{"id":1411,"date":"2026-02-11T18:03:46","date_gmt":"2026-02-11T17:03:46","guid":{"rendered":"https:\/\/regulated-devsecops.com\/uncategorized\/third-party-risk-in-ci-cd-pipelines-under-dora-article-28-2\/"},"modified":"2026-07-07T10:43:47","modified_gmt":"2026-07-07T09:43:47","slug":"third-party-risk-in-ci-cd-pipelines-under-dora-article-28","status":"publish","type":"post","link":"https:\/\/regulated-devsecops.com\/fr\/regulatory-frameworks\/third-party-risk-in-ci-cd-pipelines-under-dora-article-28\/","title":{"rendered":"Le risque tiers dans les pipelines CI\/CD au titre de l&rsquo;article 28 de DORA"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">L&rsquo;article 28 de DORA impose aux entit\u00e9s financi\u00e8res de g\u00e9rer les risques introduits par les <strong>prestataires tiers de services TIC<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dans la livraison logicielle moderne, les pipelines CI\/CD figurent parmi les <strong>syst\u00e8mes les plus d\u00e9pendants de tiers<\/strong> de l&rsquo;organisation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Les plateformes Git, les ex\u00e9cuteurs CI, les plugins et les registres d&rsquo;artefacts ne sont pas de simples choix d&rsquo;outillage : ce sont des <strong>services externes int\u00e9gr\u00e9s<\/strong> qui influent directement sur l&rsquo;int\u00e9grit\u00e9, la disponibilit\u00e9 et la r\u00e9silience op\u00e9rationnelle du logiciel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cet article porte sp\u00e9cifiquement sur le <strong>risque tiers au sein des pipelines CI\/CD<\/strong> : il explique o\u00f9 ces risques apparaissent, comment s&rsquo;applique l&rsquo;article 28 de DORA et quels contr\u00f4les les auditeurs s&rsquo;attendent \u00e0 voir appliqu\u00e9s.<\/p>\n\n\n\n<!-- GeneratePress Inline SVG \u2013 Regulated DevSecOps -->\n<figure class=\"gp-rds-diagram\">\n<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\"\n     viewBox=\"0 0 1200 520\"\n     role=\"img\"\n     aria-labelledby=\"title desc\"\n     data-theme=\"light\">\n  <title id=\"title\">Article 28 de DORA \u2014 Outils \u2192 Contr\u00f4les \u2192 Preuves<\/title>\n  <desc id=\"desc\">\n    Sch\u00e9ma reliant l&rsquo;outillage DevSecOps d&rsquo;entreprise aux contr\u00f4les CI\/CD applicables et aux preuves d&rsquo;audit qui en r\u00e9sultent,\n    avec les exigences transverses de gouvernance des tiers de l&rsquo;article 28 de DORA.\n  <\/desc>\n\n  <style>\n    :root{\n      --bg:transparent;\n      --text:#0f172a;\n      --muted:#475569;\n      --stroke:#cbd5e1;\n      --card:#ffffff;\n\n      --accent:#2563eb;\n      --accentSoft:#dbeafe;\n\n      --sec:#7c3aed;\n      --secSoft:#ede9fe;\n\n      --ev:#059669;\n      --evSoft:#d1fae5;\n\n      --warn:#b45309;\n      --warnSoft:#ffedd5;\n    }\n\n    svg[data-theme=\"dark\"]{\n      --text:#e5e7eb;\n      --muted:#9ca3af;\n      --stroke:#374151;\n      --card:#0b1220;\n\n      --accent:#60a5fa;\n      --accentSoft:#0b2a55;\n\n      --sec:#a78bfa;\n      --secSoft:#2a144d;\n\n      --ev:#34d399;\n      --evSoft:#063a2c;\n\n      --warn:#f59e0b;\n      --warnSoft:#3b2a07;\n    }\n\n    .txt{font-family:ui-sans-serif,system-ui,-apple-system,Segoe UI,Roboto,Arial;}\n    .title{font-weight:800;font-size:22px;fill:var(--text);}\n    .sub{font-weight:500;font-size:14px;fill:var(--muted);}\n\n    .label{font-weight:900;font-size:12px;fill:var(--text);letter-spacing:.06em;}\n    .h{font-weight:800;font-size:14px;fill:var(--text);}\n    .small{font-weight:600;font-size:12px;fill:var(--muted);}\n\n    .card{fill:var(--card);stroke:var(--stroke);stroke-width:1.5;rx:14;}\n    .panel{fill:transparent;stroke:var(--stroke);stroke-width:1.5;rx:14;stroke-dasharray:6 6;}\n\n    .chip{fill:transparent;stroke:var(--stroke);stroke-width:1.5;rx:7;}\n    .chipText{font-weight:800;font-size:12px;fill:var(--text);}\n\n    .tools .chip{stroke:var(--accent);fill:var(--accentSoft);}\n    .controls .chip{stroke:var(--sec);fill:var(--secSoft);}\n    .evidence .chip{stroke:var(--ev);fill:var(--evSoft);}\n    .warn .chip{stroke:var(--warn);fill:var(--warnSoft);}\n\n    .flow{fill:none;stroke:var(--stroke);stroke-width:2.5;stroke-linecap:round;stroke-linejoin:round;}\n    .arrow{marker-end:url(#arrow);}\n    .link{fill:none;stroke:var(--accent);stroke-width:2.5;stroke-linecap:round;stroke-dasharray:7 7;opacity:.85;}\n\n    .band{fill:transparent;stroke:var(--stroke);stroke-width:1.5;rx:14;stroke-dasharray:6 6;}\n    .bandTitle{font-weight:900;font-size:12px;fill:var(--muted);letter-spacing:.06em;}\n  <\/style>\n\n  <defs>\n    <marker id=\"arrow\" viewBox=\"0 0 10 10\" refX=\"9.2\" refY=\"5\" markerWidth=\"7\" markerHeight=\"7\" orient=\"auto\">\n      <path d=\"M0 0 L10 5 L0 10 Z\" fill=\"var(--stroke)\"\/>\n    <\/marker>\n  <\/defs>\n\n  <!