{
  "company": {
    "name": "Helios Asset Management SAS",
    "siret": "82345678901234",
    "lei": "969500HELIOSAM12X4Q56",
    "sector": "asset-manager",
    "sectorLabel": "Société de gestion d'actifs",
    "sizeFte": 145,
    "aumEur": 8000,
    "ciso": "Sandrine Marquet",
    "doraOfficer": "Laurent Vaillant",
    "competentAuthority": "AMF",
    "period": "2026"
  },
  "riskControls": [
    {
      "id": "RC-001",
      "pillar": 1,
      "domain": "governance",
      "ref": "Art. 5",
      "title": "Politique ICT validée organe de direction",
      "description": "Politique de gestion des risques ICT revue annuellement et signée par le directoire.",
      "owner": "Laurent Vaillant",
      "status": "implemented",
      "evidence": "ICT-POL-2026-v3.2.pdf",
      "maturity": 4,
      "lastReview": "2026-02-10",
      "nextReview": "2027-02-10"
    },
    {
      "id": "RC-002",
      "pillar": 1,
      "domain": "governance",
      "ref": "Art. 5",
      "title": "Rôle organe de direction (formation continue)",
      "description": "Membres directoire formés annuellement aux risques ICT (8h/an).",
      "owner": "RH",
      "status": "partial",
      "evidence": "Formation-CA-2025.xlsx",
      "maturity": 3,
      "lastReview": "2025-11-04",
      "nextReview": "2026-11-01"
    },
    {
      "id": "RC-003",
      "pillar": 1,
      "domain": "identification",
      "ref": "Art. 8",
      "title": "Cartographie fonctions critiques (CIF)",
      "description": "Cartographie à jour des fonctions critiques ou importantes et de leurs dépendances ICT.",
      "owner": "Sandrine Marquet",
      "status": "implemented",
      "evidence": "Cartographie-CIF-Q1-2026.xlsx",
      "maturity": 4,
      "lastReview": "2026-01-15",
      "nextReview": "2026-07-15"
    },
    {
      "id": "RC-004",
      "pillar": 1,
      "domain": "identification",
      "ref": "Art. 8",
      "title": "Inventaire assets ICT",
      "description": "CMDB tenue à jour : 1850 actifs (serveurs, postes, applications, services cloud).",
      "owner": "DSI",
      "status": "implemented",
      "evidence": "CMDB-export-202604.csv",
      "maturity": 4,
      "lastReview": "2026-04-01",
      "nextReview": "2026-07-01"
    },
    {
      "id": "RC-005",
      "pillar": 1,
      "domain": "protection",
      "ref": "Art. 9",
      "title": "Politique d'accès (least privilege + PAM)",
      "description": "Active Directory + CyberArk PAM. MFA obligatoire sur 100% des accès admin.",
      "owner": "DSI",
      "status": "implemented",
      "evidence": "IAM-Audit-Q1-2026.pdf",
      "maturity": 5,
      "lastReview": "2026-03-22",
      "nextReview": "2026-09-22"
    },
    {
      "id": "RC-006",
      "pillar": 1,
      "domain": "protection",
      "ref": "Art. 9",
      "title": "Chiffrement données au repos / transit",
      "description": "AES-256 disques, TLS 1.3 en transit. Coffre clés HSM Atos.",
      "owner": "DSI",
      "status": "implemented",
      "maturity": 4,
      "lastReview": "2026-02-28",
      "nextReview": "2027-02-28"
    },
    {
      "id": "RC-007",
      "pillar": 1,
      "domain": "protection",
      "ref": "Art. 9",
      "title": "Sécurisation réseaux + segmentation",
      "description": "Micro-segmentation VMware NSX. DMZ pour services externes. Zero-trust en cours.",
      "owner": "DSI",
      "status": "partial",
      "evidence": "Audit-Architecture-2025.pdf",
      "maturity": 3,
      "lastReview": "2025-12-10",
      "nextReview": "2026-06-30"
    },
    {
      "id": "RC-008",
      "pillar": 1,
      "domain": "detection",
      "ref": "Art. 10",
      "title": "SOC 24/7 + SIEM",
      "description": "SOC managé I-TRACING. SIEM Splunk Cloud. 4200 alertes/mois, 12 % vrais positifs.",
      "owner": "CISO",
      "status": "implemented",
      "evidence": "Rapport-SOC-Q1-2026.pdf",
      "maturity": 4,
      "lastReview": "2026-04-05",
      "nextReview": "2026-07-05"
    },
    {
      "id": "RC-009",
      "pillar": 1,
      "domain": "detection",
      "ref": "Art. 10",
      "title": "Threat Intelligence Feeds",
      "description": "FS-ISAC + Mandiant + CERT-FR. Intégration SIEM via TAXII.",
      "owner": "CISO",
      "status": "implemented",
      "maturity": 4,
      "lastReview": "2026-03-15",
