{
  "title": {
    "fr": "Répertoire des sources officielles",
    "en": "Official source directory"
  },
  "version": "2026-10-06",
  "method": {
    "fr": "Sélection éditoriale de portails primaires ; chaque fiche décrit un usage et une limite, sans classement commercial.",
    "en": "Editorial selection of primary portals; each record describes a use and limitation without commercial ranking."
  },
  "entries": [
    {
      "id": "annuaire",
      "category": "company",
      "territory": "France",
      "name": "Annuaire des Entreprises",
      "url": "https://annuaire-entreprises.data.gouv.fr/",
      "reference": "https://annuaire-entreprises.data.gouv.fr/a-propos/comment-ca-marche",
      "checked": "2026-10-02",
      "fr": {
        "use": "Retrouver une entité française et ses identifiants légaux.",
        "action": "Partir du SIREN ; distinguer établissement et unité légale.",
        "limit": "Une fiche administrative ne garantit ni solvabilité ni authenticité d’un contact."
      },
      "en": {
        "use": "Find a French entity and its legal identifiers.",
        "action": "Start with the SIREN; distinguish establishment from legal entity.",
        "limit": "An administrative record guarantees neither solvency nor contact authenticity."
      }
    },
    {
      "id": "inpi",
      "category": "company",
      "territory": "France",
      "name": "DATA INPI",
      "url": "https://data.inpi.fr/",
      "reference": "https://data.inpi.fr/",
      "checked": "2026-10-02",
      "fr": {
        "use": "Consulter les données du RNE et les bases de propriété industrielle.",
        "action": "Noter le numéro, le document consulté et sa date.",
        "limit": "Vérifier les conditions d’accès et de réutilisation propres aux données."
      },
      "en": {
        "use": "Consult RNE records and industrial-property databases.",
        "action": "Record the identifier, consulted document and date.",
        "limit": "Check the access and reuse conditions for each dataset."
      }
    },
    {
      "id": "bodacc",
      "category": "company",
      "territory": "France",
      "name": "BODACC",
      "url": "https://www.bodacc.fr/pages/home/",
      "reference": "https://www.bodacc.fr/pages/home/",
      "checked": "2026-10-02",
      "fr": {
        "use": "Rechercher des annonces civiles et commerciales.",
        "action": "Relier l’annonce à l’entité exacte et à la date publiée.",
        "limit": "Une annonce décrit un événement publié, pas toute la situation actuelle."
      },
      "en": {
        "use": "Search civil and commercial notices.",
        "action": "Link the notice to the exact entity and publication date.",
        "limit": "A notice describes a published event, not the entire current position."
      }
    },
    {
      "id": "companies-house",
      "category": "company",
      "territory": "United Kingdom",
      "name": "Companies House",
      "url": "https://find-and-update.company-information.service.gov.uk/",
      "reference": "https://find-and-update.company-information.service.gov.uk/",
      "checked": "2026-10-02",
      "fr": {
        "use": "Retrouver société, dirigeants et documents déposés au Royaume-Uni.",
        "action": "Utiliser le numéro de société et lire l’historique des dépôts.",
        "limit": "Le dépôt d’une information ne valide pas toutes les déclarations économiques."
      },
      "en": {
        "use": "Find UK companies, officers and filed documents.",
        "action": "Use the company number and read filing history.",
        "limit": "Filing information does not validate every economic claim."
      }
    },
    {
      "id": "icann",
      "category": "domain",
      "territory": "gTLD",
      "name": "ICANN Lookup",
      "url": "https://lookup.icann.org/en",
      "reference": "https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en",
      "checked": "2026-10-02",
      "fr": {
        "use": "Consulter les données d’enregistrement de domaines via RDAP.",
        "action": "Relever le domaine exact, les dates et le bureau d’enregistrement.",
        "limit": "Les champs masqués et règles des extensions limitent l’identification."
      },
      "en": {
        "use": "Consult domain registration data through RDAP.",
        "action": "Record the exact domain, dates and registrar.",
        "limit": "Redacted fields and extension-specific rules limit identification."
      }
    },
    {
      "id": "cert-fr",
      "category": "security",
      "territory": "France",
      "name": "CERT-FR",
      "url": "https://www.cert.ssi.gouv.fr/",
      "reference": "https://www.cert.ssi.gouv.fr/",
      "checked": "2026-10-02",
      "fr": {
        "use": "Suivre alertes, avis de sécurité et fiches réflexes.",
        "action": "Lire la référence, les versions touchées et les révisions.",
        "limit": "Un avis ne prouve pas que votre système est vulnérable ou compromis."
      },
      "en": {
        "use": "Follow alerts, security advisories and response guidance.",
        "action": "Read the reference, affected versions and revisions.",
        "limit": "An advisory does not prove your system is vulnerable or compromised."
      }
    },
    {
      "id": "enisa",
      "category": "security",
      "territory": "European Union",
      "name": "ENISA Threat Landscape",
      "url": "https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape",
      "reference": "https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape",
      "checked": "2026-10-02",
      "fr": {
        "use": "Comprendre les tendances européennes et leurs méthodes d’observation.",
        "action": "Distinguer année de publication, période observée et population.",
        "limit": "Des périodes qui se chevauchent ne forment pas une série annuelle comparable."