-- Header -->\n  <text class=\"txt title\" x=\"40\" y=\"48\">Outils \u2192 Contr\u00f4les \u2192 Preuves<\/text>\n  <text class=\"txt sub\" x=\"40\" y=\"74\">Vision article 28 de DORA : gouvernance des TIC tiers appliqu\u00e9e via des contr\u00f4les CI\/CD et des preuves d\u00e9montrables.<\/text>\n\n  <!-- Cross-cutting controls band -->\n  <g transform=\"translate(40,92)\">\n    <rect class=\"band\" x=\"0\" y=\"0\" width=\"1120\" height=\"62\"\/>\n    <text class=\"txt bandTitle\" x=\"18\" y=\"36\">TRANSVERSE (ARTICLE 28)<\/text>\n\n    <g class=\"warn\" transform=\"translate(320,16)\">\n      <rect class=\"chip\" x=\"0\" y=\"0\" width=\"170\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"85\" y=\"20\" text-anchor=\"middle\">Gouvernance fournisseurs<\/text>\n    <\/g>\n\n    <g class=\"warn\" transform=\"translate(500,16)\">\n      <rect class=\"chip\" x=\"0\" y=\"0\" width=\"150\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"75\" y=\"20\" text-anchor=\"middle\">Clauses contractuelles<\/text>\n    <\/g>\n\n    <g class=\"warn\" transform=\"translate(660,16)\">\n      <rect class=\"chip\" x=\"0\" y=\"0\" width=\"120\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"60\" y=\"20\" text-anchor=\"middle\">Surveillance<\/text>\n    <\/g>\n\n    <g class=\"warn\" transform=\"translate(790,16)\">\n      <rect class=\"chip\" x=\"0\" y=\"0\" width=\"110\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"55\" y=\"20\" text-anchor=\"middle\">Plan de sortie<\/text>\n    <\/g>\n\n    <g class=\"warn\" transform=\"translate(910,16)\">\n      <rect class=\"chip\" x=\"0\" y=\"0\" width=\"190\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"95\" y=\"20\" text-anchor=\"middle\">Conservation des preuves<\/text>\n    <\/g>\n  <\/g>\n\n  <!-- Main panels -->\n  <g transform=\"translate(40,160)\">\n    <rect class=\"panel\" x=\"0\" y=\"0\" width=\"1120\" height=\"300\"\/>\n    <text class=\"txt label\" x=\"18\" y=\"28\">COUCHE DE CORRESPONDANCE<\/text>\n  <\/g>\n\n  <!-- Column titles -->\n  <text class=\"txt h\" x=\"120\" y=\"210\">Outils<\/text>\n  <text class=\"txt small\" x=\"120\" y=\"232\">Plateformes &amp; services<\/text>\n\n  <text class=\"txt h\" x=\"520\" y=\"210\">Contr\u00f4les<\/text>\n  <text class=\"txt small\" x=\"520\" y=\"232\">Exigences appliqu\u00e9es<\/text>\n\n  <text class=\"txt h\" x=\"900\" y=\"210\">Preuves<\/text>\n  <text class=\"txt small\" x=\"900\" y=\"232\">Ce que v\u00e9rifient les auditeurs<\/text>\n\n  <!-- Tools cards -->\n  <g transform=\"translate(80,250)\" class=\"tools\">\n    <rect class=\"card\" width=\"300\" height=\"190\"\/>\n    <text class=\"txt label\" x=\"18\" y=\"28\">OUTILS<\/text>\n\n    <g transform=\"translate(18,48)\">\n      <rect class=\"chip\" width=\"264\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"132\" y=\"20\" text-anchor=\"middle\">Git \/ h\u00e9bergement du code source<\/text>\n    <\/g>\n    <g transform=\"translate(18,84)\">\n      <rect class=\"chip\" width=\"264\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"132\" y=\"20\" text-anchor=\"middle\">Orchestrateur CI\/CD + ex\u00e9cuteurs<\/text>\n    <\/g>\n    <g transform=\"translate(18,120)\">\n      <rect class=\"chip\" width=\"264\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"132\" y=\"20\" text-anchor=\"middle\">Registres + d\u00e9pendances<\/text>\n    <\/g>\n    <g transform=\"translate(18,156)\">\n      <rect class=\"chip\" width=\"264\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"132\" y=\"20\" text-anchor=\"middle\">Runtime cloud + observabilit\u00e9<\/text>\n    <\/g>\n  <\/g>\n\n  <!-- Controls cards -->\n  <g transform=\"translate(450,250)\" class=\"controls\">\n    <rect class=\"card\" width=\"320\" height=\"190\"\/>\n    <text class=\"txt label\" x=\"18\" y=\"28\">CONTR\u00d4LES<\/text>\n\n    <g transform=\"translate(18,48)\">\n      <rect class=\"chip\" width=\"284\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"142\" y=\"20\" text-anchor=\"middle\">Contr\u00f4le d&rsquo;acc\u00e8s + MFA + SoD<\/text>\n    <\/g>\n    <g transform=\"translate(18,84)\">\n      <rect class=\"chip\" width=\"284\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"142\" y=\"20\" text-anchor=\"middle\">Approbations + points de contr\u00f4le<\/text>\n    <\/g>\n    <g transform=\"translate(18,120)\">\n      <rect class=\"chip\" width=\"284\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"142\" y=\"20\" text-anchor=\"middle\">Int\u00e9grit\u00e9 : SBOM + signature + provenance<\/text>\n    <\/g>\n    <g transform=\"translate(18,156)\">\n      <rect class=\"chip\" width=\"284\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"142\" y=\"20\" text-anchor=\"middle\">Surveillance + gestion des incidents<\/text>\n    <\/g>\n  <\/g>\n\n  <!