-devsecops.com\/fr\/compliance\/","title":{"rendered":"Conformit\u00e9"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\"><strong>La conformit\u00e9 comme propri\u00e9t\u00e9 technique \u2014 pas un exercice documentaire<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dans les environnements r\u00e9glement\u00e9s, la conformit\u00e9 ne consiste pas \u00e0 produire des documents.<br>Il s&rsquo;agit de <strong>d\u00e9montrer le contr\u00f4le<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"640\" src=\"https:\/\/regulated-devsecops.com\/wp-content\/uploads\/2026\/07\/compliance-diagram-fr.svg\" alt=\"Cycle de conformit\u00e9 continue : cartographier, mettre en \u0153uvre, capturer les preuves, auditer\" class=\"wp-image-3193\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Les r\u00e9gulateurs, auditeurs et autorit\u00e9s de supervision attendent des organisations qu&rsquo;elles prouvent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Que les contr\u00f4les sont appliqu\u00e9s<\/li>\n\n\n\n<li>Que les responsabilit\u00e9s sont clairement s\u00e9par\u00e9es<\/li>\n\n\n\n<li>Que les changements sont tra\u00e7ables<\/li>\n\n\n\n<li>Que les preuves sont conserv\u00e9es<\/li>\n\n\n\n<li>Que les risques sont g\u00e9r\u00e9s en continu<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">La conformit\u00e9 moderne doit \u00eatre int\u00e9gr\u00e9e directement dans :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Les pipelines CI\/CD<\/li>\n\n\n\n<li>Les processus SDLC s\u00e9curis\u00e9s<\/li>\n\n\n\n<li>Les environnements cloud et d&rsquo;ex\u00e9cution<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">La conformit\u00e9 doit \u00eatre g\u00e9n\u00e9r\u00e9e par conception \u2014 pas reconstruite apr\u00e8s coup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Nouveau dans ces concepts ? Consultez notre <a href=\"https:\/\/regulated-devsecops.com\/fr\/glossary\/\">Glossaire<\/a> pour des d\u00e9finitions en langage clair, ou commencez par le <a href=\"https:\/\/regulated-devsecops.com\/fr\/start-here\/\">Guide de l&rsquo;auditeur<\/a>.<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Ce que signifie r\u00e9ellement la \u00ab conformit\u00e9 \u00bb<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><br>Dans les environnements r\u00e9glement\u00e9s, la conformit\u00e9 op\u00e8re sur <strong>trois couches compl\u00e9mentaires<\/strong>.<\/p>\n\n\n\n<!-- GeneratePress Inline SVG \u2013 Regulated DevSecOps -->\n<figure class=\"gp-rds-diagram\">\n<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\"\n     viewBox=\"0 0 1200 520\"\n     role=\"img\"\n     aria-labelledby=\"title desc\"\n     data-theme=\"light\">\n\n  <title id=\"title_2\">R\u00e9glementations vs Normes vs Cadres d&rsquo;audit<\/title>\n  <desc id=\"desc_2\">\n    Comparaison visuelle des r\u00e9glementations, normes et cadres d&rsquo;audit en cybers\u00e9curit\u00e9\n    et conformit\u00e9, montrant comment les preuves CI\/CD soutiennent les trois couches.\n  <\/desc>\n\n  <style>\n    :root{\n      --bg:transparent;\n      --text:#0f172a;\n      --muted:#475569;\n      --stroke:#cbd5e1;\n      --card:#ffffff;\n\n      --reg:#2563eb;\n      --regSoft:#dbeafe;\n\n      --std:#7c3aed;\n      --stdSoft:#ede9fe;\n\n      --aud:#059669;\n      --audSoft:#d1fae5;\n    }\n    svg[data-theme=\"dark\"]{\n      --text:#e5e7eb;\n      --muted:#9ca3af;\n      --stroke:#374151;\n      --card:#0b1220;\n\n      --reg:#60a5fa;\n      --regSoft:#0b2a55;\n\n      --std:#a78bfa;\n      --stdSoft:#2a144d;\n\n      --aud:#34d399;\n      --audSoft:#063a2c;\n    }\n\n    .txt{font-family:ui-sans-serif,system-ui,-apple-system,Segoe UI,Roboto,Arial;}\n    .title{font-weight:900;font-size:22px;fill:var(--text);}\n    .sub{font-weight:600;font-size:14px;fill:var(--muted);}\n    .h{font-weight:900;font-size:15px;fill:var(--text);}\n    .p{font-weight:600;font-size:13px;fill:var(--muted);}\n\n    .card{fill:var(--card);stroke:var(--stroke);stroke-width:1.5;rx:16;}\n    .tag{font-weight:800;font-size:12px;letter-spacing:.04em;}\n\n    .reg{stroke:var(--reg) !important;fill:var(--regSoft) !important;}\n    .std{stroke:var(--std) !important;fill:var(--stdSoft) !important;}\n    .aud{stroke:var(--aud) !important;fill:var(--audSoft) !important;}\n\n    .arrow{\n      fill:none;\n      stroke:var(--muted);\n      stroke-width:3;\n      stroke-linecap:round;\n      marker-end:url(#arrow);\n    }\n\n    .evidence{\n      stroke-dasharray:6 6;\n    }\n  <\/style>\n\n  <defs>\n    <marker id=\"arrow\" viewBox=\"0 0 10 10\" refX=\"9\" refY=\"5\"\n            markerWidth=\"7\" markerHeight=\"7\" orient=\"auto\">\n      <path d=\"M0 0 L10 5 L0 10 Z\" fill=\"var(--muted)\"\/>\n    <\/marker>\n  <\/defs>\n\n  <!-- Header -->\n  <text class=\"txt title\" x=\"40\" y=\"48\">R\u00e9glementations vs Normes vs Cadres d&rsquo;audit<\/text>\n  <text class=\"txt sub\" x=\"40\" y=\"74\">\n    Des obligations de nature diff\u00e9rente, une exigence commune : des preuves auditables\n  <\/text>\n\n  <!