Taɣellist

Aselɣun ISO 27001 n umsenfar: acu ara tesneqdeḍ uqbel ad as-tefkeḍ isefka-k?

Sɣur Codevista InnovationsYeffeɣ-d ass n 12 Kṭuber 20268 n tesdatin n tɣuri

Aselɣun ISO/IEC 27001 yesbeggen dakken amsenfar (prestataire) yesbedd anagraw n usefrek n tɣellist n telɣut (SMSI), yettwasesteb s ɣur yiwen n unbaḍ n uselɣun ilelli, ɣef yiwet n tiɣzi yettwasbedden. Ur yesbeggen ara dakken akk tiwuriwin-nnes ttekkant deg-s, wala dakken isefka-k ad ttwasesfren akken i tt-tessutur leɣnut 09-08. Uqbel ad tezmleḍ, senqed tiɣzi, azilal, anbaḍ i t-id-yefkan d tmenna n useqdec, sakin steqsi-t ɣef mamek ara isesfer isefka-k.

Matta i d tanagit ISO/IEC 27001:2022?

ISO/IEC 27001 d tanagit tagraɣlant (norme internationale) yesbedden tiwtilin n unagraw n usefrek n tɣellist n telɣut (SMSI). Ur tettḥettim ara kra n wallal: tettḥettim tarrayt. Tuddsa tesseḥsay irisken i yettɣimin ɣef tbaḍnit (confidentialité), tummdit (intégrité) d twejda (disponibilité) n telɣut-nnes, tettafran isuraf i wakken ad ten-tesseḥbes, sakin tettsestib, tsenfal anagraw-nni deg teɣzi n wakud.

Lqem yettwasqedcen tura d win n 2022. Iḥricen-nnes seg 4 ar 10 sbedden tiwtilin n unagraw (asatal, tanbaḍt, asenfar, tallelt, tikli, aktazal n tmellit, asnerni) d tamernit-nnes A (annexe A) tettak-d 93 n yisuraf n tɣellist, yettwasegrawen deg kuẓ n yisental:

• isuraf n tuddsa: tisertiyin, asenqed n unekcum, assaɣen d yimsenfaren, asefrek n tdyanin (incidents), tazzla n uxeddim;
• isuraf ixuṣṣen imdanen: afran, asali n wulɣu (sensibilisation), tiwuriwin n tbaḍnit, axeddim s ubeɛd;
• isuraf ifizikiyen: anekcum ɣer yixxamen, aḥraz n yibenkan;
• isuraf iteknolojiyen: asentem n timagit (authentification), awgal n unekcum, asewgelhen (chiffrement), aɣmis n tigawin (journalisation), tiḥraz n yisefka (sauvegardes), asnulfu aɣelsan.

Akud n wenfal seg lqem n 2013 yekfa: aselɣun yettwasirgen i yeddren mazal yettḥaḍa lqem n 2022. Ma yella i k-d-skanen aselɣun « ISO 27001:2013 », steqsi anida yewweḍ wenfal-nnes. Agzul unṣib (officiel) n tnagit yella deg usmel n ISO.

Acu i yesbeggen uselɣun ISO 27001, d acu ur yesbeggen ara?

Aselɣun yettinid dakken yiwen n usestab ilelli (auditeur indépendant) yufa, deg yiwen n wass yettwassnen, dakken SMSI yemṣada d tiwtilin n tnagit. Kuẓ n yiferdisen i yesbedden azal-nnes.

Tiɣzi d nettat i d kullec

Yal aselɣun yettaru tiɣzi (périmètre, scope): tiwuriwin, idgan, ma yella daɣen inagrawen yettwaḥaḍan. Takebbanit tezmer ad tili tettwaselɣen ɣef usenṣeb (hébergement) maci ɣef usnulfu n useɣẓan. Ma yella tawuri i tettaɣeḍ ur tettwaru ara deg tiɣzi, aselɣun ur k-yettak ula d yiwet n tḍmanin fell-as.

Anbaḍ n uselɣun

Aselɣun yettak-it-id yiwen n unbaḍ n uselɣun (organisme de certification), ilaq netta s yiman-nnes ad yili yettwasirgen (accrédité) i ISO/IEC 27001 s ɣur yiwen n unbaḍ n usireg ittekkan deg yimtawan n tussna n IAF (International Accreditation Forum). Deg Murakuc am yal amkan, d asireg-a i yesɛan azal, maci tinmel (nationalité) n unbaḍ. Akaram i d-yefka yiwen n unbaḍ ur nettwasireg ara drus n wazal-nnes, ula ma yettban am win n tidet.

Azilal d yisestiben n uḍfar

Aselɣun yesɛa azemz n usuffeɣ d uzemz n tagara. Gar-asen, anbaḍ yettxeddim isestiben n uḍfar (audits de surveillance), ma drus tikkelt deg useggas, sakin asesteb n usmaynu uqbel tagara. Aselɣun yezmer ad yettwaḥbes neɣ ad yettwakkes ma yella tuccḍiwin ur ttwaseɣtent ara: alugu (logo) deg usmel web ur d-yettini acemma ɣef waddad-nnes n tura.