-- Evidence cards -->\n  <g transform=\"translate(820,250)\" class=\"evidence\">\n    <rect class=\"card\" width=\"300\" height=\"190\"\/>\n    <text class=\"txt label\" x=\"18\" y=\"28\">PREUVES<\/text>\n\n    <g transform=\"translate(18,48)\">\n      <rect class=\"chip\" width=\"264\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"132\" y=\"20\" text-anchor=\"middle\">Journaux d&rsquo;audit + revues d&rsquo;acc\u00e8s<\/text>\n    <\/g>\n    <g transform=\"translate(18,84)\">\n      <rect class=\"chip\" width=\"264\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"132\" y=\"20\" text-anchor=\"middle\">Approbations &amp; tra\u00e7abilit\u00e9 des changements<\/text>\n    <\/g>\n    <g transform=\"translate(18,120)\">\n      <rect class=\"chip\" width=\"264\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"132\" y=\"20\" text-anchor=\"middle\">SBOM + attestations + signatures<\/text>\n    <\/g>\n    <g transform=\"translate(18,156)\">\n      <rect class=\"chip\" width=\"264\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"132\" y=\"20\" text-anchor=\"middle\">Donn\u00e9es de surveillance + registres d&rsquo;incidents<\/text>\n    <\/g>\n  <\/g>\n\n  <!-- Main flow arrows -->\n  <path class=\"flow arrow\" d=\"M 380 360 L 450 360\"\/>\n  <path class=\"flow arrow\" d=\"M 770 360 L 820 360\"\/>\n\n  <!-- Dotted alignment links (tool -> control -> evidence rows) -->\n  <!-- Row 1 -->\n  <path class=\"link\" d=\"M 360 313 L 470 313\"\/>\n  <path class=\"link\" d=\"M 750 313 L 840 313\"\/>\n  <!-- Row 2 -->\n  <path class=\"link\" d=\"M 360 349 L 470 349\"\/>\n  <path class=\"link\" d=\"M 750 349 L 840 349\"\/>\n  <!-- Row 3 -->\n  <path class=\"link\" d=\"M 360 385 L 470 385\"\/>\n  <path class=\"link\" d=\"M 750 385 L 840 385\"\/>\n  <!-- Row 4 -->\n  <path class=\"link\" d=\"M 360 421 L 470 421\"\/>\n  <path class=\"link\" d=\"M 750 421 L 840 421\"\/>\n\n  <!-- Footer note -->\n  <text class=\"txt small\" x=\"60\" y=\"500\">\n    Conseil : au titre de l&rsquo;article 28 de DORA, un outil n&rsquo;est acceptable que s&rsquo;il applique des contr\u00f4les et produit en continu des preuves auditables.\n  <\/text>\n<\/svg>\n\n  <figcaption class=\"gp-rds-caption\">\n    Sch\u00e9ma reliant l&rsquo;outillage DevSecOps d&rsquo;entreprise aux contr\u00f4les CI\/CD applicables et aux preuves d&rsquo;audit qui en r\u00e9sultent,\n    avec les exigences transverses de gouvernance des tiers de l&rsquo;article 28 de DORA.\n<\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Pourquoi les pipelines CI\/CD sont un point de concentration du risque tiers<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Les pipelines CI\/CD agr\u00e8gent de multiples d\u00e9pendances externes dans un flux d&rsquo;ex\u00e9cution unique :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>le code source est h\u00e9berg\u00e9 \u00e0 l&rsquo;ext\u00e9rieur,<\/li>\n\n\n\n<li>les builds s&rsquo;ex\u00e9cutent souvent sur une infrastructure partag\u00e9e ou g\u00e9r\u00e9e,<\/li>\n\n\n\n<li>du code tiers est r\u00e9cup\u00e9r\u00e9 automatiquement,<\/li>\n\n\n\n<li>les artefacts sont stock\u00e9s et distribu\u00e9s par des services externes.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Du point de vue de DORA, les pipelines CI\/CD repr\u00e9sentent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>des <strong>d\u00e9pendances TIC \u00e0 fort impact<\/strong>,<\/li>\n\n\n\n<li>dot\u00e9es d&rsquo;un <strong>acc\u00e8s privil\u00e9gi\u00e9<\/strong>,<\/li>\n\n\n\n<li>fonctionnant \u00e0 <strong>vitesse machine<\/strong>,<\/li>\n\n\n\n<li>et capables de propager des d\u00e9faillances ou des compromissions directement en production.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Par cons\u00e9quent, les plateformes CI\/CD doivent \u00eatre trait\u00e9es comme des <strong>services TIC tiers dans le p\u00e9rim\u00e8tre<\/strong> de l&rsquo;article 28.<\/p>\n\n\n\n<!-- GeneratePress Inline SVG \u2013 Regulated DevSecOps -->\n<figure class=\"gp-rds-diagram\">\n<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\"\n     viewBox=\"0 0 1200 560\"\n     role=\"img\"\n     aria-labelledby=\"title desc\"\n     data-theme=\"light\">\n  <title id=\"title_2\">Signaux d&rsquo;alerte CI\/CD \u2014 Article 28 de DORA (risque tiers)<\/title>\n  <desc id=\"desc_2\">\n    Sch\u00e9ma CI\/CD d&rsquo;entreprise mettant en \u00e9vidence les signaux d&rsquo;alerte fr\u00e9quents du risque tiers au titre de l&rsquo;article 28 de DORA :\n    absence de plan de sortie, ex\u00e9cuteurs partag\u00e9s, manque de visibilit\u00e9 sur les sous-traitants, absence de droits d&rsquo;audit,\n    et absence de conservation des preuves.