-- Regulations -->\n  <g transform=\"translate(40,120)\">\n    <rect class=\"card reg\" width=\"320\" height=\"200\"\/>\n    <text class=\"txt h\" x=\"20\" y=\"36\">R\u00e9glementations<\/text>\n    <text class=\"txt p\" x=\"20\" y=\"62\">Obligations juridiquement contraignantes<\/text>\n\n    <text class=\"txt tag\" x=\"20\" y=\"98\">Exemples<\/text>\n    <text class=\"txt p\" x=\"20\" y=\"120\">\u2022 DORA<\/text>\n    <text class=\"txt p\" x=\"20\" y=\"140\">\u2022 NIS2<\/text>\n\n    <text class=\"txt p\" x=\"20\" y=\"170\">\n      D\u00e9finissent ce qui doit \u00eatre atteint\n    <\/text>\n  <\/g>\n\n  <!-- Standards -->\n  <g transform=\"translate(440,120)\">\n    <rect class=\"card std\" width=\"320\" height=\"200\"\/>\n    <text class=\"txt h\" x=\"20\" y=\"36\">Normes<\/text>\n    <text class=\"txt p\" x=\"20\" y=\"62\">Cadres de contr\u00f4le structur\u00e9s<\/text>\n\n    <text class=\"txt tag\" x=\"20\" y=\"98\">Exemples<\/text>\n    <text class=\"txt p\" x=\"20\" y=\"120\">\u2022 ISO\/IEC 27001<\/text>\n    <text class=\"txt p\" x=\"20\" y=\"140\">\u2022 PCI DSS<\/text>\n\n    <text class=\"txt p\" x=\"20\" y=\"170\">\n      D\u00e9crivent comment mettre en \u0153uvre les contr\u00f4les\n    <\/text>\n  <\/g>\n\n  <!-- Audit frameworks -->\n  <g transform=\"translate(840,120)\">\n    <rect class=\"card aud\" width=\"340\" height=\"200\"\/>\n    <text class=\"txt h\" x=\"20\" y=\"36\">Cadres d&rsquo;audit et d&rsquo;assurance<\/text>\n    <text class=\"txt p\" x=\"20\" y=\"62\">Validation ind\u00e9pendante<\/text>\n\n    <text class=\"txt tag\" x=\"20\" y=\"98\">Exemple<\/text>\n    <text class=\"txt p\" x=\"20\" y=\"120\">\u2022 SOC 2<\/text>\n\n    <text class=\"txt p\" x=\"20\" y=\"170\">\n      Fournissent une assurance externe via des rapports d&rsquo;audit\n    <\/text>\n  <\/g>\n\n  <!-- Evidence box -->\n  <g transform=\"translate(260,360)\">\n    <rect class=\"card\" width=\"680\" height=\"120\"\/>\n    <text class=\"txt h\" x=\"20\" y=\"36\">Preuves CI\/CD<\/text>\n    <text class=\"txt p\" x=\"20\" y=\"62\">\n      Journaux, approbations, SBOM, r\u00e9sultats des tests de s\u00e9curit\u00e9, surveillance et chronologies d&rsquo;incidents\n    <\/text>\n    <text class=\"txt p\" x=\"20\" y=\"88\">\n      R\u00e9utilisables, corr\u00e9l\u00e9es et conserv\u00e9es dans les contextes r\u00e9glementaires, normatifs et d&rsquo;audit\n    <\/text>\n  <\/g>\n\n  <!-- Arrows -->\n  <path class=\"arrow evidence\" d=\"M 200 320 L 420 360\"\/>\n  <path class=\"arrow evidence\" d=\"M 600 320 L 600 360\"\/>\n  <path class=\"arrow evidence\" d=\"M 1000 320 L 780 360\"\/>\n\n<\/svg>\n\n  <figcaption class=\"gp-rds-caption\">\n    Comparaison visuelle des r\u00e9glementations, normes et cadres d&rsquo;audit en cybers\u00e9curit\u00e9\n    et conformit\u00e9, montrant comment les preuves CI\/CD soutiennent les trois couches.\n<\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">1. <strong>R\u00e9glementations \u2014 ce qui doit \u00eatre atteint<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Obligations juridiquement contraignantes, impos\u00e9es par les r\u00e9gulateurs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Exemples<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/dora\/\" data-type=\"page\" data-id=\"919\">DORA<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/nis2\/\" data-type=\"page\" data-id=\"921\">NIS2<\/a><\/li>\n\n\n<li>RGPD<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Elles d\u00e9finissent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Les attentes en mati\u00e8re de r\u00e9silience op\u00e9rationnelle<\/li>\n\n\n\n<li>Les exigences de gestion des risques li\u00e9s aux TIC<\/li>\n\n\n\n<li>La gouvernance de la cha\u00eene d&rsquo;approvisionnement<\/li>\n\n\n\n<li>Les obligations de notification des incidents<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Tout manquement peut entra\u00eener des mesures de supervision ou des sanctions financi\u00e8res.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. <strong>Normes \u2014 comment les contr\u00f4les peuvent \u00eatre mis en \u0153uvre<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Des cadres de contr\u00f4le structur\u00e9s qui fournissent des orientations de mise en \u0153uvre.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Exemples<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/iso-27001\/\">ISO\/IEC 27001<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/pci-dss\/\">PCI DSS<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Elles d\u00e9crivent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Les objectifs de contr\u00f4le<\/li>\n\n\n\n<li>La gouvernance des processus<\/li>\n\n\n\n<li>Les pratiques de gestion de la s\u00e9curit\u00e9<\/li>\n\n\n\n<li>Les attentes en mati\u00e8re de preuves<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3. <strong>Cadres d&rsquo;audit et d&rsquo;assurance<\/strong> \u2014 validation ind\u00e9pendante<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Des cadres qui fournissent une assurance externe au moyen d&rsquo;audits.