Tamenna n useqdec

Tamenna n useqdec (déclaration d'applicabilité, Statement of Applicability, SoA) tettales-d 93 n yisuraf n tmernit A, tettini anwi i yettwafernen d wid yettwaxedmen, sakin tessefhamay ayɣer yettwakkes yal yiwen. D akaram-a i d-yessekanen ayen yettxeddim umsenfar s tidet; s waṭas yettili d uffir, yezmer ad yettwafk s umtawa n tbaḍnit (accord de confidentialité).

Ɣer taggara, ISO 27001 ur tettselɣin ara afaris, wala aseɣẓan yettwafken, wala tilin n tɣellist mebla tixeṛṛiqin (vulnérabilités), wala amṣada d yiwet n leɣnut. Tanagit tettḥettim ɣef umsenfar ad yessen tiwuriwin-nnes n leɣnut d tid n uzmul; ur d-tettini ara dakken iḍfer-itent, akk ma d tiwuriwin-ik.

Mamek ara tesneqdeḍ aselɣun ISO 27001 n umsenfar?

Semmus n yisenqaden ur nesutur ula d yiwet n tmusni tatiknikt:

1. Ssuter anɣel (copie) n uselɣun, aru uṭṭun-nnes, lqem n tnagit (2022) d yizemzen n usuffeɣ d tagara.
2. Ɣer tiɣzi awal s wawal, sakin semmsa-tt d tuzna i tettaɣeḍ: asnulfu, asenṣeb, tallelt, tasmuɣli.
3. Issin anbaḍ n uselɣun, senqed asireg-nnes, sakin sentem azilal n uselɣun ɣur-s, s uɣmis-nnes deg Internet neɣ s tira.
4. Ssuter azemz n usesteb n uḍfar aneggaru, d ma yella tuccḍiwin timeqqranin (non-conformités majeures) mazal ttwaseɣtent.
5. Ssuter ad twaliḍ tamenna n useqdec, ma drus i yisuraf yettḥazan isefka-k: asenqed n unekcum, asewgelhen, imsenfaren, asnulfu aɣelsan.

Isenqaden-a ttkemmilen tagrumt n yiseqsawen n umagrad-nneɣ ɣef ufran n tkebbanit n usnulfu deg Dar Lbiḍa.

Matta iseqsawen ara tesqeseḍ i umsenfar n useɣẓan neɣ n IA?

Aselɣun yettlili amyannay, ur t-yettmedil ara.

I usenfar n usnulfu n useɣẓan

• Wi ara yesɛun anekcum ɣer yisefka-k n usexdem (production), ula d imsenfaren n daxel (sous-traitants), d mamek ara ttwakksen wanekcumen-a?
• Igemmaren n usnulfu d usenqed (test) sseqdacen isefka n tidet, isefka ur nesɛi isem (anonymisées) neɣ isefka n uɛraḍ (fictives)?
• Anida i yettwasenṣeb tengalt d yisefka, d deg wacu n tmura?
• Mamek d deg acḥal n wakud ara tettwassneḍ ma tella tedyant n tɣellist?
• Acu ara yuɣalen d isefka-k d wanekcumen-ik deg taggara n uzmul?

I usenfar n tussna tafrawant (IA)

• Anwi imsenfaren n tmudmin (modèles) neɣ n API i yettwasqedcen, d ma yella isefka-k ttwaznen ɣur-sen?
• Isefka-k ttwasqedcen i usmuɣel (entraînement) neɣ i usnerni n kra n tmudemt, ɣur umsenfar neɣ ɣur wis kraḍ?
• Isuturen d tririyin ttwarun deg uɣmis, d acḥal n wakud ara ttwaḥerzen?
• Isefka neɣ isuturen ffɣen seg Murakuc? Asiweḍ n yisefka ɣer berra yettwaḍbeṭ s tiwtilin n leɣnut 09-08, ddaw usenqed n CNDP.

Ẓer daɣen ayen ilaqen ad yettwaḥader deg umagrad-nneɣ ɣef IA tagmayt deg tkebbaniyin n Murakuc. I SaaS, rnu ameẓlu n yisefka gar yimsaɣen (ẓer amnir-nneɣ ɣef usnulfu n SaaS s wudem uslig).

ISO 27001, leɣnut 09-08 d CNDP: mamek i msemmadent?

Deg Murakuc, asesfer n yisefka udmawen yettwaḍbeṭ s leɣnut 09-08 (loi 09-08), ddaw usenqed n CNDP (Commission nationale de contrôle de la protection des données à caractère personnel, tamesbaṛt tanaṣlant i yettḥeḍḍun isefka udmawen). Leɣnut tettḥettim, gar wiyaḍ, tiwuriwin uqbel asesfer ɣer CNDP, isuraf n tɣellist yemṣadan d uḍbaṭ n usiweḍ n yisefka ɣer berra.