\n  <\/desc>\n\n  <style>\n    :root{\n      --bg:transparent;\n      --text:#0f172a;\n      --muted:#475569;\n      --stroke:#cbd5e1;\n      --card:#ffffff;\n\n      --accent:#2563eb;\n      --accentSoft:#dbeafe;\n\n      --warn:#b91c1c;\n      --warnSoft:#fee2e2;\n\n      --ok:#059669;\n      --okSoft:#d1fae5;\n\n      --band:#0ea5e9;\n      --bandSoft:#e0f2fe;\n    }\n    svg[data-theme=\"dark\"]{\n      --text:#e5e7eb;\n      --muted:#9ca3af;\n      --stroke:#374151;\n      --card:#0b1220;\n\n      --accent:#60a5fa;\n      --accentSoft:#0b2a55;\n\n      --warn:#f87171;\n      --warnSoft:#3a0b10;\n\n      --ok:#34d399;\n      --okSoft:#063a2c;\n\n      --band:#38bdf8;\n      --bandSoft:#083047;\n    }\n\n    .txt{font-family:ui-sans-serif,system-ui,-apple-system,Segoe UI,Roboto,Arial;}\n    .title{font-weight:900;font-size:22px;fill:var(--text);}\n    .sub{font-weight:600;font-size:14px;fill:var(--muted);}\n\n    .label{font-weight:900;font-size:12px;fill:var(--text);letter-spacing:.06em;}\n    .h{font-weight:900;font-size:14px;fill:var(--text);}\n    .small{font-weight:700;font-size:12px;fill:var(--muted);}\n\n    .card{fill:var(--card);stroke:var(--stroke);stroke-width:1.5;rx:14;}\n    .chip{fill:transparent;stroke:var(--stroke);stroke-width:1.5;rx:7;}\n    .chipText{font-weight:900;font-size:12px;fill:var(--text);}\n\n    .flow{fill:none;stroke:var(--stroke);stroke-width:2.5;stroke-linecap:round;stroke-linejoin:round;}\n    .arrow{marker-end:url(#arrow);}\n\n    .band{fill:transparent;stroke:var(--stroke);stroke-width:1.5;rx:14;stroke-dasharray:6 6;}\n    .bandTitle{font-weight:900;font-size:12px;fill:var(--muted);letter-spacing:.06em;}\n    .bandChip{fill:var(--bandSoft);stroke:var(--band);stroke-width:1.5;rx:7;}\n    .bandText{font-weight:900;font-size:12px;fill:var(--text);}\n\n    .rf .chip{stroke:var(--warn);fill:var(--warnSoft);}\n    .rftext{font-weight:900;font-size:12px;fill:var(--text);}\n\n    .ok .chip{stroke:var(--ok);fill:var(--okSoft);}\n  <\/style>\n\n  <defs>\n    <marker id=\"arrow\" viewBox=\"0 0 10 10\" refX=\"9.2\" refY=\"5\" markerWidth=\"7\" markerHeight=\"7\" orient=\"auto\">\n      <path d=\"M0 0 L10 5 L0 10 Z\" fill=\"var(--stroke)\"\/>\n    <\/marker>\n  <\/defs>\n\n  <!-- Header -->\n  <text class=\"txt title\" x=\"40\" y=\"48\">Signaux d&rsquo;alerte CI\/CD \u2014 Article 28 de DORA<\/text>\n  <text class=\"txt sub\" x=\"40\" y=\"74\">D\u00e9faillances du risque tiers fr\u00e9quemment signal\u00e9es par les auditeurs sur Git, le SaaS CI\/CD, les ex\u00e9cuteurs, les registres et le runtime cloud.<\/text>\n\n  <!-- Cross-cutting band -->\n  <g transform=\"translate(40,92)\">\n    <rect class=\"band\" x=\"0\" y=\"0\" width=\"1120\" height=\"62\"\/>\n    <text class=\"txt bandTitle\" x=\"18\" y=\"36\">TRANSVERSE (ARTICLE 28)<\/text>\n\n    <g transform=\"translate(330,16)\">\n      <rect class=\"bandChip\" x=\"0\" y=\"0\" width=\"180\" height=\"30\"\/>\n      <text class=\"txt bandText\" x=\"90\" y=\"20\" text-anchor=\"middle\">Gouvernance fournisseurs<\/text>\n    <\/g>\n    <g transform=\"translate(520,16)\">\n      <rect class=\"bandChip\" x=\"0\" y=\"0\" width=\"160\" height=\"30\"\/>\n      <text class=\"txt bandText\" x=\"80\" y=\"20\" text-anchor=\"middle\">Droits d&rsquo;audit<\/text>\n    <\/g>\n    <g transform=\"translate(690,16)\">\n      <rect class=\"bandChip\" x=\"0\" y=\"0\" width=\"150\" height=\"30\"\/>\n      <text class=\"txt bandText\" x=\"75\" y=\"20\" text-anchor=\"middle\">Strat\u00e9gie de sortie<\/text>\n    <\/g>\n    <g transform=\"translate(850,16)\">\n      <rect class=\"bandChip\" x=\"0\" y=\"0\" width=\"220\" height=\"30\"\/>\n      <text class=\"txt bandText\" x=\"110\" y=\"20\" text-anchor=\"middle\">Conservation des preuves<\/text>\n    <\/g>\n  <\/g>\n\n  <!-- Pipeline row cards -->\n  <g transform=\"translate(40,175)\">\n    <!-- Git -->\n    <g transform=\"translate(0,0)\">\n      <rect class=\"card\" width=\"200\" height=\"130\"\/>\n      <text class=\"txt h\" x=\"18\" y=\"32\">H\u00e9bergement Git<\/text>\n      <text class=\"txt small\" x=\"18\" y=\"54\">SaaS GitHub \/ GitLab<\/text>\n      <g class=\"rf\" transform=\"translate(18,74)\">\n        <rect class=\"chip\" width=\"164\" height=\"30\"\/>\n        <text class=\"txt rftext\" x=\"82\" y=\"20\" text-anchor=\"middle\">Aucun droit d&rsquo;audit<\/text>\n      <\/g>\n    <\/g>\n\n    <!