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Exemple<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/soc-2\/\">SOC 2<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ils produisent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Des rapports d&rsquo;audit ind\u00e9pendants<\/li>\n\n\n\n<li>L&rsquo;assurance donn\u00e9e aux clients<\/li>\n\n\n\n<li>La validation de la gouvernance<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Les audits ne cr\u00e9ent pas la conformit\u00e9.<br>Ils la v\u00e9rifient.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Le d\u00e9nominateur commun : les preuves techniques<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Quel que soit le cadre, <strong>ce sont les m\u00eames preuves techniques qui sont r\u00e9utilis\u00e9es<\/strong> :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Les journaux des pipelines CI\/CD<\/li>\n\n\n\n<li>Les approbations de changement<\/li>\n\n\n\n<li>Les revues de pull requests<\/li>\n\n\n\n<li>Les <a href=\"https:\/\/regulated-devsecops.com\/fr\/glossary\/#sbom\">SBOM<\/a> et la provenance des <a href=\"https:\/\/regulated-devsecops.com\/fr\/glossary\/#artifact\">artefacts<\/a><\/li>\n\n\n\n<li>Security test results (<a href=\"https:\/\/regulated-devsecops.com\/fr\/glossary\/#sast\">SAST<\/a>, <a href=\"https:\/\/regulated-devsecops.com\/fr\/glossary\/#dast\">DAST<\/a>, <a href=\"https:\/\/regulated-devsecops.com\/fr\/glossary\/#sca\">SCA<\/a>)<\/li>\n\n\n\n<li>L&rsquo;historique des d\u00e9ploiements<\/li>\n\n\n\n<li>La surveillance et les chronologies d&rsquo;incidents<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ces preuves doivent \u00eatre :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>G\u00e9n\u00e9r\u00e9es en continu<\/li>\n\n\n\n<li>Corr\u00e9l\u00e9es entre les syst\u00e8mes<\/li>\n\n\n\n<li>Inalt\u00e9rables<\/li>\n\n\n\n<li>Conserv\u00e9es avec une gouvernance des acc\u00e8s<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Sans preuves fiables, la conformit\u00e9 ne peut \u00eatre d\u00e9montr\u00e9e.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>La conformit\u00e9 tout au long du cycle de livraison logicielle<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dans les environnements r\u00e9glement\u00e9s, <strong>chaque changement doit pouvoir \u00eatre justifi\u00e9<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La conformit\u00e9 couvre donc l&rsquo;ensemble du cycle de vie :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Les d\u00e9cisions de conception<\/li>\n\n\n\n<li>Les commits de code<\/li>\n\n\n\n<li>L&rsquo;ex\u00e9cution des pipelines<\/li>\n\n\n\n<li>Les approbations de mise en production<\/li>\n\n\n\n<li>L&rsquo;ex\u00e9cution en production<\/li>\n\n\n\n<li>La r\u00e9ponse aux incidents<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Un SDLC conforme cr\u00e9e une cha\u00eene v\u00e9rifiable :<br><strong>Gouvernance \u2192 Livraison \u2192 Ex\u00e9cution \u2192 Conservation<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">O\u00f9 :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>La gouvernance d\u00e9finit les responsabilit\u00e9s et les politiques<\/li>\n\n\n\n<li>La livraison applique les contr\u00f4les<\/li>\n\n\n\n<li>L&rsquo;ex\u00e9cution g\u00e9n\u00e8re des preuves op\u00e9rationnelles<\/li>\n\n\n\n<li>La conservation pr\u00e9serve l&rsquo;auditabilit\u00e9<\/li>\n<\/ul>\n\n\n\n<!-- GeneratePress Inline SVG \u2013 Regulated DevSecOps -->\n<figure class=\"gp-rds-diagram\">\n  <svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\"\n       viewBox=\"0 0 1200 520\"\n       role=\"img\"\n       aria-labelledby=\"gp-rds-title gp-rds-desc\"\n       class=\"gp-rds-svg\">\n\n    <title id=\"gp-rds-title\">\n      Cha\u00eene de preuves de conformit\u00e9 et d&rsquo;audit pour un SDLC r\u00e9glement\u00e9\n    <\/title>\n\n    <desc id=\"gp-rds-desc\">\n      Diagramme illustrant la cha\u00eene de preuves d&rsquo;audit tout au long d&rsquo;un cycle de vie logiciel r\u00e9glement\u00e9 :\nidentit\u00e9, gestion des changements, contr\u00f4les du pipeline, int\u00e9grit\u00e9 des artefacts, surveillance en production et conservation.