ANInstituciones
ANSSI
French national cybersecurity agency.
EL PORTAL CIBER INTERNACIONAL / DIRECTORY
Un mundo de conocimiento.
Instituciones públicas, equipos de respuesta, empresas e investigación. Encuentre recursos para su país y sus necesidades.
Distribución de perfiles FIRST · 883
Perfiles en la instantánea : 883 ·
- Government, Private and Public sectors
252 / 883 252 - Other commercial
207 / 883 207 - Industrial sector
95 / 883 95 - Financial sector
94 / 883 94 - ICT vendor customer base
57 / 883 57 - Sector no indicado
50 / 883 50 - Government & military
46 / 883 46 - Research & education
45 / 883 45 - ISP customer base
37 / 883 37
El país y el sector no determinan el ámbito de intervención. Confirme las condiciones en el perfil oficial. FIRST ↗
CNInstituciones
CNIL
Personal data protection and AI resources.
ENInstituciones
ENISA
European Union Agency for Cybersecurity.
EUInstituciones
European Data Protection Board
European data protection guidance.
NIInstituciones
NIST
Risk frameworks, research and technical standards.
Identidad: factores, sesiones y recuperación
References use NIST SP 800-63B-4, finalised in July 2025, and WebAuthn Level 3, a W3C Recommendation since 25 August 2026. AALs describe authentication transactions rather than product scores or certifications earned by ticking this table. Application depends on service scope and risk assessment.
These values are not cookie lifetimes to copy blindly. NIST distinguishes overall and inactivity limits and then defines reauthentication rules. Applications may choose shorter periods based on risk. IAL concerns identity proofing and FAL federation: AAL does not replace either dimension.
- NIST SP 800-63B-4 · final publication ·
- NIST · Authentication Assurance Levels ·
- NIST · Authenticators and password requirements ·
- NIST · Authenticator Event Management ·
- NIST · Session Management ·
- NIST · Syncable Authenticators ·
Open the authenticator and recovery comparison →
Sources consulted on
KIInstituciones
KISA
Korea Internet & Security Agency.
DGInstituciones
DGSSI · Maroc
Morocco information systems security authority.
NAInstituciones
National Cybersecurity Authority · Saudi Arabia
National cybersecurity guidance and controls.
UNInvestigación y formación
UNIDIR
Research on disarmament, security and technology.
ITInstituciones
ITU · Cybersecurity
International cooperation and digital capacity building.
FIComunidades y estándares
FIRST · Traffic Light Protocol
Security information-sharing designations set by the source. Check their meaning before redistribution.
Información documental
- Dato o referencia verificada
- TLP 2.0 uses RED, AMBER, GREEN and CLEAR; AMBER+STRICT restricts sharing to the recipient organisation. Labels must not be translated.
- Cómo utilizarla
- Keep the marking with the information and check recipients before forwarding. Ask the source to clarify any ambiguity.
- Límite que debe conservarse
- TLP is neither a formal classification nor a reuse licence. It does not guarantee content accuracy.
Documentación consultada el
Indicadores STIX y difusión TLP
A traceable note does not by itself grant permission to redistribute it. TLP markings, additional restrictions and intended recipients must accompany a redaction or publication decision.
TLP describes a sharing scope; it certifies neither accuracy, official classification nor a usage licence. Encryption and retention rules need separate definition. Obtain explicit source permission before widening the received scope.
Read the STIX, observations and TLP sharing reference →
References and verification scope
- FIRST · Traffic Light Protocol 2.0 · TLP 2.0 · 2022-08
§1, §2, §3 · TLP:AMBER+STRICT
Sources checked on
NIInstituciones
NIST · Cybersecurity Framework
Cyber risk management framework and implementation resources. Organises intended outcomes rather than providing certification.
Información documental
- Dato o referencia verificada
- CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. It does not prescribe a single way to achieve outcomes.
- Cómo utilizarla
- Describe current and target profiles with evidence, gaps and owners. Connect each priority to the services it helps protect.