-- CI\/CD SaaS -->\n    <g transform=\"translate(220,0)\">\n      <rect class=\"card\" width=\"200\" height=\"130\"\/>\n      <text class=\"txt h\" x=\"18\" y=\"32\">SaaS CI\/CD<\/text>\n      <text class=\"txt small\" x=\"18\" y=\"54\">Orchestrateur<\/text>\n      <g class=\"rf\" transform=\"translate(18,74)\">\n        <rect class=\"chip\" width=\"164\" height=\"30\"\/>\n        <text class=\"txt rftext\" x=\"82\" y=\"20\" text-anchor=\"middle\">Aucun plan de sortie<\/text>\n      <\/g>\n    <\/g>\n\n    <!-- Runners -->\n    <g transform=\"translate(440,0)\">\n      <rect class=\"card\" width=\"200\" height=\"130\"\/>\n      <text class=\"txt h\" x=\"18\" y=\"32\">Ex\u00e9cuteurs CI<\/text>\n      <text class=\"txt small\" x=\"18\" y=\"54\">Ex\u00e9cution cloud<\/text>\n      <g class=\"rf\" transform=\"translate(18,74)\">\n        <rect class=\"chip\" width=\"164\" height=\"30\"\/>\n        <text class=\"txt rftext\" x=\"82\" y=\"20\" text-anchor=\"middle\">Ex\u00e9cuteurs partag\u00e9s<\/text>\n      <\/g>\n    <\/g>\n\n    <!-- Registries -->\n    <g transform=\"translate(660,0)\">\n      <rect class=\"card\" width=\"200\" height=\"130\"\/>\n      <text class=\"txt h\" x=\"18\" y=\"32\">Registres<\/text>\n      <text class=\"txt small\" x=\"18\" y=\"54\">Artefacts + images<\/text>\n      <g class=\"rf\" transform=\"translate(18,74)\">\n        <rect class=\"chip\" width=\"164\" height=\"30\"\/>\n        <text class=\"txt rftext\" x=\"82\" y=\"20\" text-anchor=\"middle\">Aucune conservation<\/text>\n      <\/g>\n    <\/g>\n\n    <!-- Cloud runtime -->\n    <g transform=\"translate(880,0)\">\n      <rect class=\"card\" width=\"220\" height=\"130\"\/>\n      <text class=\"txt h\" x=\"18\" y=\"32\">Runtime cloud<\/text>\n      <text class=\"txt small\" x=\"18\" y=\"54\">Services de production<\/text>\n      <g class=\"rf\" transform=\"translate(18,74)\">\n        <rect class=\"chip\" width=\"184\" height=\"30\"\/>\n        <text class=\"txt rftext\" x=\"92\" y=\"20\" text-anchor=\"middle\">Aucune vue sous-traitants<\/text>\n      <\/g>\n    <\/g>\n  <\/g>\n\n  <!-- Flow arrows between pipeline stages -->\n  <path class=\"flow arrow\" d=\"M 240 240 L 260 240\"\/>\n  <path class=\"flow arrow\" d=\"M 460 240 L 480 240\"\/>\n  <path class=\"flow arrow\" d=\"M 680 240 L 700 240\"\/>\n  <path class=\"flow arrow\" d=\"M 900 240 L 920 240\"\/>\n\n  <!-- Lower remediation hints -->\n  <g transform=\"translate(40,340)\">\n    <rect class=\"card\" width=\"1100\" height=\"170\"\/>\n    <text class=\"txt label\" x=\"18\" y=\"28\">PISTES DE REM\u00c9DIATION POUR LES ING\u00c9NIEURS<\/text>\n\n    <g class=\"ok\" transform=\"translate(18,52)\">\n      <rect class=\"chip\" width=\"260\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"130\" y=\"20\" text-anchor=\"middle\">Strat\u00e9gie de sortie test\u00e9e (CI\/CD)<\/text>\n    <\/g>\n    <g class=\"ok\" transform=\"translate(290,52)\">\n      <rect class=\"chip\" width=\"250\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"125\" y=\"20\" text-anchor=\"middle\">Ex\u00e9cuteurs d\u00e9di\u00e9s \/ isol\u00e9s<\/text>\n    <\/g>\n    <g class=\"ok\" transform=\"translate(550,52)\">\n      <rect class=\"chip\" width=\"270\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"135\" y=\"20\" text-anchor=\"middle\">Cartographie fournisseurs + sous-traitants<\/text>\n    <\/g>\n    <g class=\"ok\" transform=\"translate(830,52)\">\n      <rect class=\"chip\" width=\"260\" height=\"30\"\/>\n      <text class=\"txt chipText\" x=\"130\" y=\"20\" text-anchor=\"middle\">Journaux centralis\u00e9s + conservation<\/text>\n    <\/g>\n\n    <text class=\"txt small\" x=\"18\" y=\"110\">\n      R\u00e8gle des auditeurs : si des contr\u00f4les ne peuvent pas produire \u00e0 la demande des preuves horodat\u00e9es, ils sont consid\u00e9r\u00e9s comme inefficaces au titre de l&rsquo;article 28.\n    <\/text>\n    <text class=\"txt small\" x=\"18\" y=\"136\">\n      Points d&rsquo;attention : p\u00e9rim\u00e8tre de la plateforme CI\/CD, auditabilit\u00e9 contractuelle, isolation des ex\u00e9cuteurs, gouvernance des sous-traitants et conservation des preuves.\n    <\/text>\n  <\/g>\n<\/svg>\n  <figcaption class=\"gp-rds-caption\">\n    Sch\u00e9ma CI\/CD d&rsquo;entreprise mettant en \u00e9vidence les signaux d&rsquo;alerte fr\u00e9quents du risque tiers au titre de l&rsquo;article 28 de DORA :\n    absence de plan de sortie, ex\u00e9cuteurs partag\u00e9s, manque de visibilit\u00e9 sur les sous-traitants, absence de droits d&rsquo;audit,\n    et absence de conservation des preuves.\n<\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>GitHub \/ GitLab SaaS en tant que prestataires tiers de services TIC<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Exposition au risque<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les plateformes SaaS GitHub et GitLab contr\u00f4lent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>l&rsquo;acc\u00e8s au code source,<\/li>\n\n\n\n<li>les workflows d&rsquo;approbation des changements,<\/li>\n\n\n\n<li>l&rsquo;application des identit\u00e9s et des permissions.