      "nextReview": "2026-09-15"
    },
    {
      "id": "RC-010",
      "pillar": 1,
      "domain": "response",
      "ref": "Art. 11",
      "title": "Plan de réponse incidents (CSIRT)",
      "description": "Runbooks 18 scénarios. Astreintes CSIRT 24/7. Test mensuel.",
      "owner": "CISO",
      "status": "implemented",
      "evidence": "CSIRT-Runbooks-v4.pdf",
      "maturity": 4,
      "lastReview": "2026-01-20",
      "nextReview": "2026-07-20"
    },
    {
      "id": "RC-011",
      "pillar": 1,
      "domain": "response",
      "ref": "Art. 11",
      "title": "Politique communication crise",
      "description": "Plan comm interne / externe / régulateur. Porte-parole CEO + COMEX. Manque test grandeur réelle.",
      "owner": "COMEX",
      "status": "partial",
      "evidence": "Plan-Comm-Crise-v2.pdf",
      "maturity": 3,
      "lastReview": "2025-09-12",
      "nextReview": "2026-09-12"
    },
    {
      "id": "RC-012",
      "pillar": 1,
      "domain": "recovery",
      "ref": "Art. 12",
      "title": "Plan continuité ICT (BCP)",
      "description": "BCP couvrant CIF. RTO objectifs : trading 30 min, settlement 4h, reporting 24h.",
      "owner": "Sandrine Marquet",
      "status": "implemented",
      "evidence": "BCP-ICT-2026.pdf",
      "maturity": 4,
      "lastReview": "2026-02-01",
      "nextReview": "2027-02-01"
    },
    {
      "id": "RC-013",
      "pillar": 1,
      "domain": "recovery",
      "ref": "Art. 12",
      "title": "Disaster Recovery Plan (DRP)",
      "description": "DRP testé semestriellement. Site secondaire OVH Roubaix. Dernier test : mars 2026 OK.",
      "owner": "DSI",
      "status": "implemented",
      "evidence": "DRP-Test-2026Q1.pdf",
      "maturity": 4,
      "lastReview": "2026-03-08",
      "nextReview": "2026-09-08"
    },
    {
      "id": "RC-014",
      "pillar": 1,
      "domain": "recovery",
      "ref": "Art. 12",
      "title": "Sauvegardes immuables",
      "description": "Backup 3-2-1 + immuable Veeam. Test restauration mensuel.",
      "owner": "DSI",
      "status": "implemented",
      "maturity": 5,
      "lastReview": "2026-04-10",
      "nextReview": "2026-05-10"
    },
    {
      "id": "RC-015",
      "pillar": 1,
      "domain": "learning",
      "ref": "Art. 13",
      "title": "Apprentissage post-incident",
      "description": "RCA systématique. Lessons learned remontées au COMEX. Manque base de connaissance centralisée.",
      "owner": "CISO",
      "status": "partial",
      "maturity": 3,
      "lastReview": "2025-12-20",
      "nextReview": "2026-06-20"
    },
    {
      "id": "RC-016",
      "pillar": 1,
      "domain": "learning",
      "ref": "Art. 13",
      "title": "Sensibilisation collaborateurs",
      "description": "Campagne phishing mensuelle. E-learning annuel obligatoire. Taux clic : 4,2 % (cible < 5 %).",
      "owner": "RH + CISO",
      "status": "implemented",
      "evidence": "Phishing-Report-Q1-2026.pdf",
      "maturity": 4,
      "lastReview": "2026-03-31",
      "nextReview": "2026-06-30"
    }
  ],
  "incidents": [
    {
      "id": "INC-2026-001",
      "detectedAt": "2026-02-14T08:42:00.000Z",
      "classifiedAt": "2026-02-14T11:15:00.000Z",
      "classification": "major",
      "category": "third-party",
      "rootCause": "Indisponibilité régionale AWS eu-west-3 (Paris) suite à panne réseau opérateur. Bascule DR Roubaix retardée.",
      "title": "Indisponibilité plateforme trading 4h12 — incident AWS eu-west-3",
      "description": "Panne régionale AWS impactant l'OMS Charles River. Bascule DR effectuée en 1h08 (RTO cible : 30 min). 247 ordres rejetés. Réconciliation manuelle effectuée. AMF notifiée à 09:23 (T+41min).",
      "affectedServices": [
        "core-trading",
        "OMS",
        "market-data"
      ],
      "thirdPartyId": "TP-001",
      "clientsImpacted": 14200,
      "durationMin": 252,
      "dataLoss": false,
      "financialImpactEur": 380000,
      "reportingStatus": "final-sent",
      "initialReportAt": "2026-02-14T09:23:00.000Z",
      "intermediateReportAt": "2026-02-16T18:00:00.000Z",
      "finalReportAt": "2026-03-12T16:30:00.000Z",
      "authority": "AMF",
      "refExternal": "AMF-INC-2026-00417"
    },
    {
      "id": "INC-2026-002",
      "detectedAt": "2026-03-22T14:08:00.000Z",