- Límite que debe conservarse
- Mapping to the framework is neither certification nor proof that every control works.
Documentación consultada el
Incidentes cibernéticos: decisiones y pruebas
Qualifying a signal, preserving investigative material and restoring a service answer different questions. CSF 2.0 distinguishes recovery initiation, integrity of restoration assets, validation of restored assets and the end of recovery. These are outcomes to document, not certification or one mandatory procedure.
The twelve entries below are a selected, paraphrased part of CSF 2.0. Evidence columns, timelines and injects are original teaching proposals. They do not replace a local plan and imply no universal timing, severity level or authority. SP 800-61 Revision 3 has been final since April 2025 and supersedes Revision 2.
Explore NIST outcomes and the timeline →
Primary references and limits
Identifiers and outcome meanings come from CSF 2.0; SP 800-61r3 adds incident response and recovery recommendations. Evidence tables, times and scenarios are educational, with no client results, certification or actual notification.
- NIST · SP 800-61 Rev. 3 · Final · 2025-04-03
Community Profile CSF 2.0 ; remplace / supersedes Rev. 2 - NIST · SP 800-61r3 — recommandations détaillées / detailed recommendations · April 2025
Pages imprimées / printed pages 27–29, 34–35 : RS.MA, RS.AN, RC.RP, RC.CO - NIST · Cybersecurity Framework 2.0 · 2024-02-26 · NIST CSWP 29
Appendix A, printed pages 22–23 : official outcome identifiers - NIST · SP 800-184 — Guide for Cybersecurity Event Recovery · Final · 2016-12-22
Recovery planning, playbooks, testing and improvement
References reviewed
NIInstituciones
NIST · AI Risk Management Framework
Voluntary framework and resources for documenting AI risks. Check the version and status of consulted documents.
Información documental
- Dato o referencia verificada
- The AI RMF Core is organised around Govern, Map, Measure and Manage. It is a voluntary risk-management framework.
- Cómo utilizarla
- Define intended use, affected people and error consequences. Connect each risk to an evaluation, owner and stop or recovery mechanism.
- Límite que debe conservarse
- The framework certifies neither a model nor an application. Using it does not remove the need to examine applicable requirements.
Documentación consultada el
W3Comunidades y estándares
W3C · Web Accessibility Initiative
Standards, evaluation methods and web accessibility resources. Supports complete journey testing beyond automated checks.
ICComunidades y estándares
ICANN · Registration Data Lookup
Domain registration data lookup. Redacted data or a technical provider alone cannot establish control by an entity.
Información documental
- Dato o referencia verificada
- RDAP is the registration data access protocol. ICANN Lookup provides access to available public registration data.
- Cómo utilizarla
- Keep the exact domain, consultation date and result. Distinguish registrar, technical service and the entity operating a website.
- Límite que debe conservarse
- Data may be redacted or limited. Domain information alone cannot attribute content or an operation to a person.
Documentación consultada el
SPComunidades y estándares
SPDX · Specifications
Describe components and information in a software bill of materials.
Información documental
- Dato o referencia verificada
- The official specifications page distinguishes SPDX 3.0 from earlier versions such as 2.3. Document version affects schema and tool compatibility.
- Cómo utilizarla
- Request format, version, build scope and component identifiers. Compare the bill of materials with the delivered artefact.
- Límite que debe conservarse
- A bill of materials alone proves neither vulnerability absence, dependency completeness nor compliance with every licence.
Documentación consultada el
NIInstituciones
NIST · Privacy Framework
Examine risks to people arising from data processing.
Información documental
- Dato o referencia verificada
- The Privacy Framework is a voluntary privacy risk-management tool. It is distinct from a universal legal compliance checklist.
- Cómo utilizarla
- Describe actual processing: data, purposes, recipients, access and retention. Compare documents, settings and deletion or retrieval tests.
- Límite que debe conservarse
- Using the framework alone does not determine compliance with applicable law. Processing context and jurisdiction still need examination.
Documentación consultada el