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Une compromission ou une mauvaise configuration peut entra\u00eener :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>des modifications de code non autoris\u00e9es,<\/li>\n\n\n\n<li>le contournement des approbations,<\/li>\n\n\n\n<li>une perte de tra\u00e7abilit\u00e9.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Attentes de l&rsquo;article 28<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les auditeurs attendent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>que les plateformes d&rsquo;h\u00e9bergement Git figurent dans l&rsquo;<strong>inventaire des tiers<\/strong>,<\/li>\n\n\n\n<li>une classification claire du risque (souvent <em>critique<\/em>),<\/li>\n\n\n\n<li>l&rsquo;application de la s\u00e9paration des t\u00e2ches,<\/li>\n\n\n\n<li>des preuves de contr\u00f4le d&rsquo;acc\u00e8s et d&rsquo;approbations.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Les journaux d&rsquo;acc\u00e8s, les approbations de pull requests et les param\u00e8tres de protection des branches sont trait\u00e9s comme des <strong>preuves d&rsquo;audit<\/strong>, et non comme de simples d\u00e9tails op\u00e9rationnels.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Ex\u00e9cuteurs CI dans le cloud<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Exposition au risque<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les ex\u00e9cuteurs CI g\u00e9r\u00e9s ou h\u00e9berg\u00e9s dans le cloud :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ex\u00e9cutent du code non fiable,<\/li>\n\n\n\n<li>acc\u00e8dent aux secrets et aux identifiants,<\/li>\n\n\n\n<li>interagissent avec des syst\u00e8mes internes et externes.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ils s&rsquo;ex\u00e9cutent souvent sur une <strong>infrastructure partag\u00e9e<\/strong>, ce qui accro\u00eet l&rsquo;exposition.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Attentes de l&rsquo;article 28<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Au titre de l&rsquo;article 28, les organisations doivent d\u00e9montrer :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>l&rsquo;isolation entre les ex\u00e9cuteurs,<\/li>\n\n\n\n<li>un acc\u00e8s contr\u00f4l\u00e9 aux secrets,<\/li>\n\n\n\n<li>la surveillance des environnements d&rsquo;ex\u00e9cution,<\/li>\n\n\n\n<li>la capacit\u00e9 de restreindre ou de r\u00e9voquer l&rsquo;acc\u00e8s des ex\u00e9cuteurs.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Les auditeurs demandent fr\u00e9quemment :<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u00ab Qui contr\u00f4le l&rsquo;environnement d&rsquo;ex\u00e9cution dans lequel votre code est construit ? \u00bb<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Actions et plugins de la marketplace<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Exposition au risque<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les marketplaces CI\/CD introduisent du <strong>code tiers non v\u00e9rifi\u00e9<\/strong> directement dans les pipelines.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Les risques incluent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>les attaques de la cha\u00eene d&rsquo;approvisionnement,<\/li>\n\n\n\n<li>les mises \u00e0 jour malveillantes,<\/li>\n\n\n\n<li>l&rsquo;absence de gestion des versions,<\/li>\n\n\n\n<li>une propri\u00e9t\u00e9 peu claire.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Attentes de l&rsquo;article 28<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les auditeurs attendent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>une gouvernance sur les plugins autoris\u00e9s,<\/li>\n\n\n\n<li>une \u00e9valuation des risques pour les actions critiques,<\/li>\n\n\n\n<li>l&rsquo;\u00e9pinglage des versions et des processus de revue,<\/li>\n\n\n\n<li>la surveillance des changements dans le temps.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Un usage non restreint de la marketplace est souvent signal\u00e9 comme une <strong>faiblesse majeure au regard de l&rsquo;article 28<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Registres d&rsquo;artefacts<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Exposition au risque<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les registres d&rsquo;artefacts stockent et distribuent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>les r\u00e9sultats de build,<\/li>\n\n\n\n<li>les images de conteneurs,<\/li>\n\n\n\n<li>les biblioth\u00e8ques internes.