Jean-Baptiste C.

CONSTRUCTION AND IMPLEMENTATION OF THE ISMS FOR ISO27001 CERTIFICATION

.Implementation of cyber governance practice, roadmap definition: ISMS, Run, transversal projects

.Facilitation of business, management, and operational committees, minutes

.Definition and update of risk management strategy: remediation, transfer, acceptance, avoidance

.Supplier risk management: Definition of strategy for service provider risks, definition of ICT service usage policy for critical or important functions, implementation and maintenance of an information register for all contracts with service providers, due diligence at the start of the relationship, drafting of supplier contracts

including security clauses, implementation of continuous relationship monitoring

.Implementation of activity monitoring indicators

.Implementation of the security process in Change Management

.Mentoring of alternating students

.Support for Swift Audits

.Support for the control environment: defined and updated policies, procedures, and processes

.Design and maintenance of the ISMS for ISO 27001 certification support

.Verification of the implementation of planned responses to risks and security requirements

.Recommendation of modifications/improvements to the information system security policy based on the evolving threat landscape

.Construction and maintenance of a knowledge base to facilitate audits, knowledge transfer, and sharing.

.Management of internal and external auditor expectations and requests, including the implementation of an audit program and compliance verification with standards and the assurance framework in collaboration with the internal audit team.

SUPPORT FOR THE IMPLEMENTATION OF THE DORA REGULATION/NIS2 DIRECTIVE - IMPLEMENTATION OF THE ISMS FOR ISO 27001 CERTIFICATION

- Implementation of the ISMS for ISO 27001 certification

- Support for the implementation and compliance with the European DORA regulation: regulation and first regulatory technical standards

- Support for the pre-implementation of the NIS2 directive, before its transposition into French law

- Implementation of security incident reporting processes

- Third-party risk management, particularly suppliers: Definition of strategy for service provider risks, definition of ICT service usage policy for critical or important functions, implementation and maintenance of an information register for all contracts with service providers, due diligence at the start of the relationship, drafting of contracts including security clauses, implementation of continuous relationship monitoring, drafting and updating of security assurance plans

- Deepening of the cybersecurity watch policy

and information sharing with the financial community and

regulatory authorities

PRODUCTION OF VERSION 2 OF THE INFORMATION SYSTEM SECURITY POLICY

 Update of the Information System Security Policy (ISO 27001: 2022)

 Implementation of recommendations in accordance with ISO 27002: 2022