Spreadsheet: 871045d1717497768-caculate-the-number-of-compliance-lines-completed-questionnaire-of-specific-functional-needs
Sheet: #A3

QUESTIONNAIRE OF SPECIFIC FUNCTIONAL NEEDS
 | Compliance
 | Rate of progress
 | Date
 | Security requirements |  |  | Answer | Comments or justifications | Result | Useful links
 | 1 | Classification | Has the compliance team been consulted in order to determine if a CNIL statement is needed? |  |  |  | Information protection
 |  |  | Has the compliance team been consulted in order to determine if locally laws and regulation are applicable?
 | 2 | Compliance with legal and regulatory context | Are data stored and managed in proper conditions (as per the compliance team)? |  |  |  | Information protection
 |  |  | Is the license counting ensured for  the products used during the project?
 |  |  | Are the end users informed of the process of their personal information?
 |  |  | Can end users ask for access / modification / deletion of their personal information?
 | 3 | Project Security | Are the development and production environments segregated? |  |  |  | Security of projects, applications and infrastructures throughout their life cycle
 |  |  | Has a penetration test been performed?
 |  |  | Has the application source code been reviewed?
 | 4 | Security Insurance | Are the different recurring contractors referenced (internal and external: editor, cloud service infrastructure, development, maintenance...)? |  |  |  | Security of projects, applications and infrastructures throughout their life cycle
 |  |  | Do those contracts include PAS (Plan d'Assurance Sécurité)?
 | Access control |  |  | Answer | Comments or justifications | Result | Useful links
 | 5 | Identification of TOTAL end users | Are end users identified with nominative accounts? |  |  |  | Logical access management
 | 6 | Privilege accounts | Have the default administration accounts been deleted (admin, supervisor, …)? |  |  |  | Logical access management
 |  |  | If not, have their passwords been changed?
 |  |  | Do administrators or developers authenticate with  personal accounts during operations associated with their tasks?  (if Infra project, please precise: Windows admin accounts, CMS, etc.)
 |  |  | Is the use of generic accounts required for operations on this application?
 |  |  | Is the use of  service accounts required for operations on this application?
 |  |  | Do the administration accounts meet the principles of least privilege and segregation of duties?
 | 7 | Users authentication | Is a strong authentication required to connect to the application? (if Infra project, please precise on which applications (CMS, mails, messages, routers, etc.) |  |  |  | Authentication of users and applications
 |  |  | Is the authentication centralized? (Digital Pass, AD,…) |  |  |  | Logical access management
 |  |  | Is the password encrypted during the authentication process?
 |  |  | Is the first connection password unique for each account?
 |  |  | Do the passwords meet the following criteria?  - minimum length of 12 characters for user accounts - minimum lenght of 16 characters for administrator accounts; - minimum lenght of 24characters for system accounts; - maximum validity period of 60 days (365 days for system accounts) - syntactically complex passwords: combination of letters (uppercase and/or lowercase), - numbers and special characters (at least one character of each) - history file of the last 24 passwords or secret codes used,  - validity period of at least one day for new passwords - limited validity period for initial password and modification at first connection
 |  |  | Are the passwords encrypted/hashed/salted (non reversible encryption)?
 |  |  | Is user authentication required before password modification (current password needed)?
 |  |  | Is the user account locked after 5 authentication failures?
 |  |  | Is the application locked at startup and after a timeout of 30 minutes [NAME]? (session suspended)
 |  |  | Have the application documentation and scripts been checked to make sure that they do not contain passwords?
 | 8 | Access request process | Are the accounts provided through a documented account request process or workflow, including a mandatory management approval? |  |  |  | Logical access management
 |  |  | Are the accounts created  according to the principles of 'least privilege' (profiles and rights)
 |  |  | Have the administration and service accounts been reviewed in the last 6 months?
 |  |  | Is a review of accesses and accounts performed at least once a year?
 | 9 | Management of IT traces | Can the application traces allow to: - allocate the event? - date the event? - characterize the event? |  |  |  | Traces and logs management
 |  |  | Do you confirm that traces do not contain passwords?
 |  |  | Did the compliance team approve the traced events, data and storage conditions?
 |  |  | Is the access to logs only available through read-only permissions?
 | Protection measures |  |  | Answer | Comments or justifications | Result | Useful links
 | 10 | Back-up plan | Does the data back-up plan meet the RPO/RTO objectives? Has it been tested? Has it been tested on PCA site (if applicable)? |  |  |  | Security continuity for IS resources
 | 11 | Continuity | Does the architecture design meet the continuity objectives? |  |  |  | Security continuity for IS resources
 |  |  | Is the BCP (Business Continuity Plan) tested on a regular basis?