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">En cas de compromission, ils peuvent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>propager des artefacts malveillants,<\/li>\n\n\n\n<li>rompre l&rsquo;int\u00e9grit\u00e9 du d\u00e9ploiement,<\/li>\n\n\n\n<li>affecter plusieurs syst\u00e8mes simultan\u00e9ment.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Attentes de l&rsquo;article 28<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les auditeurs attendent des contr\u00f4les couvrant :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>les restrictions d&rsquo;acc\u00e8s,<\/li>\n\n\n\n<li>les politiques d&rsquo;immuabilit\u00e9,<\/li>\n\n\n\n<li>la signature et la v\u00e9rification des artefacts,<\/li>\n\n\n\n<li>la conservation des m\u00e9tadonn\u00e9es d&rsquo;artefacts.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Les registres d&rsquo;artefacts sont trait\u00e9s comme des <strong>composants centraux de la cha\u00eene d&rsquo;approvisionnement<\/strong>, et non comme un stockage passif.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Proxys de d\u00e9pendances et d\u00e9p\u00f4ts externes<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Exposition au risque<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les proxys de d\u00e9pendances et les d\u00e9p\u00f4ts externes :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>r\u00e9cup\u00e8rent du code hors de l&rsquo;organisation,<\/li>\n\n\n\n<li>introduisent des d\u00e9pendances tierces indirectes,<\/li>\n\n\n\n<li>peuvent modifier leur contenu sans pr\u00e9avis.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Cela cr\u00e9e une <strong>exposition tierce cach\u00e9e<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Attentes de l&rsquo;article 28<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les auditeurs attendent :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>une visibilit\u00e9 sur les sources de d\u00e9pendances,<\/li>\n\n\n\n<li>des contr\u00f4les pour restreindre ou mettre en cache les d\u00e9pendances externes,<\/li>\n\n\n\n<li>une tra\u00e7abilit\u00e9 reliant les d\u00e9pendances aux builds,<\/li>\n\n\n\n<li>la surveillance des changements de d\u00e9pendances.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Les SBOM et les journaux de d\u00e9pendances sont souvent examin\u00e9s en tant que <strong>preuves au titre de l&rsquo;article 28<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Contr\u00f4les CI\/CD essentiels attendus au titre de l&rsquo;article 28<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pour l&rsquo;ensemble des services tiers li\u00e9s au CI\/CD, les auditeurs s&rsquo;attendent \u00e0 voir :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>une inclusion explicite dans les inventaires de tiers,<\/li>\n\n\n\n<li>une classification et une gouvernance fond\u00e9es sur le risque,<\/li>\n\n\n\n<li>une isolation des acc\u00e8s et le moindre privil\u00e8ge,<\/li>\n\n\n\n<li>des politiques applicables (approbations, points de contr\u00f4le),<\/li>\n\n\n\n<li>une surveillance continue,<\/li>\n\n\n\n<li>une g\u00e9n\u00e9ration automatis\u00e9e des preuves.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Les pipelines CI\/CD doivent appliquer ces contr\u00f4les <strong>d\u00e8s la conception<\/strong>, et non par des proc\u00e9dures manuelles.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Preuves fr\u00e9quemment demand\u00e9es par les auditeurs<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pour le risque tiers CI\/CD, les auditeurs demandent fr\u00e9quemment :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>les journaux d&rsquo;acc\u00e8s des plateformes Git,<\/li>\n\n\n\n<li>les journaux d&rsquo;ex\u00e9cution CI et les m\u00e9tadonn\u00e9es des ex\u00e9cuteurs,<\/li>\n\n\n\n<li>les registres d&rsquo;approbation et les r\u00e9sultats des points de contr\u00f4le de politique,<\/li>\n\n\n\n<li>les donn\u00e9es de signature et de provenance des artefacts,<\/li>\n\n\n\n<li>les alertes de surveillance impliquant des services CI\/CD.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ces artefacts servent \u00e0 valider que les <strong>contr\u00f4les fonctionnent<\/strong>, et pas seulement qu&rsquo;ils sont d\u00e9finis.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Lien avec les autres contr\u00f4les de l&rsquo;article 28 de DORA<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Les pipelines CI\/CD jouent souvent le r\u00f4le de <strong>couche d&rsquo;application<\/strong> pour :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>les exigences contractuelles,<\/li>\n\n\n\n<li>les politiques de s\u00e9curit\u00e9,<\/li>\n\n\n\n<li>les contraintes de la strat\u00e9gie de sortie.