      "classifiedAt": "2026-03-22T15:30:00.000Z",
      "classification": "significant",
      "category": "cyberattack",
      "rootCause": "Tentative phishing ciblée (whaling) sur 3 cadres COMEX. 1 click. Pas d'exécution payload : EDR a bloqué.",
      "title": "Campagne phishing ciblée — directoire",
      "description": "Email usurpant l'identité du commissaire aux comptes. 1/3 cliqué. CrowdStrike Falcon a bloqué le téléchargement. RAS aval. Sensibilisation renforcée.",
      "affectedServices": [
        "email",
        "endpoint"
      ],
      "clientsImpacted": 0,
      "durationMin": 90,
      "dataLoss": false,
      "financialImpactEur": 0,
      "reportingStatus": "closed",
      "initialReportAt": "2026-03-22T22:45:00.000Z",
      "authority": "AMF"
    },
    {
      "id": "INC-2026-003",
      "detectedAt": "2026-04-05T22:14:00.000Z",
      "classifiedAt": "2026-04-06T02:00:00.000Z",
      "classification": "significant",
      "category": "system-failure",
      "rootCause": "Bug montée de version PMS Front Investor (Linedata). Calcul VL erroné sur 4 OPCVM small-cap.",
      "title": "VL erronées NAV — 4 OPCVM",
      "description": "Écart constaté lors du contrôle dépositaire matinal. Re-calcul + recalcul souscriptions/rachats du 06/04. Indemnisation porteurs : 38 k€. Levée bug par Linedata sous 36h.",
      "affectedServices": [
        "PMS",
        "NAV-calculation"
      ],
      "thirdPartyId": "TP-005",
      "clientsImpacted": 2100,
      "durationMin": 480,
      "dataLoss": false,
      "financialImpactEur": 38000,
      "reportingStatus": "final-sent",
      "initialReportAt": "2026-04-06T08:30:00.000Z",
      "intermediateReportAt": "2026-04-08T17:00:00.000Z",
      "finalReportAt": "2026-05-02T11:00:00.000Z",
      "authority": "AMF",
      "refExternal": "AMF-INC-2026-00891"
    },
    {
      "id": "INC-2026-004",
      "detectedAt": "2026-05-09T06:55:00.000Z",
      "classifiedAt": "2026-05-09T08:10:00.000Z",
      "classification": "minor",
      "category": "system-failure",
      "rootCause": "Saturation disque serveur reporting. Logs non rotatés.",
      "title": "Indisponibilité reporting investisseurs 1h45",
      "description": "Portail reporting inaccessible. Pas d'impact opérationnel ni client (notification post-mortem aux 12 institutionnels concernés).",
      "affectedServices": [
        "reporting-portal"
      ],
      "clientsImpacted": 12,
      "durationMin": 105,
      "dataLoss": false,
      "financialImpactEur": 0,
      "reportingStatus": "closed",
      "authority": "AMF"
    }
  ],
  "tests": [
    {
      "id": "TST-001",
      "type": "tlpt",
      "title": "TLPT TIBER-FR cycle 2025",
      "scope": [
        "Front trading",
        "OMS Charles River",
        "Settlement T+1",
        "Custody bridge"
      ],
      "performedAt": "2025-03-18",
      "performedBy": "Synacktiv (Red Team) + Sekoia (TI)",
      "externalAccredited": true,
      "framework": "TIBER-EU",
      "findings": [
        {
          "severity": "critical",
          "count": 1
        },
        {
          "severity": "high",
          "count": 3
        },
        {
          "severity": "medium",
          "count": 11
        },
        {
          "severity": "low",
          "count": 8
        }
      ],
      "remediated": 91,
      "nextDue": "2028-03-18",
      "cost": 285000,
      "reportLink": "TLPT-2025-Red-Team-Report.pdf"
    },
    {
      "id": "TST-002",
      "type": "pentest",
      "title": "Pentest applicatif portail investisseurs",
      "scope": [
        "portail-clients.helios-am.fr"
      ],
      "performedAt": "2025-09-12",
      "performedBy": "Wavestone",
      "externalAccredited": false,
      "framework": "OWASP",
      "findings": [
        {
          "severity": "critical",
          "count": 0
        },
        {
          "severity": "high",
          "count": 2
        },
        {
          "severity": "medium",
          "count": 7
        },
        {
          "severity": "low",
          "count": 14
        }
      ],
      "remediated": 100,
      "nextDue": "2026-09-12",
      "cost": 38000
    },
    {
      "id": "TST-003",
      "type": "vulnerability-scan",
      "title": "Scan vulnérabilités infra mensuel — Mars 2026",
      "scope": [
