Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified DPO / RSSI / legal counsel before reliance. Citations to ANSSI / CNIL / EU regulations may lag the current text — verify against the source.
You are helping an enterprise architect assess compliance with ANSSI security recommendations for a French information system. ANSSI (Agence Nationale de la Sécurité des Systèmes d'Information) publishes the authoritative security guidelines for French organisations. The primary reference is the Guide d'hygiène informatique (42 measures), complemented by the ANSSI cloud security recommendations (2021) for cloud-hosted or hybrid systems.
These recommendations are best-practice baseline for all organisations and are referenced as mandatory input for OIV security plans, OSE NIS2 compliance, RGS homologation, and PSSI drafting.
User Input
$ARGUMENTS
Instructions
Note: Before generating, scan projects/ for existing project directories. For each project, list all ARC-*.md artifacts, check external/ for reference documents, and check 000-global/ for cross-project policies. If no external docs exist but they would improve output, ask the user.
Step 0: Read existing artifacts from the project context
MANDATORY (warn if missing):
REQ (Requirements) — Extract: system description, deployment environment (cloud/on-premise/hybrid), user scale, security requirements (NFR-SEC-xxx), OIV/OSE designation
If missing: warn that ANSSI assessment requires understanding of system scope and environment
RECOMMENDED (read if available, note if missing):
SECD (Secure by Design) — Extract: existing security controls and baseline measures already in place
PRIN (Architecture Principles, 000-global) — Extract: security principles and data classification policy
Step 0b: Read external documents and policies
Read any external documents in external/ — extract previous ANSSI audits, PASSI penetration test reports, existing hygiene assessments, CERT-FR advisories received
Read any global policies in 000-global/policies/ — extract security policy, access management policy, patch management policy
If a previous ANSSI assessment exists, note which measures have changed status since the last review
Step 1: Identify or Create Project
Identify the target project from the hook context. If the project doesn't exist:
Use Glob to list projects/*/ directories and find the highest NNN-* number
Calculate the next number (zero-padded to 3 digits)
Slugify the project name
Use the Write tool to create projects/{NNN}-{slug}/README.md
Set PROJECT_ID and PROJECT_PATH
Step 2: Read Source Artifacts
Read all documents from Step 0. From the artifacts, extract:
System deployment environment: cloud (IaaS/PaaS/SaaS), on-premise, hybrid
Existing security controls — which of the 42 hygiene measures may already be implemented
OIV/OSE designation — affects applicability priority (OIV must apply all measures)
Cloud provider used — determines which cloud recommendations apply
Step 3: ANSSI Assessment Template Reading
Read the template (with user override support):
First, check if .arckit/templates-custom/fr-anssi-template.md exists in the project root
If found: Read the user's customized template
If not found: Read .arckit/templates/fr-anssi-template.md
Step 4: ANSSI Compliance Assessment
Step 4a: Scope and Context
System profile: Document the system, its deployment environment, user population, and regulatory context (OIV/OSE/public sector/private)
Cloud determination: If the system uses any cloud services (IaaS, PaaS, SaaS), flag that cloud security recommendations apply in addition to the 42 measures
Applicability: Note any measures that are not applicable with justification (e.g. Measure 31 on Wi-Fi if the system has no Wi-Fi)
Step 4b: 42 Hygiene Measures Assessment
For each of the 42 measures, assess compliance status based on available artifacts, existing controls, and system context:
✅ Implemented: Evidence of the measure being in place
⚠️ Partial: Measure partially implemented — describe the gap
❌ Not implemented: No evidence of the measure being in place
N/A: Measure genuinely not applicable — document justification
Assess all seven themes:
Theme 1 — Know and manage your assets (Measures 1–5): hardware inventory, software inventory, naming conventions, technical contacts, network map
Theme 2 — Manage user and admin accounts (Measures 6–13): limit admin accounts, password policy, default credentials, individual accounts, account revocation, access management process, separate privileged accounts, no local admin for standard users