      },
      "en": {
        "use": "Understand European trends and their observation methods.",
        "action": "Separate publication year, observation period and population.",
        "limit": "Overlapping periods do not form a comparable annual series."
      }
    },
    {
      "id": "cybermalveillance",
      "category": "response",
      "territory": "France",
      "name": "Cybermalveillance.gouv.fr",
      "url": "https://www.cybermalveillance.gouv.fr/",
      "reference": "https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/piratage-de-compte",
      "checked": "2026-10-02",
      "fr": {
        "use": "Trouver des conseils défensifs et un parcours d’assistance.",
        "action": "Choisir la fiche correspondant au signal constaté.",
        "limit": "Une ressource générale ne remplace pas le traitement d’un incident actif."
      },
      "en": {
        "use": "Find defensive advice and an assistance pathway.",
        "action": "Select guidance matching the observed signal.",
        "limit": "General guidance does not replace handling an active incident."
      }
    },
    {
      "id": "cnil",
      "category": "privacy",
      "territory": "France / RGPD",
      "name": "CNIL — violations de données",
      "url": "https://www.cnil.fr/fr/violations-de-donnees-personnelles-les-regles-suivre",
      "reference": "https://www.cnil.fr/fr/violations-de-donnees-personnelles-les-regles-suivre",
      "checked": "2026-10-02",
      "fr": {
        "use": "Comprendre la documentation et les critères de notification des violations.",
        "action": "Faire qualifier le risque par le responsable et le DPO.",
        "limit": "Les obligations dépendent du rôle, du risque et du contexte ; éviter une règle automatique."
      },
      "en": {
        "use": "Understand breach documentation and notification criteria.",
        "action": "Have the controller and DPO assess the risk.",
        "limit": "Duties depend on role, risk and context; avoid an automatic rule."
      }
    },
    {
      "id": "nist",
      "category": "ai",
      "territory": "International",
      "name": "NIST — Generative AI Profile",
      "url": "https://doi.org/10.6028/NIST.AI.600-1",
      "reference": "https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence",
      "checked": "2026-10-02",
      "fr": {
        "use": "Structurer la revue des risques liés aux systèmes d’IA générative.",
        "action": "Relier le risque au cas d’usage et aux contrôles de validation.",
        "limit": "Ce cadre volontaire ne certifie pas un modèle ou une réponse particulière."
      },
      "en": {
        "use": "Structure a review of generative AI risks.",
        "action": "Connect risk to the use case and validation controls.",
        "limit": "This voluntary framework does not certify a model or individual answer."
      }
    },
    {
      "id": "gleif",
      "category": "company",
      "territory": "International",
      "name": "GLEIF · LEI",
      "url": "https://search.gleif.org/",
      "reference": "https://www.gleif.org/en/lei-data/access-and-use-lei-data",
      "checked": "2026-10-06",
      "fr": {
        "use": "Identifier une entité et consulter les relations déclarées associées à son LEI.",
        "action": "Conserver LEI, statut d’enregistrement, date de renouvellement et exceptions de déclaration des relations.",
        "limit": "Un LEI identifie une entité ; il ne certifie pas la solvabilité. Les données de relations peuvent comporter des exceptions."
      },
      "en": {
        "use": "Identify an entity and inspect reported relationships associated with its LEI.",
        "action": "Retain the LEI, registration status, renewal date and relationship reporting exceptions.",
        "limit": "An LEI identifies an entity; it does not certify solvency. Relationship data may include reporting exceptions."
      }
    },
    {
      "id": "vies",
      "category": "company",
      "territory": "European Union",
      "name": "Commission européenne · VIES",
      "url": "https://ec.europa.eu/taxation_customs/vies/",
      "reference": "https://ec.europa.eu/taxation_customs/vies/",
      "checked": "2026-10-06",
      "fr": {
        "use": "Vérifier la reconnaissance d’un numéro de TVA pour les échanges intracommunautaires.",
        "action": "Consigner pays, numéro, résultat et heure ; distinguer réponse négative et service indisponible.",
        "limit": "La validation de TVA ne confirme ni le contrôle d’un compte bancaire ni l’authenticité d’un interlocuteur."
      },
      "en": {
        "use": "Check recognition of a VAT number for intra-EU transactions.",
        "action": "Record country, number, result and time; distinguish a negative response from an unavailable service.",
        "limit": "VAT validation establishes neither bank-account control nor correspondent authenticity."
      }
    },
    {
      "id": "eu-sanctions",
      "category": "sanctions",
      "territory": "European Union",
      "name": "Commission européenne · sanctions financières",
      "url": "https://finance.ec.europa.eu/eu-and-world/sanctions-restrictive-measures/overview-sanctions-and-related-resources_en",
      "reference": "https://finance.ec.europa.eu/eu-and-world/sanctions-restrictive-measures/overview-sanctions-and-related-resources_en",
      "checked": "2026-10-06",
      "fr": {
        "use": "Accéder aux listes de sanctions financières et aux textes associés de l’UE.",
        "action": "Relier une correspondance à l’entité exacte, au régime et au texte en vigueur.",
        "limit": "Une absence dans la liste financière ne couvre pas toutes les restrictions sectorielles."
