This service aims to provide expertise to assess, advise, implement and supervise the necessary measures to ensure data security, while guiding companies on their journey towards ISO 27001 and SOC2 certification.



<div class="wp-block-columns">
<div class="wp-block-column">
<h2 class="wp-block-heading">Main missions :</h2>



<ol>
<li>Audit &amp; Diagnostic: Assessment of the current security posture, identification of vulnerabilities and recommendations.</li>



<li>Development of security strategies: Design of a complete IS security strategy aligned with business objectives and current regulations.</li>



<li>Certification Support: Guide for SMEs and startups in setting up a robust IS framework with a view to obtaining ISO 27001 and SOC2 certifications. This includes initial assessment, strategic planning, audit preparation and post-certification monitoring.</li>



<li>Training &amp; Awareness: Staff education on best security practices and awareness of different threats.</li>



<li>Incident management: Procedures for responding to possible intrusions or security violations and analyzing incidents for prevention.</li>



<li>Technology &amp; regulatory monitoring: Update on recent cyber threat trends and relevant regulations.</li>
</ol>
</div>



<div class="wp-block-column">
<h2 class="wp-block-heading">Types of deliverables:</h2>



<ol>
<li>Audit report: A detailed document highlighting current vulnerabilities, associated risks and recommendations to address them.</li>



<li>Strategic Security Plan: An overall framework that defines how the company will approach IT security, including policies, procedures and technical recommendations.</li>



<li>Training programs: Training modules and awareness materials for staff to strengthen safety culture.</li>



<li>Incident reports: Detailed analyzes of security incidents that have occurred, with recommendations to prevent their recurrence.</li>



<li>Security dashboard: A tool for regular monitoring of key performance indicators related to IS security, allowing continuous evaluation and adaptation according to changes in the threat landscape.</li>



<li>Guides and Manuals: Technical and operational documentation for deploying and managing recommended security tools and solutions.</li>
</ol>
</div>
</div>



<h2 class="wp-block-heading">Support Methodology</h2>



Discovery Phase: Before any intervention, a discovery phase is essential. It allows you to understand the culture of the company, its size, its sector of activity, and above all, its maturity in terms of IT security. This stage consists of interviews with key stakeholders, as well as an initial review of existing processes and tools.



Detailed Assessment: Based on the information collected during the discovery phase, an in-depth assessment of the systems, processes and policies in place is carried out. This makes it possible to determine deviations from ISO 27001 and SOC2 standards and establish a priority level for each corrective action.



Strategic Planning: An action plan is developed in collaboration with internal teams to respond to identified gaps. This detailed plan outlines the steps, responsibilities, timelines and resources needed to achieve compliance.



Implementation: During this phase, the recommendations are concretely applied. This may include implementing new tools, modifying existing processes or training teams. The consultant here plays the role of guide, technical expert and coach.



Review &amp; Audit Preparation: Once the changes are implemented, a full review is carried out to ensure that all deviations have been addressed. Additionally, a mock audit is carried out to prepare the company for the official examination.



Post-Certification Support: After obtaining certification, monitoring is offered to ensure that security practices are maintained and continually improved. This phase includes regular reviews, technological and regulatory monitoring, as well as ongoing training sessions.

ISO 27001 support

This pack offers a complete solution for companies looking to develop their online presence and improve the management of their information system. It combines expertise in drafting specifications for websites and web applications with strategic management of the information system, ensuring a coherent and integrated approach.



<div class="wp-block-columns">
<div class="wp-block-column">
<h2 class="wp-block-heading">Main Missions : </h2>



<ol>
<li>Writing of Specifications: Creation of detailed documents for websites and web applications, defining the objectives, functionalities, technical constraints and success criteria.</li>



<li>IS Management Consulting: Evaluation of current information systems, identification of possible improvements and development of strategies to optimize data and security management.</li>



<li>Implementation Assistance: Assistance with the selection of service providers and project management for the creation of websites and applications in accordance with specifications.</li>
</ol>
</div>



<div class="wp-block-column">
<h2 class="wp-block-heading">Types of deliverables:</h2>



<ol>
<li>Specifications: Structured documents detailing the specifications of websites and web applications.</li>



<li>IS Assessment Report: Analysis of the current state of the IS with recommendations for improvements.</li>



<li>Strategic Plans: Roadmaps for the development and implementation of web and IS management solutions.</li>



<li>Project Management Guides: Tools and methods for effective management of web development projects.</li>
</ol>
</div>
</div>



<h2 class="wp-block-heading">Support Methodology</h2>



Preliminary Analysis: Understand the specific needs of the company, its environment and its long-term objectives.