        "Infrastructure interne",
        "DMZ"
      ],
      "performedAt": "2026-03-30",
      "performedBy": "Tenable + équipe SecOps interne",
      "externalAccredited": false,
      "framework": "internal",
      "findings": [
        {
          "severity": "critical",
          "count": 0
        },
        {
          "severity": "high",
          "count": 4
        },
        {
          "severity": "medium",
          "count": 28
        },
        {
          "severity": "low",
          "count": 142
        }
      ],
      "remediated": 72,
      "nextDue": "2026-04-30",
      "cost": 4500
    },
    {
      "id": "TST-004",
      "type": "scenario-bcp",
      "title": "Test PCA — perte data center primaire",
      "scope": [
        "Production trading",
        "Settlement",
        "Reporting"
      ],
      "performedAt": "2026-03-08",
      "performedBy": "Équipe interne + Mazars",
      "externalAccredited": false,
      "framework": "ISO27001",
      "findings": [
        {
          "severity": "critical",
          "count": 0
        },
        {
          "severity": "high",
          "count": 1
        },
        {
          "severity": "medium",
          "count": 4
        },
        {
          "severity": "low",
          "count": 6
        }
      ],
      "remediated": 60,
      "nextDue": "2026-09-08",
      "cost": 22000
    },
    {
      "id": "TST-005",
      "type": "tabletop",
      "title": "Tabletop ransomware COMEX",
      "scope": [
        "Gouvernance crise",
        "Communication"
      ],
      "performedAt": "2026-04-22",
      "performedBy": "Equipe interne + cabinet Mandiant",
      "externalAccredited": false,
      "framework": "NIST",
      "findings": [
        {
          "severity": "critical",
          "count": 0
        },
        {
          "severity": "high",
          "count": 0
        },
        {
          "severity": "medium",
          "count": 3
        },
        {
          "severity": "low",
          "count": 5
        }
      ],
      "remediated": 50,
      "nextDue": "2026-10-22",
      "cost": 15000
    },
    {
      "id": "TST-006",
      "type": "red-team",
      "title": "Red Team interne T1 2026",
      "scope": [
        "Active Directory",
        "Privilege escalation"
      ],
      "performedAt": "2026-02-05",
      "performedBy": "Équipe Purple Team interne",
      "externalAccredited": false,
      "framework": "MITRE-ATT&CK",
      "findings": [
        {
          "severity": "critical",
          "count": 0
        },
        {
          "severity": "high",
          "count": 2
        },
        {
          "severity": "medium",
          "count": 5
        },
        {
          "severity": "low",
          "count": 9
        }
      ],
      "remediated": 88,
      "nextDue": "2026-08-05",
      "cost": 0
    },
    {
      "id": "TST-007",
      "type": "compatibility",
      "title": "Test régression API Bloomberg",
      "scope": [
        "Bloomberg B-PIPE",
        "OMS interfaces"
      ],
      "performedAt": "2026-01-18",
      "performedBy": "Équipe interne + Bloomberg engineers",
      "externalAccredited": false,
      "framework": "internal",
      "findings": [
        {
          "severity": "critical",
          "count": 0
        },
        {
          "severity": "high",
          "count": 0
        },
        {
          "severity": "medium",
          "count": 1
        },
        {
          "severity": "low",
          "count": 3
        }
      ],
      "remediated": 100,
      "nextDue": "2026-07-18",
      "cost": 0
    },
    {
      "id": "TST-008",
      "type": "performance",
      "title": "Load test plateforme trading",
      "scope": [
        "OMS Charles River",
        "Market data"
      ],
      "performedAt": "2026-04-15",
      "performedBy": "Équipe interne",
      "externalAccredited": false,
      "framework": "internal",
      "findings": [
        {
          "severity": "critical",
          "count": 0
        },
        {
          "severity": "high",
          "count": 1
        },
        {
          "severity": "medium",
          "count": 2
        },
        {
          "severity": "low",
          "count": 4
        }
      ],
      "remediated": 75,
      "nextDue": "2026-10-15",