      },
      "en": {
        "use": "Access EU financial sanctions lists and associated legal texts.",
        "action": "Connect a match to the exact entity, regime and current legal text.",
        "limit": "Absence from the financial list does not cover all sectoral restrictions."
      }
    },
    {
      "id": "uk-sanctions",
      "category": "sanctions",
      "territory": "United Kingdom",
      "name": "UK Sanctions List",
      "url": "https://search-uk-sanctions-list.service.gov.uk/",
      "reference": "https://www.gov.uk/government/publications/the-uk-sanctions-list",
      "checked": "2026-10-06",
      "fr": {
        "use": "Consulter les désignations britanniques actuelles et leurs identifiants uniques.",
        "action": "Employer la UK Sanctions List ; l’ancienne liste consolidée OFSI n’est plus actualisée depuis le 28 janvier 2026.",
        "limit": "Un résultat approchant demande une comparaison des identifiants. La portée des restrictions doit être examinée séparément."
      },
      "en": {
        "use": "Consult current UK designations and unique identifiers.",
        "action": "Use the UK Sanctions List; the former OFSI consolidated list has not been updated since 28 January 2026.",
        "limit": "A fuzzy match requires identifier comparison. The scope of restrictions needs a separate assessment."
      }
    },
    {
      "id": "ofac",
      "category": "sanctions",
      "territory": "United States",
      "name": "OFAC · Sanctions List Search",
      "url": "https://sanctionssearch.ofac.treas.gov/",
      "reference": "https://ofac.treasury.gov/sanctions-list-search-tool",
      "checked": "2026-10-06",
      "fr": {
        "use": "Rechercher des correspondances possibles dans les listes SDN et consolidées non-SDN.",
        "action": "Conserver les paramètres de recherche et comparer alias, pays et identifiants publiés.",
        "limit": "Le score de recherche est une similarité, pas une probabilité de culpabilité ni une décision juridique."
      },
      "en": {
        "use": "Find potential matches in SDN and consolidated non-SDN lists.",
        "action": "Retain search settings and compare aliases, countries and published identifiers.",
        "limit": "The search score measures similarity, not culpability probability or a legal decision."
      }
    },
    {
      "id": "cisa-kev",
      "category": "security",
      "territory": "United States",
      "name": "CISA · Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "checked": "2026-10-06",
      "fr": {
        "use": "Repérer une CVE dont l’exploitation réelle est documentée dans le catalogue KEV.",
        "action": "Rapprocher la CVE du produit et de la version installée, puis consulter l’avis de l’éditeur.",
        "limit": "L’absence d’une CVE du catalogue ne prouve pas qu’elle n’est pas exploitée. Les échéances fédérales américaines ne sont pas des délais universels."
      },
      "en": {
        "use": "Identify a CVE with documented real-world exploitation in the KEV catalog.",
        "action": "Match the CVE to the installed product and version, then consult the vendor advisory.",
        "limit": "Absence from the catalog does not prove a CVE is not exploited. US federal deadlines are not universal deadlines."
      }
    },
    {
      "id": "first-epss",
      "category": "security",
      "territory": "International",
      "name": "FIRST · EPSS",
      "url": "https://www.first.org/epss/",
      "reference": "https://www.first.org/epss/",
      "checked": "2026-10-06",
      "fr": {
        "use": "Consulter l’estimation d’exploitation d’une CVE sur les trente prochains jours.",
        "action": "Conserver date du score, probabilité et percentile dans des champs distincts.",
        "limit": "Le score ne mesure ni l’impact métier ni la probabilité de compromission de votre propre système."
      },
      "en": {
        "use": "Consult a CVE exploitation estimate for the next thirty days.",
        "action": "Retain score date, probability and percentile in separate fields.",
        "limit": "The score measures neither business impact nor the compromise probability of your own system."
      }
    },
    {
      "id": "nvd",
      "category": "security",
      "territory": "United States",
      "name": "NIST · National Vulnerability Database",
      "url": "https://nvd.nist.gov/",
      "reference": "https://nvd.nist.gov/vuln-metrics/cvss",
      "checked": "2026-10-06",
      "fr": {
        "use": "Consulter les références et métriques de gravité associées à une CVE.",
        "action": "Noter source du score, version CVSS, vecteur et éventuelles différences avec l’avis éditeur.",
        "limit": "Un score CVSS exprime une gravité technique ; il ne constitue pas une mesure complète du risque."
      },
      "en": {
        "use": "Consult references and severity metrics associated with a CVE.",
        "action": "Record score source, CVSS version, vector and differences from the vendor advisory.",
        "limit": "A CVSS score expresses technical severity; it is not a complete risk measure."
      }
    }
  ]
}