Development of specifications: Close work with stakeholders to draft precise and complete specifications.



Strategic Planning: Development of coherent strategies for IS and web projects, with clear and achievable steps.



Continuous Monitoring and Advice: Support throughout the implementation of projects, guaranteeing alignment with specifications and strategic objectives.

Drafting specifications

This pack offers a specialized service in writing detailed functional and technical specifications for websites and web applications. It is designed to help businesses clearly define the needs, features and technical constraints of their web projects, ensuring a solid foundation for development and implementation.



<div class="wp-block-columns">
<div class="wp-block-column">
<h2 class="wp-block-heading">Main Missions : </h2>



<ol>
<li>Writing Functional Specifications: Development of documents specifying the functionalities, user interface, user journeys and business requirements for websites and applications.</li>



<li>Writing Technical Specifications: Definition of technical requirements, including system architecture, technologies to be used, necessary integrations and performance constraints.</li>



<li>Needs Analysis: In-depth study of the company's needs, target audience and business objectives to ensure specifications match market expectations and requirements.</li>



<li>Coordination with Technical Teams: Close collaboration with developers, architects and other technical stakeholders to ensure feasibility and optimization of specifications.</li>
</ol>
</div>



<div class="wp-block-column">
<h2 class="wp-block-heading">Types of deliverables:</h2>



<ol>
<li>Functional Specification Documents: Detailing the functionality and user experience intended for the site or application.</li>



<li>Technical Specification Documents: Including technical aspects such as architecture, technologies, and integrations.</li>



<li>Requirements Analysis Reports: Summarizing the results of requirements studies and how they influence specifications.</li>



<li>Project Coordination Guides: Providing guidelines for management and effective communication between technical and non-technical teams.</li>
</ol>
</div>
</div>



<h2 class="wp-block-heading">Support Methodology</h2>



Information Gathering: Gather detailed information about the company's needs, expectations and objectives.



Writing and Validation: Developing specifications in close collaboration with customers and stakeholders, followed by a validation process to ensure accuracy and relevance.



Adaptability and Update: Flexibility to adjust specifications based on feedback, with ongoing updates to reflect changes in requirements or technologies.



Implementation Assistance: Provide support and guidance during the implementation phase to ensure development is aligned with established specifications.

Drafting Functional & Technical Specifications

This pack offers a comprehensive code audit service for businesses using PHP, JavaScript, MySQL, and various frameworks such as ReactJS, WordPress, Symfony, and NextJS. It aims to improve the quality, security and performance of the code of your applications and websites.



<div class="wp-block-columns">
<div class="wp-block-column">
<h2 class="wp-block-heading">Main Missions : </h2>



<ol>
<li>Code Quality Analysis: In-depth review of source code to identify possible errors, non-standard coding practices, and areas for improvement.</li>



<li>Security Assessment: Checking the code for security vulnerabilities, including XSS, CSRF, SQL injection, etc., and recommending how to fix them.</li>



<li>Performance Optimization: Analysis of code performance, with suggestions for optimizing execution speed and resource usage.</li>



<li>Architecture Review: Evaluation of the underlying architecture of the code to ensure its scalability and maintainability.</li>



<li>Compliance with Standards: Verification of code compliance with development standards and best practices.</li>
</ol>
</div>



<div class="wp-block-column">
<h2 class="wp-block-heading">Types of deliverables:</h2>



<ol>
<li>Code Audit Report: Comprehensive document presenting the results of the audit, including identified issues and recommendations.</li>



<li>Action Plan for Corrections: A step-by-step guide to resolving issues found during the audit.</li>



<li>Best Practices Documentation: Tips and guidelines for maintaining code quality and security.</li>



<li>Compliance Status Summary: Assessment of code compliance with current standards and suggestions for continued improvement.</li>
</ol>
</div>
</div>



<h2 class="wp-block-heading">Support Methodology</h2>



Preparation and Planning: Understand the audit objectives, the technological framework and prepare a personalized audit plan.