      "cost": 8000
    }
  ],
  "thirdParties": [
    {
      "id": "TP-001",
      "legalName": "Amazon Web Services EMEA SARL",
      "lei": "529900N3CBQQNLVYWE85",
      "country": "LU",
      "serviceType": "cloud-iaas",
      "description": "IaaS production (eu-west-3 Paris + eu-west-1 Dublin). Hosting OMS, PMS, reporting.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": true,
      "subOutsourced": false,
      "dataLocation": "FR/IE",
      "exitStrategy": "draft",
      "concentrationRiskScore": 88,
      "annualCostEur": 1850000,
      "contractStart": "2022-04-01",
      "contractEnd": "2027-03-31",
      "lastAssessment": "2026-01-30",
      "status": "active"
    },
    {
      "id": "TP-002",
      "legalName": "Microsoft Ireland Operations Ltd",
      "lei": "635400AKJBGNS5WNQL34",
      "country": "IE",
      "serviceType": "cloud-saas",
      "description": "Microsoft 365, Azure AD, Teams. Bureautique + identité.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": true,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 72,
      "annualCostEur": 240000,
      "contractStart": "2021-09-01",
      "contractEnd": "2027-08-31",
      "lastAssessment": "2026-02-12",
      "status": "active"
    },
    {
      "id": "TP-003",
      "legalName": "Google Cloud EMEA Limited",
      "lei": "549300PPXHEU2JF0AM85",
      "country": "IE",
      "serviceType": "cloud-saas",
      "description": "Workspace (DR mail) + BigQuery analytics secondaire.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": true,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 30,
      "annualCostEur": 95000,
      "contractStart": "2023-06-15",
      "contractEnd": "2026-06-14",
      "lastAssessment": "2025-12-04",
      "status": "active"
    },
    {
      "id": "TP-004",
      "legalName": "Bloomberg Finance L.P.",
      "lei": "549300L0F39SOTNHNB22",
      "country": "US",
      "serviceType": "data-provider",
      "description": "B-PIPE market data + Bloomberg Terminal (78 terminaux).",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "US/UK",
      "exitStrategy": "draft",
      "concentrationRiskScore": 78,
      "annualCostEur": 1420000,
      "contractStart": "2018-01-01",
      "contractEnd": "2028-12-31",
      "lastAssessment": "2026-03-20",
      "status": "active"
    },
    {
      "id": "TP-005",
      "legalName": "Linedata Services",
      "lei": "969500LINEDATAYZB987",
      "country": "FR",
      "serviceType": "outsourcing-it",
      "description": "PMS Front Investor (gestion portefeuilles) + middle office. Hébergé chez Linedata.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": true,
      "dataLocation": "FR",
      "exitStrategy": "missing",
      "concentrationRiskScore": 85,
      "annualCostEur": 680000,
      "contractStart": "2020-03-01",
      "contractEnd": "2026-12-31",
      "lastAssessment": "2026-04-02",
      "status": "active"
    },
    {
      "id": "TP-006",
      "legalName": "Charles River Development (State Street)",
      "country": "US",
      "lei": "549300ZK53CNGEEI6A29",
      "serviceType": "trading-platform",
      "description": "OMS/EMS Charles River IMS. Trading desk + compliance.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU/US",
      "exitStrategy": "draft",
      "concentrationRiskScore": 80,
      "annualCostEur": 540000,
      "contractStart": "2019-07-01",
      "contractEnd": "2027-06-30",
      "lastAssessment": "2026-02-28",
      "status": "active"
    },
    {
      "id": "TP-007",
      "legalName": "Refinitiv (LSEG)",
      "lei": "213800BRT8VJZQ86RP06",
      "country": "GB",
      "serviceType": "data-provider",
      "description": "Data ESG + référentiel instruments (backup Bloomberg).",
      "criticality": "important",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "UK",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 45,
      "annualCostEur": 280000,
      "contractStart": "2021-01-01",
      "contractEnd": "2026-12-31",
      "lastAssessment": "2026-01-10",
      "status": "active"
    },
    {
      "id": "TP-008",
      "legalName": "BNP Paribas Securities Services",
      "lei": "549300WBCUNQGVN6P408",
      "country": "FR",
      "serviceType": "outsourcing-it",