\n    <\/desc>\n\n    <style>\n  \/* Default = light *\/\n    :root{\n      --bg: transparent;\n      --text: #0f172a;\n      --muted: #475569;\n      --stroke: #cbd5e1;\n      --card: #ffffff;\n      --accent: #2563eb;\n      --accentSoft:#dbeafe;\n      --warn:#f59e0b;\n      --warnSoft:#fffbeb;\n    }\n    \/* Optional dark theme *\/\n    svg[data-theme=\"dark\"]{\n        --text:#e5e7eb;\n        --muted:#9ca3af;\n        --stroke:#374151;\n        --card:#0b1220;\n        --accent:#60a5fa;\n        --accentSoft:#0b2a55;\n        --warn:#fbbf24;\n        --warnSoft:#2a1f0b;\n    } \n\n    .txt{font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Arial, \"Noto Sans\", \"Liberation Sans\", sans-serif;}\n    .title{font-weight:700; font-size:22px; fill:var(--text);}\n    .sub{font-weight:500; font-size:14px; fill:var(--muted);}\n    .label{font-weight:700; font-size:14px; fill:var(--text);}\n    .small{font-weight:500; font-size:12px; fill:var(--muted);}\n    .card{fill:var(--card); stroke:var(--stroke); stroke-width:1.5; rx:14;}\n    .lane{fill:transparent; stroke:var(--stroke); stroke-width:1.5; rx:16; stroke-dasharray:6 6;}\n    .laneTitle{font-weight:800; font-size:12px; fill:var(--muted); letter-spacing:.05em;}\n    .flow{fill:none; stroke:var(--stroke); stroke-width:2.5; stroke-linecap:round; stroke-linejoin:round;}\n    .arrow{marker-end:url(#arrow);}\n    .chip{fill:transparent; stroke:var(--stroke); stroke-width:1.5;}\n    .chipText{font-weight:700; font-size:12px; fill:var(--text);}\n    .chipBlue{fill:var(--accentSoft); stroke:var(--accent);}\n    .chipWarn{fill:var(--warnSoft); stroke:var(--warn);}\n    .chipTextMuted{font-weight:700; font-size:12px; fill:var(--muted);}\n  <\/style>\n\n  <defs>\n    <marker id=\"arrow\" viewBox=\"0 0 10 10\" refX=\"9.2\" refY=\"5\" markerWidth=\"7\" markerHeight=\"7\" orient=\"auto-start-reverse\">\n      <path d=\"M 0 0 L 10 5 L 0 10 z\" fill=\"var(--stroke)\"\/>\n    <\/marker>\n  <\/defs>\n\n  <!-- Background -->\n  <rect x=\"0\" y=\"0\" width=\"1200\" height=\"460\" fill=\"var(--bg)\"\/>\n\n  <!-- Header -->\n  <text class=\"txt title\" x=\"40\" y=\"48\">Cha\u00eene de preuves de conformit\u00e9 et d&rsquo;audit<\/text>\n  <text class=\"txt sub\" x=\"40\" y=\"74\">SDLC r\u00e9glement\u00e9 : contr\u00f4les de gouvernance et preuves v\u00e9rifiables, du changement \u00e0 l&rsquo;ex\u00e9cution<\/text>\n\n  <!-- Lanes -->\n  <!-- Lane 1: Governance -->\n  <g>\n    <rect class=\"lane\" x=\"40\" y=\"100\" width=\"1120\" height=\"110\" rx=\"16\"\/>\n    <text class=\"txt laneTitle\" x=\"60\" y=\"126\">GOUVERNANCE<\/text>\n\n    <g transform=\"translate(60,142)\">\n      <rect class=\"chip chipBlue\" x=\"0\" y=\"0\" width=\"200\" height=\"30\" rx=\"6\"\/>\n      <text class=\"txt chipText\" x=\"100\" y=\"20\" text-anchor=\"middle\">Identit\u00e9s et acc\u00e8s (IAM)<\/text>\n    <\/g>\n\n    <g transform=\"translate(280,142)\">\n      <rect class=\"chip chipBlue\" x=\"0\" y=\"0\" width=\"220\" height=\"30\" rx=\"6\"\/>\n      <text class=\"txt chipText\" x=\"110\" y=\"20\" text-anchor=\"middle\">Gestion des changements<\/text>\n    <\/g>\n\n    <g transform=\"translate(520,142)\">\n      <rect class=\"chip chipBlue\" x=\"0\" y=\"0\" width=\"250\" height=\"30\" rx=\"6\"\/>\n      <text class=\"txt chipText\" x=\"125\" y=\"20\" text-anchor=\"middle\">S\u00e9paration des t\u00e2ches<\/text>\n    <\/g>\n\n    <g transform=\"translate(790,142)\">\n      <rect class=\"chip chipBlue\" x=\"0\" y=\"0\" width=\"330\" height=\"30\" rx=\"6\"\/>\n      <text class=\"txt chipText\" x=\"165\" y=\"20\" text-anchor=\"middle\">Politiques, normes et exceptions<\/text>\n    <\/g>\n  <\/g>\n\n  <!-- Lane 2: Delivery Evidence -->\n  <g>\n    <rect class=\"lane\" x=\"40\" y=\"230\" width=\"1120\" height=\"150\" rx=\"16\"\/>\n    <text class=\"txt laneTitle\" x=\"60\" y=\"256\">PREUVES DE LIVRAISON<\/text>\n\n    <!-- Cards -->\n    <g transform=\"translate(60,270)\">\n      <rect class=\"card\" x=\"0\" y=\"0\" width=\"250\" height=\"90\" rx=\"14\"\/>\n      <text class=\"txt label\" x=\"16\" y=\"28\">Demande de changement<\/text>\n      <text class=\"txt small\" x=\"16\" y=\"50\">Ticket \u2022 approbation \u2022 p\u00e9rim\u00e8tre<\/text>\n      <g transform=\"translate(16,60)\">\n        <rect class=\"chip\" x=\"0\" y=\"0\" width=\"218\" height=\"26\" rx=\"6\"\/>\n        <text class=\"txt chipText\" x=\"109\" y=\"18\" text-anchor=\"middle\">ID de tra\u00e7abilit\u00e9<\/text>\n      <\/g>\n    <\/g>\n\n    <g transform=\"translate(335,270)\">\n      <rect class=\"card\" x=\"0\" y=\"0\" width=\"260\" height=\"90\" rx=\"14\"\/>\n      <text class=\"txt label\" x=\"16\" y=\"28\">Pull request<\/text>\n      <text class=\"txt small\" x=\"16\" y=\"50\">Revues \u2022 v\u00e9rifications \u2022 validation<\/text>\n      <g transform=\"translate(16,60)\">\n        <rect class=\"chip\" x=\"0\" y=\"0\" width=\"228\" height=\"26\" rx=\"6\"\/>\n        <text class=\"txt chipText\" x=\"114\" y=\"18\" text-anchor=\"middle\">Preuve de revue<\/text>\n      <\/g>\n    <\/g>\n\n    <g transform=\"translate(620,270)\">\n      <rect class=\"card\" x=\"0\" y=\"0\" width=\"260\" height=\"90\" rx=\"14\"\/>\n      <text class=\"txt label\" x=\"16\" y=\"28\">Ex\u00e9cution CI\/CD<\/text>\n      <text class=\"txt small\" x=\"16\" y=\"50\">SAST \u2022 SCA \u2022 DAST \u2022 SBOM<\/text>\n      <g transform=\"translate(16,60)\">\n        <rect class=\"chip\" x=\"0\" y=\"0\" width=\"228\" height=\"26\" rx=\"6\"\/>\n        <text class=\"txt chipText\" x=\"114\" y=\"18\" text-anchor=\"middle\">Journaux du pipeline<\/text>\n      <\/g>\n    <\/g>\n\n    <g transform=\"translate(905,270)\">\n      <rect class=\"card\" x=\"0\" y=\"0\" width=\"255\" height=\"90\" rx=\"14\"\/>\n      <text class=\"txt label\" x=\"16\" y=\"28\">Version<\/text>\n      <text class=\"txt small\" x=\"16\" y=\"50\">Version \u2022 approbations \u2022 retour arri\u00e8re<\/text>\n      <g transform=\"translate(16,60)\">\n        <rect class=\"chip\" x=\"0\" y=\"0\" width=\"223\" height=\"26\" rx=\"6\"\/>\n        <text class=\"txt chipText\" x=\"111.5\" y=\"18\" text-anchor=\"middle\">Artefact de version<\/text>\n      <\/g>\n    <\/g>\n\n    <!