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ils font le pont entre les domaines juridique, s\u00e9curit\u00e9 et ing\u00e9nierie, ce qui les rend centraux pour la conformit\u00e9 \u00e0 l&rsquo;article 28.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>\u00c0 retenir<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Au titre de l&rsquo;article 28 de DORA, les pipelines CI\/CD ne sont pas des outils d&rsquo;automatisation neutres.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ce sont des <strong>points d&rsquo;int\u00e9gration TIC tiers \u00e0 haut risque<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Les organisations qui :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>gouvernent explicitement les services tiers CI\/CD,<\/li>\n\n\n\n<li>appliquent les contr\u00f4les au sein des pipelines,<\/li>\n\n\n\n<li>et g\u00e9n\u00e8rent des preuves en continu<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">sont nettement mieux plac\u00e9es pour r\u00e9ussir les audits de l&rsquo;article 28 et ma\u00eetriser le risque op\u00e9rationnel r\u00e9el.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Contenu associ\u00e9<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/dora-article-28-architecture-third-party-risk-controls-across-ci-cd-pipelines\/\" data-type=\"post\" data-id=\"364\">Architecture de l&rsquo;article 28 de DORA : contr\u00f4les du risque tiers dans les pipelines CI\/CD<\/a><\/strong><\/li>\n\n\n\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/dora-article-28-evidence-pack-what-to-show-auditors\/\" data-type=\"post\" data-id=\"347\">Dossier de preuves de l&rsquo;article 28 de DORA \u2014 ce qu&rsquo;il faut pr\u00e9senter aux auditeurs<\/a><\/strong><\/li>\n\n\n\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/ci-cd-security\/ci-cd-security-checklist-for-enterprises\/\" data-type=\"post\" data-id=\"32\">Check-list de s\u00e9curit\u00e9 CI\/CD pour les entreprises<\/a><\/strong><\/li>\n\n\n\n<li><strong><a href=\"https:\/\/regulated-devsecops.com\/fr\/compliance\/ci-cd-audit-red-flags-what-immediately-raises-auditor-concerns\/\" data-type=\"post\" data-id=\"264\">Signaux d&rsquo;alerte des audits CI\/CD<\/a><\/strong><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n    <section class=\"rds-author-box rds-author-box--audit\"\r\n             dir=\"ltr\" lang=\"fr\"\r\n             style=\"border:1px solid rgba(100,116,139,.35);border-radius:14px;padding:16px 18px;margin:26px 0 18px;background:rgba(148,163,184,.08);\">\r\n      <strong style=\"margin:0 0 8px; font-size:14px; font-weight:700; letter-spacing:.02em;\">Contexte \u201caudit-ready\u201d<\/strong>\r\n      <p style=\"margin:0; font-size:14px; line-height:1.55;\">Contenu con\u00e7u pour les environnements r\u00e9glement\u00e9s : contr\u00f4les avant outils, enforcement par politiques dans le CI\/CD, et evidence-by-design pour l\u2019audit.<\/p>\r\n      <p style=\"margin:0; font-size:14px; line-height:1.55;\">Focus sur la tra\u00e7abilit\u00e9, les approbations, la gouvernance des exceptions et la r\u00e9tention des preuves de bout en bout.<\/p>\r\n      <p style=\"margin:0; font-size:14px; line-height:1.55;\">\r\n        <a href=\"https:\/\/regulated-devsecops.com\/fr\/fr\/about\/\">Voir la m\u00e9thodologie sur la page About.<\/a>\r\n      <\/p>\r\n    <\/section>\r\n    \n","protected":false},"excerpt":{"rendered":"<p>L&rsquo;article 28 de DORA fait des pipelines CI\/CD des points d&rsquo;int\u00e9gration TIC tiers \u00e0 haut risque. O\u00f9 naissent ces risques, comment l&rsquo;article 28 s&rsquo;applique et quels contr\u00f4les et preuves les auditeurs attendent.<\/p>\n","protected":false},"author":1,"featured_media":2802,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[126,123],"tags":[],"post_folder":[],"class_list":["post-1411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulatory-frameworks","category-ci-cd-governance"],"_links":{"self":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/posts\/1411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/comments?post=1411"}],"version-history":[{"count":0,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/posts\/1411\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/media\/2802"}],"wp:attachment":[{"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/media?parent=1411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/categories?post=1411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/tags?post=1411"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/regulated-devsecops.com\/fr\/wp-json\/wp\/v2\/post_folder?post=1411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}