      "description": "Dépositaire-conservateur + valorisateur. Externalisation fonction valorisation.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 65,
      "annualCostEur": 1100000,
      "contractStart": "2015-01-01",
      "contractEnd": "2028-12-31",
      "lastAssessment": "2026-03-05",
      "status": "active"
    },
    {
      "id": "TP-009",
      "legalName": "I-TRACING SAS",
      "lei": "969500ITRACINGFR0021",
      "country": "FR",
      "serviceType": "security-vendor",
      "description": "SOC managé 24/7 + IR. Surveillance SIEM + EDR.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "draft",
      "concentrationRiskScore": 55,
      "annualCostEur": 320000,
      "contractStart": "2023-01-01",
      "contractEnd": "2026-12-31",
      "lastAssessment": "2026-04-10",
      "status": "active"
    },
    {
      "id": "TP-010",
      "legalName": "OVHcloud SAS",
      "lei": "9695004B62U64S94QM43",
      "country": "FR",
      "serviceType": "cloud-iaas",
      "description": "Site DR + archivage immuable Veeam.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 35,
      "annualCostEur": 165000,
      "contractStart": "2022-09-01",
      "contractEnd": "2027-08-31",
      "lastAssessment": "2026-02-18",
      "status": "active"
    },
    {
      "id": "TP-011",
      "legalName": "Cisco Systems France",
      "country": "FR",
      "serviceType": "telecom",
      "description": "Webex + connectivité Cisco SD-WAN.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "draft",
      "concentrationRiskScore": 25,
      "annualCostEur": 78000,
      "contractStart": "2020-04-01",
      "contractEnd": "2026-03-31",
      "lastAssessment": "2025-10-15",
      "status": "active"
    },
    {
      "id": "TP-012",
      "legalName": "CrowdStrike France",
      "country": "FR",
      "serviceType": "security-vendor",
      "description": "Falcon EDR + Identity Threat Protection.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "draft",
      "concentrationRiskScore": 50,
      "annualCostEur": 145000,
      "contractStart": "2023-04-01",
      "contractEnd": "2026-03-31",
      "lastAssessment": "2026-01-22",
      "status": "active"
    },
    {
      "id": "TP-013",
      "legalName": "Salesforce.com France",
      "country": "FR",
      "serviceType": "cloud-saas",
      "description": "CRM commercial + service client.",
      "criticality": "ordinary",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 20,
      "annualCostEur": 88000,
      "contractStart": "2022-01-01",
      "contractEnd": "2027-12-31",
      "lastAssessment": "2026-02-05",
      "status": "active"
    },
    {
      "id": "TP-014",
      "legalName": "Wavestone",
      "country": "FR",
      "serviceType": "professional-services",
      "description": "Conseil sécurité + pentests applicatifs.",
      "criticality": "ordinary",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 15,
      "annualCostEur": 95000,
      "contractStart": "2024-01-01",
      "contractEnd": "2026-12-31",
      "lastAssessment": "2025-11-20",
      "status": "active"
    },
    {
      "id": "TP-015",
      "legalName": "Mazars (Forvis Mazars)",
      "country": "FR",
      "serviceType": "professional-services",
      "description": "Audit ICT + CAC. Audit interne SI.",
      "criticality": "ordinary",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 12,
      "annualCostEur": 110000,
      "contractStart": "2023-01-01",
      "contractEnd": "2026-12-31",
      "lastAssessment": "2026-01-12",
      "status": "active"
    },
    {
      "id": "TP-016",
      "legalName": "Synacktiv",
      "country": "FR",
      "serviceType": "professional-services",
      "description": "Pentest avancé + Red Team. Prestataire TLPT 2025.",
      "criticality": "ordinary",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 15,
      "annualCostEur": 0,
      "contractStart": "2024-09-01",
      "contractEnd": "2026-09-01",
      "lastAssessment": "2025-03-18",
      "status": "active"
    },
    {
      "id": "TP-017",
      "legalName": "Atos France",
      "country": "FR",
      "serviceType": "security-vendor",
      "description": "HSM cloud + gestion clés cryptographiques.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "draft",
      "concentrationRiskScore": 60,
      "annualCostEur": 78000,