ISO 27001 d leɣnut 09-08 msemmadent, yiwet ur tettbeddil tayeḍ:

• leɣnut tettini acu ilaq ad tḍefreḍ d kečč d ameswul ɣef usesfer (responsable du traitement), d acu ilaq ad yeḍmen umsenfar-ik n daxel;
• ISO 27001 tettak-d tarrayt i usefrek n yisuraf n tɣellist ara yeǧǧen ad ttwaḥerzen tiwuriwin-a;
• aselɣun ur yettbeddil ara tiwuriwin ɣer CNDP, wala azmul n usenfar n daxel (contrat de sous-traitance).

Amsenfar yettwaselɣen yessehal fell-ak ad tesbeggneḍ amṣada-k, maca tamsulit n usesfer teqqim ɣef yiri-k. Tiwuriwin d yiḍrisen n tura: asmel n CNDP.

ISO 9001 neɣ ISO 27001: matta i d amgired i umsaɣ?

ISO 9001 tettselɣin anagraw n usefrek n tigezmi: tiwuriwin yettwaṭṭfen, yettwanin ɣer umsaɣ d usnerni ur nettḥbas. ISO 27001 tettselɣin anagraw n usefrek n tɣellist n telɣut: asefrek yettwasuddsen n yirisken ɣef telɣut. I usenfar n useɣẓan neɣ n IA i yessexdamen isefka-k, ISO 9001 tettini-ak-d mamek i yettwaxdam uxeddim, ISO 27001 mamek tettwaḥrez telɣut-ik. Ihi, aselɣun ISO 9001 weḥd-s ur d-yettini acemma ɣef tbaḍnit n yisefka-k; snat-nsent akken ttḥaḍant tarrayt n tuzna d tarrayt n uḥraz.

Mamek ara tesekcmeḍ taɣellist n yisefka deg udlis n tiwtilin?

Akud yelhan i usbedd n tiwtilin-a d uqbel tasuturt i yimsenfaren (consultation), maci ass n uzmul. Aru deg udlis n tiwtilin ayen tettraǧuḍ deg tɣellist: aselɣun yettwaramen d tiɣzi-nnes, adeg n usenṣeb, asefrek n unekcum, alɣu n tdyanin, tuɣalin (réversibilité). Sakin ssuter tiririyin tasga s tasga, s yikaramen, deg umkan n tsebbart « yettwaselɣen ISO 27001 » yettwaṛcmen.

Codevista Innovations tettwaselɣen ISO 27001:2022 (aselɣun CTX-2026-540336, yedder ar 31 dujembir 2029) d DIN EN ISO 9001:2015 (aselɣun CTX-2026-488547, yedder ar 19 yunyu 2028). I wakken ad tesneqdeḍ iselɣunen-a d tiɣzi-nsen uqbel asenfar n useɣẓan neɣ n IA, nermes tarbaɛt-nneɣ deg Dar Lbiḍa.

Isteqsiyen yettuɣalen

Amsenfar yettwaselɣen ISO 27001 yemṣada s yiman-nnes d leɣnut 09-08?

Ala. ISO 27001 tettḥettim ad ttwassnent tiwuriwin n leɣnut ixuṣṣen d ad ttwasefrken yirisken n tɣellist, maca ur tettxeddim ara deg umkan-ik tiwuriwin ɣer CNDP, wala tettbeddil azmul n usenfar n daxel. Amṣada d leɣnut 09-08 yettwasenqad weḥd-s, ddaw tmsulit n umeswul ɣef usesfer.

Acḥal n yisuraf n tɣellist i yellan deg tmernit A n ISO 27001:2022?

Tamernit A n lqem n 2022 tesɛa 93 n yisuraf, yettwabḍan ɣef kuẓ n yisental: tuddsa, imdanen, ifizikiyen d iteknolojiyen. Takebbanit yettwaselɣen ur tettwaḥettem ara ad ten-tesseqdec akk: tettafran wid yesseḥbasen irisken-nnes, tessefhamay yal tukksa deg tmenna-nnes n useqdec, i yettsenqad usestab.

Mamek ara issineɣ ma yella aselɣun ISO 27001 n umsenfar mazal yedder?

Aru uṭṭun n uselɣun, izemzen-nnes n usuffeɣ d tagara d yisem n unbaḍ n uselɣun, sakin senqed-it srid ɣur unbaḍ-a. Ssuter daɣen azemz n usesteb n uḍfar aneggaru: aselɣun yezmer ad yettwaḥbes neɣ ad yettwakkes uqbel tagara-nnes ma yella tuccḍiwin yettwafen ur ttwaseɣtent ara.

Ilaq ad tessutreḍ ISO 27001 i usenfar n tussna tafrawant?

D asektay yesɛan azal mi ara yessexdem usenfar isefka iḥulfanen neɣ udmawen, acku yessekan dakken amsenfar yessefrak irisken-nnes n tɣellist s tarrayt yettwasuddsen. Ssuter daɣen anwi imsenfaren n tmudmin i yettwasqedcen, ma yella isefka-k ttwasqedcen i usmuɣel, anida i ttwasenṣeben d acḥal n wakud ara ttwaḥerzen yimyannayen.