-- Flow arrows inside lane -->\n    <path class=\"flow arrow\" d=\"M 310 315 L 335 315\"\/>\n    <path class=\"flow arrow\" d=\"M 595 315 L 620 315\"\/>\n    <path class=\"flow arrow\" d=\"M 880 315 L 905 315\"\/>\n  <\/g>\n\n  <!-- Lane 3: Runtime Evidence -->\n  <g>\n    <rect class=\"lane\" x=\"40\" y=\"395\" width=\"1120\" height=\"50\" rx=\"16\"\/>\n    <text class=\"txt laneTitle\" x=\"60\" y=\"422\">PREUVES D&rsquo;EX\u00c9CUTION ET CONSERVATION<\/text>\n\n    <g transform=\"translate(380,410)\">\n      <rect class=\"chip chipWarn\" x=\"0\" y=\"0\" width=\"220\" height=\"28\" rx=\"6\"\/>\n      <text class=\"txt chipText\" x=\"110\" y=\"19\" text-anchor=\"middle\">Journalisation centralis\u00e9e<\/text>\n    <\/g>\n\n    <g transform=\"translate(610,410)\">\n      <rect class=\"chip chipWarn\" x=\"0\" y=\"0\" width=\"250\" height=\"28\" rx=\"6\"\/>\n      <text class=\"txt chipText\" x=\"125\" y=\"19\" text-anchor=\"middle\">Surveillance de s\u00e9curit\u00e9<\/text>\n    <\/g>\n\n    <g transform=\"translate(870,410)\">\n      <rect class=\"chip chipWarn\" x=\"0\" y=\"0\" width=\"250\" height=\"28\" rx=\"6\"\/>\n      <text class=\"txt chipText\" x=\"125\" y=\"19\" text-anchor=\"middle\">Conservation et contr\u00f4le d&rsquo;acc\u00e8s<\/text>\n    <\/g>\n  <\/g>\n\n  <!-- Footer note -->\n  <text class=\"txt small\" x=\"40\" y=\"460\"> Chaque changement est tra\u00e7able, chaque contr\u00f4le produit une preuve, et les preuves sont conserv\u00e9es avec une gouvernance des acc\u00e8s.<\/text>\n\n  <\/svg>\n\n  <figcaption class=\"gp-rds-caption\">\n    Les cadres r\u00e9glementaires exigent des organisations qu&rsquo;elles d\u00e9montrent le contr\u00f4le, la tra\u00e7abilit\u00e9 et la responsabilit\u00e9 tout au long du d\u00e9veloppement, de la livraison et de l&rsquo;ex\u00e9cution. Les preuves de conformit\u00e9 doivent donc \u00eatre g\u00e9n\u00e9r\u00e9es en continu, et non a posteriori.\n  <\/figcaption>\n<\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Contr\u00f4les de gouvernance<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La conformit\u00e9 commence par la gouvernance :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Gestion des identit\u00e9s et des acc\u00e8s<\/li>\n\n\n\n<li>S\u00e9paration des t\u00e2ches<\/li>\n\n\n\n<li>Politiques de gestion des changements<\/li>\n\n\n\n<li>Proc\u00e9dures de traitement des exceptions<\/li>\n\n\n\n<li>Gestion des risques fournisseurs<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">La gouvernance d\u00e9finit les r\u00e8gles.<br>L&rsquo;architecture les applique.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Preuves de livraison (CI\/CD)<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Les pipelines CI\/CD doivent produire :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>La tra\u00e7abilit\u00e9 des demandes de changement<\/li>\n\n\n\n<li>Les approbations de pull requests<\/li>\n\n\n\n<li>Les r\u00e9sultats des tests de s\u00e9curit\u00e9 automatis\u00e9s<\/li>\n\n\n\n<li>Les d\u00e9cisions des points de contr\u00f4le de politique<\/li>\n\n\n\n<li>Les artefacts de version sign\u00e9s<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Dans les environnements r\u00e9glement\u00e9s, les pipelines fonctionnent comme des syst\u00e8mes de contr\u00f4le \u2014 et pas seulement comme des outils d&rsquo;automatisation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Preuves d&rsquo;ex\u00e9cution et conservation<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Les environnements de production doivent fournir :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Une journalisation centralis\u00e9e<\/li>\n\n\n\n<li>Une surveillance de s\u00e9curit\u00e9<\/li>\n\n\n\n<li>Un suivi des incidents<\/li>\n\n\n\n<li>La conservation et la gouvernance des acc\u00e8s<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Les preuves doivent rester accessibles pour l&rsquo;audit \u2014 parfois des ann\u00e9es apr\u00e8s le d\u00e9ploiement.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Chaque changement est tra\u00e7able.<br>Chaque contr\u00f4le produit une preuve.<br>Les preuves sont conserv\u00e9es et accessibles pour l&rsquo;audit.