      "contractStart": "2021-06-01",
      "contractEnd": "2026-05-31",
      "lastAssessment": "2026-02-03",
      "status": "active"
    },
    {
      "id": "TP-018",
      "legalName": "Splunk Cloud Services UK",
      "country": "GB",
      "serviceType": "cloud-saas",
      "description": "SIEM Splunk Cloud. Logs sécurité centralisés.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "draft",
      "concentrationRiskScore": 50,
      "annualCostEur": 215000,
      "contractStart": "2022-07-01",
      "contractEnd": "2027-06-30",
      "lastAssessment": "2026-03-08",
      "status": "active"
    },
    {
      "id": "TP-019",
      "legalName": "Tenable Network Security France",
      "country": "FR",
      "serviceType": "security-vendor",
      "description": "Tenable.io scan vulnérabilités.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 20,
      "annualCostEur": 38000,
      "contractStart": "2023-01-01",
      "contractEnd": "2026-12-31",
      "lastAssessment": "2025-12-15",
      "status": "active"
    },
    {
      "id": "TP-020",
      "legalName": "CyberArk Software France",
      "country": "FR",
      "serviceType": "security-vendor",
      "description": "PAM coffre comptes privilégiés.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "draft",
      "concentrationRiskScore": 45,
      "annualCostEur": 52000,
      "contractStart": "2022-11-01",
      "contractEnd": "2026-10-31",
      "lastAssessment": "2026-01-25",
      "status": "active"
    },
    {
      "id": "TP-021",
      "legalName": "Cloudflare France",
      "country": "FR",
      "serviceType": "security-vendor",
      "description": "WAF + anti-DDoS + DNS résolveur portail clients.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 30,
      "annualCostEur": 42000,
      "contractStart": "2023-03-01",
      "contractEnd": "2026-02-28",
      "lastAssessment": "2025-11-08",
      "status": "active"
    },
    {
      "id": "TP-022",
      "legalName": "DocuSign France",
      "country": "FR",
      "serviceType": "cloud-saas",
      "description": "Signature électronique contrats clients.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 20,
      "annualCostEur": 28000,
      "contractStart": "2022-04-01",
      "contractEnd": "2026-03-31",
      "lastAssessment": "2025-12-02",
      "status": "active"
    },
    {
      "id": "TP-023",
      "legalName": "Workday France",
      "country": "FR",
      "serviceType": "cloud-saas",
      "description": "SIRH + paie.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "draft",
      "concentrationRiskScore": 22,
      "annualCostEur": 92000,
      "contractStart": "2023-07-01",
      "contractEnd": "2028-06-30",
      "lastAssessment": "2026-02-20",
      "status": "active"
    },
    {
      "id": "TP-024",
      "legalName": "Equinix France SAS",
      "country": "FR",
      "serviceType": "telecom",
      "description": "Colocation racks production (interconnect SWIFT, marketdata).",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "draft",
      "concentrationRiskScore": 40,
      "annualCostEur": 185000,
      "contractStart": "2018-06-01",
      "contractEnd": "2028-05-31",
      "lastAssessment": "2026-01-30",
      "status": "active"
    },
    {
      "id": "TP-025",
      "legalName": "SWIFT (S.W.I.F.T. SCRL)",
      "lei": "549300NJTSJ6PXFKZX13",
      "country": "BE",
      "serviceType": "telecom",
      "description": "Messagerie financière sécurisée.",
      "criticality": "critical",
      "supportsCriticalFunction": true,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "draft",
      "concentrationRiskScore": 70,
      "annualCostEur": 145000,
      "contractStart": "2015-01-01",
      "contractEnd": "2099-12-31",
      "lastAssessment": "2026-03-15",
      "status": "active"
    },
    {
      "id": "TP-026",
      "legalName": "Sekoia.io",
      "country": "FR",
      "serviceType": "security-vendor",
      "description": "Threat Intelligence Platform.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 18,
      "annualCostEur": 32000,
      "contractStart": "2024-01-01",
      "contractEnd": "2026-12-31",
      "lastAssessment": "2026-02-08",
      "status": "active"
    },
    {
      "id": "TP-027",
      "legalName": "Zscaler Switzerland",