Theme 3 — Authenticate and control access (Measures 14–20): authentication before access, MFA for remote/admin, least privilege, restrict data access, physical access, authentication logging, remote maintenance security
Theme 4 — Secure workstations and mobile devices (Measures 21–27): configuration baseline, full-disk encryption on laptops, endpoint detection, removable media control, autorun disabled, email filtering, web content filtering
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ ANSSI Security Assessment Generated
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 Document: projects/{project_id}/ARC-{PROJECT_ID}-ANSSI-v{VERSION}.md
📋 Document ID: {document_id}
📅 Assessment Date: {date}
🔒 Classification: OFFICIAL-SENSITIVE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 Hygiene Score (42 measures)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Implemented: {N} / 42
Partial: {N} / 42
Not implemented: {N} / 42
Not applicable: {N} / 42
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🌩️ Cloud Recommendations (if applicable)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
{Cloud applicable: Yes / No}
{If yes: provider qualification status, key gaps}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🚨 Priority Gaps ({N} total)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔴 High ({N}): {top gap descriptions}
🟠 Medium ({N}): {medium gap descriptions}
🟡 Low ({N}):
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Next steps:
1. {If OIV/OSE: Run $arckit-fr-ebios — ANSSI findings feed Workshop 1 baseline}
2. {If cloud gaps: Run $arckit-fr-secnumcloud for provider qualification assessment}
3. Run $arckit-fr-pssi to formalise security objectives in a PSSI document
4. Run $arckit-secure to implement technical remediation measures
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Important Notes
Both public and private sector: The ANSSI guide d'hygiène applies to all French organisations — public, private, OIV, OSE, SME. Priority and obligation level differ (OIV must apply all measures; others treat them as strongly recommended).
OIV / OSE obligations: For OIV systems (SIIV), the hygiene measures are a baseline minimum. The sectoral arrêté sectoriel may impose additional measures. For OSE under NIS2, Article 21 measures overlap significantly — run $arckit-eu-nis2 to avoid duplication.
ANSSI cloud recommendations are separate from SecNumCloud: The cloud recommendations assess the security of the architecture; SecNumCloud is a provider qualification programme. Both are relevant for cloud-hosted sensitive systems.
CERT-FR subscription (Measure 41): Free subscription at cert.ssi.gouv.fr — flag this if not already done; it costs nothing and provides critical threat intelligence.
✅ Assessment document created at projects/{project_id}/ARC-{PROJECT_ID}-ANSSI-v{VERSION}.md
✅ All 42 hygiene measures assessed with status (implemented / partial / not implemented / N/A)
✅ Cloud security recommendations assessed if cloud services are used
✅ Gap analysis with priority, owner, and remediation action for each gap
✅ Summary score (N / 42 implemented) reported
✅ Document classified OFFICIAL-SENSITIVE minimum
✅ ANSSI per-type quality checks passed
Example Usage
$arckit-fr-anssi Assess ANSSI hygiene compliance for a French regional prefecture information system — on-premise Windows/Active Directory environment, 300 users, no cloud services
$arckit-fr-anssi ANSSI security posture for 001 — hybrid cloud ministry portal, hosted on OVHcloud, handling citizen personal data, NIS2 OSE designation
$arckit-fr-anssi ANSSI hygiene assessment for a French private company (OIV énergie sector), SCADA-adjacent IS, mixed cloud and on-premise, 50 IT staff
Suggested Next Steps
After completing this command, consider running:
$arckit-fr-ebios -- Use ANSSI hygiene gap findings as Workshop 1 security baseline in the EBIOS risk analysis (when ANSSI assessment reveals significant gaps that should inform a formal risk analysis)
$arckit-fr-secnumcloud -- Assess cloud provider qualification against SecNumCloud when cloud security gaps are identified (when Cloud security recommendations show gaps around provider qualification or extraterritorial risk)
$arckit-fr-pssi -- Translate ANSSI compliance findings into formal PSSI security objectives and organisational measures (when Organisation requires a formal security policy document)
$arckit-secure -- Implement the technical security measures identified in the ANSSI gap analysis (when ANSSI hygiene gaps require implementation in the codebase or infrastructure)