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>La conformit\u00e9 dans les environnements d&rsquo;entreprise r\u00e9glement\u00e9s<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Les secteurs r\u00e9glement\u00e9s \u2014 banque, assurance, sant\u00e9, infrastructures critiques \u2014 sont soumis \u00e0 <strong>de multiples obligations qui se chevauchent<\/strong>, notamment :<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">R\u00e9glementations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/dora\/\" data-type=\"page\" data-id=\"919\">DORA<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/nis2\/\" data-type=\"page\" data-id=\"921\">NIS2<\/a><\/li>\n\n\n<li>RGPD<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Normes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/iso-27001\/\">ISO\/IEC 27001<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/pci-dss\/\">PCI DSS<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cadres d&rsquo;audit<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SOC 2<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ces cadres diff\u00e8rent par leur port\u00e9e, mais partagent une exigence :<br>\ud83d\udc49 Un contr\u00f4le d\u00e9montrable et continu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La conformit\u00e9 ne peut reposer sur les seuls audits p\u00e9riodiques.<br>Elle doit \u00eatre int\u00e9gr\u00e9e aux op\u00e9rations quotidiennes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Les contr\u00f4les de conformit\u00e9 par cat\u00e9gorie<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Une conformit\u00e9 efficace repose sur un ensemble \u00e9quilibr\u00e9 de contr\u00f4les :<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Pr\u00e9ventifs<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Contr\u00f4le d&rsquo;acc\u00e8s<\/li>\n\n\n\n<li>Application des politiques<\/li>\n\n\n\n<li>Param\u00e8tres s\u00e9curis\u00e9s par d\u00e9faut<\/li>\n\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/glossary\/#segregation-of-duties\">S\u00e9paration des t\u00e2ches<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>D\u00e9tectifs<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Journalisation<\/li>\n\n\n\n<li>Surveillance<\/li>\n\n\n\n<li>Tests de s\u00e9curit\u00e9 en continu<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Correctifs<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>La r\u00e9ponse aux incidents<\/li>\n\n\n\n<li>M\u00e9canismes de retour arri\u00e8re<\/li>\n\n\n\n<li>Suivi des rem\u00e9diations<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Une organisation mature \u00e9quilibre ces trois cat\u00e9gories.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Conformit\u00e9 continue<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dans les environnements r\u00e9glement\u00e9s modernes :<br>La conformit\u00e9 n&rsquo;est pas un \u00e9v\u00e9nement annuel.<br>Elle est continue.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Les pipelines CI\/CD la rendent possible en :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Automatisant l&rsquo;application des politiques<\/li>\n\n\n\n<li>Bloquant les changements non conformes<\/li>\n\n\n\n<li>G\u00e9n\u00e9rant des journaux pr\u00eats pour l&rsquo;audit<\/li>\n\n\n\n<li>Pr\u00e9servant la tra\u00e7abilit\u00e9 d\u00e8s la conception<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Lorsque l&rsquo;architecture applique le contr\u00f4le, la conformit\u00e9 devient une propri\u00e9t\u00e9 du syst\u00e8me. Voir <a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/continuous-compliance-via-ci-cd\/\">Conformit\u00e9 continue via CI\/CD<\/a> et <a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/continuous-auditing-vs-point-in-time-audits\/\">Audit continu vs audits ponctuels<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Analyses r\u00e9glementaires approfondies<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ce site couvre en profondeur cinq cadres r\u00e9glementaires et d&rsquo;assurance. Chaque page de r\u00e9f\u00e9rence propose des orientations propres \u00e0 la r\u00e9glementation, des cartographies de contr\u00f4les, des listes de v\u00e9rification pour auditeurs et des r\u00e9f\u00e9rences de preuves.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th><strong>Cadre<\/strong><\/th><th><strong>Type<\/strong><\/th><th><strong>P\u00e9rim\u00e8tre<\/strong><\/th><th><strong>Page de r\u00e9f\u00e9rence<\/strong><\/th><\/tr><\/thead><tbody><tr><td><strong>DORA<\/strong><\/td><td>R\u00e9glementation<\/td><td>Entit\u00e9s financi\u00e8res de l&rsquo;UE \u2014 risques TIC, gouvernance des tiers, tests de r\u00e9silience<\/td><td><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/dora\/\">R\u00e9f\u00e9rence DORA<\/a><\/td><\/tr><tr><td><strong>NIS2<\/strong><\/td><td>R\u00e9glementation<\/td><td>Entit\u00e9s essentielles et importantes \u2014 cha\u00eene d&rsquo;approvisionnement, notification des incidents, gestion des risques<\/td><td><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/nis2\/\">R\u00e9f\u00e9rence NIS2<\/a><\/td><\/tr><tr><td><strong>ISO 27001<\/strong><\/td><td>Norme<\/td><td>Toute organisation \u2014 