 | 12 | Information protection | Are classified data (confidentiality ≥3) encrypted? (information, back-up, traces) |  |  |  | Data encryption
 |  |  | Are classified data (integrity ≥3) digitally signed? (information, back-up, traces) |  |  |  | Electronic signature and data integrity
 |  |  | Has the protection of sensitive/strategic information been taken into account outside the application? |  |  |  | Sensitive data definition
 |  |  | Has the protection of Personally Identifiable Information (according to the CNIL) been taken into account?
 |  |  | Have the regulatory obligations from the General Data Protection Regulation been taken into account? |  |  |  | General Data Protection Regulation
 | 13 | Filtering of the flows | If any other applications are hosted in the same VLAN, do they belong to the same business owner or do they have similar classification criteria? |  |  |  | Network security
 |  |  | Do the incoming and outgoing flows comply with the security rules of filtering and transfers through buffering zones?
 |  |  | Are the flows of the application mapped in SecureApp? (if Infra project : is a flow matrix available?)
 |  |  | If the application is classified (availability, integrity, confidentiality, traceability ≥3), is it hosted in a dedicated VLAN? |  |  |  | Hosting selection
 | 14 | Automated mails | Are information of confidentiality=3 encrypted in emails? |  |  |  | E-mail security
 |  |  | Are information of confidentiality=4 forbidden in emails?
 |  |  | Are the emails containing information classified (Integrity≥3 or Traceability=4) digitally signed?
 | 15 | Data wiping | Is there any procedure for the appropriate destruction of data for the servers and back-up solutions at the end of the lifecycle of these equipments? |  |  |  | ISS rules : classification of equipments and wiping procedure
 | 16 | Physical security | Are physical location of the equipments mapped in the CMDB? |  |  |  | Physical security
 |  |  | Are those locations in accordance with the classification? (yellow room, orange or red)
 | 17 | Test data | Are production data used as test data? |  |  |  | Security of projects, applications and infrastructures throughout their life cycle
 |  |  | If so, does the business owner accept the risks related to the use of real production data in a non-production environment?
 |  |  | Are test data anonymized or fictitious?
 | 18 | Application interface | Are the different classifications of the applications exchanging data consistent with each other? (Example: a C3 application sending data to a C1 application) |  |  |  | \
 |  |  | In case of shared secret (encryption/signature), is there a process for renewing these secrets?
 |  |  | Is the least privilege principle applied for the application interfaces?
 | Management process |  |  | Answer | Comments or justifications | Result | Useful links
 | 19 | Incident management | Are security incidents recorded in Service Now? |  |  |  | Management of security events
 |  |  | Are actors involved in incidents resolution clearly identified?
 | 20 | Change management | Is a change management process formalized for this solution? |  |  |  | Security of projects, applications and infrastructures throughout their life cycle
 |  |  | Are the changes made on the application recorded?
 | 21 | Patch management | Is a patch management update procedure formalized? |  |  |  | Security of projects, applications and infrastructures throughout their life cycle
 |  |  | Are the application products/components duly recorded in the CMDB?
 |  |  | Is a system patch management update procedure formalized? |  |  |  | Security of system base layers
 | 22 | Antivirus management | Are the servers covered by an anti-virus solution? |  |  |  | Malware defense
 | 23 | Supervision | Are the systems integrated to a supervision infrastructure? |  |  |  | Traces and logs management
 | 24 | Contracts | Is the contract written by TOTAL? |  |  |  | Outsourcing of services related to IS resources
 |  |  | Is there a "PAS Prestation" in the appendix of the contract?
 |  |  | Does the contract include standard DJ (Direction Juridique = Legal Department) provision regarding personal data?
 | 25 | Remote maintenance | Will there be any remote connection by the provider from outside TOTAL network for maintenance of the application? |  |  |  | Outsourcing of services related to IS resources
 |  |  | Is the remote maintenance made through Total Connect, "Bureau Infogérant", Any Connect? |  |  |  | Network security
 | 26 | Web application good practices | Are the administration and coding principles respected? (§5.2.14) and (§5.1) |  |  |  | Best practices of the production of web applications
 |  |  | Are the rules related to infrastructure components implemented? (§5.3)
 |  |  | Are the rules related to input (§5.2.3) and output (§5.2.4) implemented and respected?
 |  |  | Are the rules related to encryption (§5.2.2), strong authentication or password (§5.2.5) and security of communications (§5.2.11) implemented and respected?
 |  |  | Are the rules related to accreditation and identity management implemented and respected? (§5.2.6)
 |  |  | If the application uses social network or audience analysis cookies, is the collection of user consent formalized?
 |  |  | Is the cookie lifetime lower than 13 months?
 |  |  | Are the rules related to session and ID management implemented and respected? (§5.2.7)
 |  |  | Are the rules related to logs (§5.2.9) and error management (§5.2.8) implemented and respected?
 |  |  | Are the rules related to data protection (§5.2.10), files management (§5.2.12) and memory management (§5.2.13) implemented and respected?
 |  |  | Were the precedent principles (§5) kept during the implementation phase?