Audit Execution: Careful analysis of code through automated tools and manual reviews for a comprehensive assessment.



Report and Recommendations: Compilation of results into a detailed report with practical and specific recommendations.



Follow-up and Assistance: Provide follow-up for the implementation of recommendations and assistance with questions or clarifications.

Code Audit

Creation of an interface with a message broker in order to carry out tasks asynchronously.
Interface with RabbitMq and AWS SQS
Simple and complex asynchronous tasks performed:
<ul>
<li>Maintenance tasks</li>
<li>Mail sending</li>
<li>Image processing</li>
<li>Request to third-party services (mass data recovery)</li>
</ul>

Development

Technical Design

Interface with message broker

Creation of interfaces with different identity providers with the SAML protocol:
<ul>
<li>Okta
Microsoft Entra ID (formerly Azure Active Directory)
OneLogin
Ping Identity</li>
</ul>
Technical design of the interface with the existing identity service
Writing technical and functional specifications
Interface development with SimpleSAMLHPp

Project management support

Interface with SSO systems

Organization and holding of internal audits in order to validate the processes established within the framework of ISO or SOC 2 certification

Audits

Security

Internal audits

Réalisation d'une application Microsoft Teams pour offrir une expérience du Saas Grytics au sein de <a href="https://learn.microsoft.com/fr-fr/microsoft-365-app-certification/teams/1339-sas-grytics-companion" target="_blank" rel="noopener">Teams</a>.
<ul>
<li>Conception des interfaces dans le respect des guidelines de Microsoft (adaptation des principes de navigation et de la charte graphique)</li>
<li>Conception technique pour permettre l'interface entre l'application Teams / les services d'identification de Microsoft / les webservices du Saas</li>
<li>Réalisation des spécifications techniques</li>
<li>Gestion de la soumission, du parcours de test et de l'obtention de l'attestation Publisher et Microsoft 365</li>
</ul>
&nbsp;

Project owner support

Creation of Microsoft Teams application

Carrying out code reviews and audits:
PHP (Vanilla, Symfony, WordPress)
Javascript (ReactJs, NodeJs, NextJs)
MySQL
Static and dynamic analyzes

Code review and audit

Creating REST APIs with Symfony, PHP Vanilla and NodeJs
<ul>
<li>Design, technical specifications</li>
<li>Specificities :
<ul>
<li>Custom or JWT authentication</li>
<li>Development with Symfony (5.X, 6.X), PHP Vanilla and NodeJs</li>
<li>Interface with database (Doctrine or custom)</li>
<li>Interface with external APIs</li>
<li>Internal and public use</li>
</ul>
</li>
<li>Development</li>
<li>Test management</li>
<li>Documentation management</li>
</ul>

Rest API Development

Implementation of high availability architecture on public clouds (Amazon Web Services and Microsoft Azure) for a SaaS application &amp; showcase sites
<ul>
<li>Adaptation of application components in order to take advantage of the advantages and specificities of each</li>
<li>Simultaneous hosting of the application on several clouds</li>
<li>Automated deployment</li>
<li>Load management</li>
<li>“Classic” hosting on servers</li>
<li>Serverless hosting</li>
<li>Use of PaaS (AWS RDS, OpenSearch, etc.)</li>
</ul>

Outsourcing and hosting

High availability multi-cloud architecture

Write functional and technical specifications in order to realize the vision of the project based on specifications and/or on the work carried out during workshops with end customers (external or internal).
Projects can be technical or functional:
<ul>
<li>websites</li>
<li>apps</li>
<li>webservices</li>
</ul>

Technical and functional specifications

Design of showcase websites: project management and development
<ul>
<li>Writing functional and technical specifications</li>
<li>Management of development teams</li>
<li>Recipe management</li>
</ul>
Technical specificities :
<ul>
<li>CSS Framework: Bootstrap</li>
<li>Component libraries: ChakraUI, Tailwind, Fluent UI</li>
<li>Using CMS (WordPress) in classic mode</li>
<li>Using CMS in HeadLess mode: front with NextJs + WordPress in Headless with Rest API</li>
</ul>
&nbsp;

Design & Creation of showcase sites

Collection and translation of needs with a view to drafting specifications, whether formal (calls for tender) or more informal (development of specifications for a tool to be developed by internal teams).
Projects can be technical, organizational or functional:
<ul>
<li>websites, applications, webservices, etc.</li>
<li>organization of the IS</li>
</ul>