SMSI, contr\u00f4les de l&rsquo;annexe A, certification<\/td><td><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/iso-27001\/\">R\u00e9f\u00e9rence ISO 27001<\/a><\/td><\/tr><tr><td><strong>SOC 2<\/strong><\/td><td>Assurance<\/td><td>Organismes de services \u2014 crit\u00e8res des services de confiance (Trust Service Criteria), rapports de type I\/II<\/td><td><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/soc-2\/\">R\u00e9f\u00e9rence SOC 2<\/a><\/td><\/tr><tr><td><strong>PCI DSS<\/strong><\/td><td>Norme<\/td><td>Environnements de donn\u00e9es des titulaires de carte \u2014 d\u00e9veloppement s\u00e9curis\u00e9, acc\u00e8s, journalisation<\/td><td><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/pci-dss\/\">R\u00e9f\u00e9rence PCI DSS<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>DORA<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/dora-compliance-architecture-ci-cd-as-a-regulated-ict-system\/\">Architecture de conformit\u00e9 DORA \u2014 le CI\/CD comme syst\u00e8me TIC r\u00e9glement\u00e9<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/dora-article-21-deep-dive-enforcing-ict-risk-controls-via-ci-cd\/\">DORA article 21, analyse approfondie \u2014 contr\u00f4les des risques TIC<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/dora-article-28-explained-managing-ict-third-party-risk-in-ci-cd-and-cloud-environments\/\">DORA article 28 \u2014 risques TIC li\u00e9s aux tiers<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/dora-article-28-auditor-checklist\/\">DORA article 28 \u2014 liste de v\u00e9rification pour l&rsquo;auditeur<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>NIS2<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/nis2-security-architecture-explained\/\">L&rsquo;architecture de s\u00e9curit\u00e9 NIS2 expliqu\u00e9e<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/ci-cd-governance\/nis2-article-21-ci-cd-controls-mapping\/\">NIS2 article 21 \u2014 cartographie des contr\u00f4les CI\/CD<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/nis2-supply-chain-security-auditing-third-party-components-in-ci-cd\/\">S\u00e9curit\u00e9 de la cha\u00eene d&rsquo;approvisionnement NIS2 \u2014 auditer les composants tiers<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/nis2-audit-checklist-evidence-pack-for-compliance-officers\/\">Liste de v\u00e9rification d&rsquo;audit NIS2 \u2014 dossier de preuves<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>ISO 27001<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/ci-cd-governance\/iso-27001-annex-a-controls-mapped-to-ci-cd-pipelines\/\">Contr\u00f4les de l&rsquo;annexe A d&rsquo;ISO 27001 cartographi\u00e9s sur les pipelines CI\/CD<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/iso-27001-a-14-deep-dive-system-development-and-maintenance-in-ci-cd\/\">ISO 27001 A.14, analyse approfondie \u2014 d\u00e9veloppement et maintenance des syst\u00e8mes<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/iso-27001-certification-what-ci-cd-evidence-auditors-require\/\">Certification ISO 27001 \u2014 exigences de preuves CI\/CD<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>SOC 2<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/ci-cd-governance\/soc-2-trust-service-criteria-mapped-to-pipeline-controls\/\">Crit\u00e8res des services de confiance SOC 2 cartographi\u00e9s sur les contr\u00f4les de pipeline<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/soc-2-type-ii-sustained-ci-cd-evidence-requirements\/\">SOC 2 type II \u2014 exigences de preuves CI\/CD dans la dur\u00e9e<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/soc-2-readiness-assessment-ci-cd-specific-checklist\/\">\u00c9valuation de pr\u00e9paration SOC 2 \u2014 liste de v\u00e9rification propre au CI\/CD<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>PCI DSS<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/ci-cd-governance\/pci-dss-v4-0-software-delivery-requirements-requirement-6-deep-dive\/\">PCI DSS v4.0 \u2014 analyse approfondie de l&rsquo;exigence 6<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/pci-dss-and-ci-cd-what-qsas-need-to-verify\/\">PCI DSS et CI\/CD \u2014 ce que les QSA doivent v\u00e9rifier<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Comparaisons inter-r\u00e9glementations<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/cross-regulation-comparisons\/iso-27001-vs-dora-vs-nis2-controls-overlap-matrix\/\">ISO 27001 vs DORA vs NIS2 \u2014 matrice de recouvrement des contr\u00f4les<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/cross-regulation-comparisons\/nis2-vs-dora-overlap-analysis-for-dual-regulated-entities\/\">NIS2 vs DORA \u2014 analyse du recouvrement pour les entit\u00e9s doublement r\u00e9glement\u00e9es<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/dual-compliance-architecture-explained\/\">L&rsquo;architecture de double conformit\u00e9 expliqu\u00e9e<\/a><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Audit et