      "country": "CH",
      "serviceType": "security-vendor",
      "description": "ZIA + ZPA — secure web gateway + zero trust access.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "draft",
      "concentrationRiskScore": 28,
      "annualCostEur": 68000,
      "contractStart": "2024-04-01",
      "contractEnd": "2027-03-31",
      "lastAssessment": "2026-01-15",
      "status": "active"
    },
    {
      "id": "TP-028",
      "legalName": "ServiceNow Netherlands",
      "country": "NL",
      "serviceType": "cloud-saas",
      "description": "ITSM + GRC. Tickets, change, IRM.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 25,
      "annualCostEur": 125000,
      "contractStart": "2022-09-01",
      "contractEnd": "2027-08-31",
      "lastAssessment": "2026-02-22",
      "status": "active"
    },
    {
      "id": "TP-029",
      "legalName": "Veeam Software France",
      "country": "FR",
      "serviceType": "outsourcing-it",
      "description": "Logiciel sauvegarde + immuable repositories.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 20,
      "annualCostEur": 42000,
      "contractStart": "2023-01-01",
      "contractEnd": "2026-12-31",
      "lastAssessment": "2026-01-08",
      "status": "active"
    },
    {
      "id": "TP-030",
      "legalName": "Iron Mountain France",
      "country": "FR",
      "serviceType": "outsourcing-it",
      "description": "Archivage physique documents légaux.",
      "criticality": "ordinary",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "FR",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 10,
      "annualCostEur": 22000,
      "contractStart": "2019-01-01",
      "contractEnd": "2026-12-31",
      "lastAssessment": "2025-10-30",
      "status": "active"
    },
    {
      "id": "TP-031",
      "legalName": "Adobe Systems Software Ireland",
      "country": "IE",
      "serviceType": "cloud-saas",
      "description": "Creative Cloud + Acrobat Sign.",
      "criticality": "ordinary",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "in-place",
      "concentrationRiskScore": 8,
      "annualCostEur": 18000,
      "contractStart": "2022-01-01",
      "contractEnd": "2026-12-31",
      "lastAssessment": "2025-09-15",
      "status": "active"
    },
    {
      "id": "TP-032",
      "legalName": "Datadog France",
      "country": "FR",
      "serviceType": "cloud-saas",
      "description": "Observability — APM + logs + monitoring.",
      "criticality": "important",
      "supportsCriticalFunction": false,
      "isCTPP": false,
      "subOutsourced": false,
      "dataLocation": "EU",
      "exitStrategy": "draft",
      "concentrationRiskScore": 25,
      "annualCostEur": 88000,
      "contractStart": "2023-06-01",
      "contractEnd": "2026-05-31",
      "lastAssessment": "2026-03-01",
      "status": "active"
    }
  ],
  "sharing": [
    {
      "id": "SH-001",
      "framework": "FS-ISAC",
      "partyName": "FS-ISAC EMEA",
      "scope": "tactical",
      "signedAt": "2024-05-10",
      "lastExchangeAt": "2026-05-12",
      "exchanges90d": 22,
      "trustedCircle": true,
      "active": true
    },
    {
      "id": "SH-002",
      "framework": "CERT-EU",
      "partyName": "CERT-EU (Commission)",
      "scope": "operational",
      "signedAt": "2025-01-22",
      "lastExchangeAt": "2026-04-28",
      "exchanges90d": 8,
      "trustedCircle": true,
      "active": true
    },
    {
      "id": "SH-003",
      "framework": "national-CSIRT",
      "partyName": "ANSSI / CERT-FR",
      "scope": "strategic",
      "signedAt": "2023-09-04",
      "lastExchangeAt": "2026-05-02",
      "exchanges90d": 11,
      "trustedCircle": true,
      "active": true
    },
    {
      "id": "SH-004",
      "framework": "trade-body",
      "partyName": "AFG (Association Française Gestion)",
      "scope": "strategic",
      "signedAt": "2022-01-15",
      "lastExchangeAt": "2026-03-10",
      "exchanges90d": 4,
      "trustedCircle": false,
      "active": true
    },
    {
      "id": "SH-005",
      "framework": "bilateral",
      "partyName": "BNP Paribas Securities Services CSIRT",
      "scope": "operational",
      "signedAt": "2025-06-01",
      "lastExchangeAt": "2026-04-15",
      "exchanges90d": 6,
      "trustedCircle": true,
      "active": true
    }
  ]
}