Writing specifications

Design, development and management of SaaS applications from A to Z
<ul>
<li>Functional design</li>
<li>Technical design</li>
</ul>
Achievements:
<ul>
<li>Grytics</li>
</ul>

SaaS web application development

Web project management from A to Z on both the client and agency sides.
<ul>
<li>Manage the teams under my responsibility: developers, other project managers, web designers and hosting engineers. This includes managing their schedule, answering questions, clarifying misunderstandings.</li>
<li>Write functional and technical specifications in order to realize the vision of the project concerned based on specifications and/or on the work carried out during workshops with end clients (external or internal).</li>
</ul>
Manage the functional and technical recipe
Some examples :
<ul>
<li>CEA (Atomic Energy and Alternative Energies Commission)
<ul>
<li>Creation of the internal DSI site for a knowledge base;</li>
<li>Redesign of the complete graphic charter of the CEA sites (still current): creation of all navigation principles, compliance with accessibility standards, HTML integration applicable on the CEA Sharepoint sites.</li>
</ul>
</li>
<li>Plus Belle la Vie: Creation of the community site (2011/2012).</li>
<li>Editions Harlequin: various showcase sites.</li>
<li>Editions Hachette Jeunesse: Various showcase sites and reader community sites.</li>
<li>Equidia &amp; PMU: Redesign of all TV channel sites and interface with the PMU for sports betting.</li>
<li>France TV: Redesign of broadcast sites (C dans l’Air for example).</li>
<li>Radio France: Functional and technical specifications on internal projects.</li>
<li>Grytics</li>
</ul>

Web project management

Mastery of interface to payment solutions: Stripe, Paypal
<ul>
<li>Management of one-time payments and subscriptions</li>
<li>Interface with business solution to manage its specificities (rights management, order management, etc.)</li>
</ul>

Interface with payment solutions

Use of different Microsoft APIs: Graph API, Yammer API, Activity API
<ul>
<li>Interface with authentication services (Consumer and Business)</li>
<li>Interface with endpoints dedicated to Yammer</li>
<li>Interface with endpoints dedicated to the Activity API for Azure tenants</li>
<li>Interface with SAML services</li>
</ul>
Technical design of interfaces (in PHP and NodeJs)
Development
Managing Application Review

Interface with Microsoft APIs

Using the Meta Graph API (Facebook)
<ul>
<li>Interface with Facebook Connect for authentication management</li>
<li>Interface with endpoints dedicated to Groups</li>
<li>Interface with endpoints dedicated to Pages</li>
<li>Interface with endpoints dedicated to Workplace</li>
</ul>
Technical design of interfaces (in PHP and NodeJs)
Development
Managing app review by Meta

Interface with Meta APIs

Compliance of SME procedures and practices in order to obtain ISO 27001-2013 certification.
<ul>
<li>Audit and study of the existing</li>
<li>Team training</li>
<li>Drafting policies and procedures</li>
<li>Creation of the monitoring framework</li>
</ul>

IS compliance with ISO 27001

Creation of the websockets architecture with SocketIo (interface in Php, NodeJs and ReactJs)
System development
Types of production:
<ul>
<li>Sending notifications to a customer</li>
<li>User authentication</li>
<li>Complex online gaming system</li>
</ul>

Websocket interface/management

Management of security audits from an application and development point of view
<ul>
<li>Implementation of internal procedures</li>
<li>Selection of service providers for organization of pentests</li>
<li>Security audit performance (code review and audit, pentest in gray box and white box mode)</li>
</ul>

Security audit

Compliance of SME procedures and practices in order to obtain SOC2 Type 1 certification.
<ul>
<li>Audit and study of the existing</li>
<li>Team training</li>
<li>Drafting policies and procedures</li>
<li>Creation of the monitoring framework</li>
</ul>

IS compliance with SOC2

Architecture design to store, analyze and consult these analyzes a large quantity of data (&gt; 2 million)
<ul>
<li>Ops Architecture: Intelligent Use of AWS Services</li>
<li>Back office architecture and design: MySQL optimizations, cache management, data flattening</li>
</ul>
Case: Grytics

My All-in-one packages

Drafting specifications

Drafting Functional & Technical Specifications

Code Audit