preuves<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/audit-day-playbook-how-to-handle-ci-cd-audits-in-regulated-environments\/\">Briefing d&rsquo;audit pour dirigeants<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/how-auditors-actually-review-ci-cd-pipelines\/\">Comment les auditeurs examinent r\u00e9ellement les pipelines CI\/CD<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/audit-day-playbook-how-to-handle-ci-cd-audits-in-regulated-environments\/\">Guide pratique du jour de l&rsquo;audit<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/building-evidence-repository-continuous-compliance\/\">Construire un r\u00e9f\u00e9rentiel de preuves pour la conformit\u00e9 continue<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/continuous-auditing-vs-point-in-time-audits\/\">Audit continu vs audits ponctuels<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/audit-evidence\/common-audit-findings-ci-cd-top-10-failures\/\">Constats d&rsquo;audit fr\u00e9quents \u2014 les 10 principales d\u00e9faillances CI\/CD<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Domaines de s\u00e9curit\u00e9 connexes<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">La conformit\u00e9 n&rsquo;existe pas de mani\u00e8re isol\u00e9e.<br>Elle d\u00e9pend de :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/architecture\/\" data-type=\"page\" data-id=\"923\">Architecture<\/a><\/strong> \u2014 mod\u00e8les d&rsquo;application et conception des syst\u00e8mes<\/li>\n\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/ci-cd-security\/\" data-type=\"page\" data-id=\"11\"><strong>S\u00e9curit\u00e9 CI\/CD<\/strong> <\/a>\u2014 les pipelines comme syst\u00e8mes r\u00e9glement\u00e9s<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/devsecops\/\" data-type=\"page\" data-id=\"13\">DevSecOps<\/a><\/strong> \u2014 des m\u00e9thodes de travail s\u00e9curis\u00e9es<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/application-security\/\" data-type=\"page\" data-id=\"746\">S\u00e9curit\u00e9 applicative<\/a><\/strong> \u2014 conception s\u00e9curis\u00e9e et protection \u00e0 l&rsquo;ex\u00e9cution<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ensemble, ces domaines cr\u00e9ent une r\u00e9silience continue et auditable.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Principe final<\/strong><\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Dans les environnements r\u00e9glement\u00e9s, la conformit\u00e9 ne consiste pas \u00e0 produire des rapports. Elle consiste \u00e0 exercer un contr\u00f4le.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Si vos syst\u00e8mes appliquent les politiques, g\u00e9n\u00e8rent la tra\u00e7abilit\u00e9 et conservent les preuves d\u00e8s la conception, les audits deviennent de simples exercices de v\u00e9rification. Si les contr\u00f4les sont informels ou manuels, la conformit\u00e9 se transforme en reconstruction.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Ressources connexes pour les auditeurs<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/glossary\/\">Glossaire<\/a> \u2014 d\u00e9finitions en langage clair des termes techniques<\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/start-here\/\">Commencez ici \u2014 guide de l&rsquo;auditeur pour la s\u00e9curit\u00e9 CI\/CD<\/a><\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/resources\/\">R\u00e9pertoire complet des ressources<\/a> \u2014 listes de v\u00e9rification, dossiers de preuves, cartographies de contr\u00f4les<\/li>\n\n\n<li><a href=\"https:\/\/regulated-devsecops.com\/fr\/architecture\/\">Architecture<\/a> \u2014 comment le CI\/CD applique les contr\u00f4les d\u00e8s la conception<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>La conformit\u00e9 comme propri\u00e9t\u00e9 technique \u2014 pas un exercice documentaire Dans les environnements r\u00e9glement\u00e9s, la conformit\u00e9 ne consiste pas \u00e0 produire des documents.Il s&rsquo;agit de d\u00e9montrer le contr\u00f4le. Les r\u00e9gulateurs, auditeurs et autorit\u00e9s de supervision attendent des organisations qu&rsquo;elles prouvent : La conformit\u00e9 moderne doit \u00eatre int\u00e9gr\u00e9e directement dans : La conformit\u00e9 doit \u00eatre g\u00e9n\u00e9r\u00e9e &#8230; <a title=\"Conformit\u00e9\" class=\"read-more\" href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/\" aria-label=\"En savoir plus sur Conformit\u00e9\">Lire la suite<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":5,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-1460","page","type-page","status-publish"],"_links":{"self":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/pages\/1460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/comments?post=1460"}],"version-history":[{"count":0,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/pages\/1460\/revisions"}],"wp:attachment":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/media?parent=1460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}