CNInstituutiot
CNIL
Personal data protection and AI resources.
KANSAINVÄLINEN KYBERPORTAALI / DIRECTORY
Maailma täynnä osaamista.
Viranomaiset, vastetiimit, yritykset ja tutkimus. Löydä maallesi ja tarpeisiisi sopivat lähteet.
FIRST-profiilien jakauma · 883
Profiileja tilannekuvassa : 883 ·
- Government, Private and Public sectors
252 / 883 252 - Other commercial
207 / 883 207 - Industrial sector
95 / 883 95 - Financial sector
94 / 883 94 - ICT vendor customer base
57 / 883 57 - Sektoria ei ilmoitettu
50 / 883 50 - Government & military
46 / 883 46 - Research & education
45 / 883 45 - ISP customer base
37 / 883 37
Maa ja sektori eivät määritä palvelun kohderyhmää. Tarkista ehdot virallisesta profiilista. FIRST ↗
INTutkimus ja koulutus
Inria
Research in digital science and technology.
EUInstituutiot
European Data Protection Board
European data protection guidance.
NIInstituutiot
NIST
Risk frameworks, research and technical standards.
Identiteetti: tekijät, istunnot ja palautus
References use NIST SP 800-63B-4, finalised in July 2025, and WebAuthn Level 3, a W3C Recommendation since 25 August 2026. AALs describe authentication transactions rather than product scores or certifications earned by ticking this table. Application depends on service scope and risk assessment.
These values are not cookie lifetimes to copy blindly. NIST distinguishes overall and inactivity limits and then defines reauthentication rules. Applications may choose shorter periods based on risk. IAL concerns identity proofing and FAL federation: AAL does not replace either dimension.
- NIST SP 800-63B-4 · final publication ·
- NIST · Authentication Assurance Levels ·
- NIST · Authenticators and password requirements ·
- NIST · Authenticator Event Management ·
- NIST · Session Management ·
- NIST · Syncable Authenticators ·
Open the authenticator and recovery comparison →
Sources consulted on
OWYhteisöt ja standardit
OWASP Foundation
Open projects for application and AI security.
MITutkimus ja koulutus
MITRE ATLAS
Knowledge base of threats to AI systems.
Lähdetiedot
- Tarkistettu tieto tai vertailukohta
- The official repository publishes ATLAS tactics, techniques and case-study data. They support analysis of the actual deployed system.
- Käyttö käytännössä
- Select scenarios matching your application’s data, interfaces and tools. Test permissions and consequences, not only model responses.
- Huomioitava rajoitus
- A technique catalogue is neither an exhaustive coverage guarantee nor a test result for your system.
Aineisto tarkistettu
ARTutkimus ja koulutus
arXiv
Scientific preprints; peer review is not guaranteed.
HUYksityinen sektori
Hugging Face
AI models, datasets and open tools.
MIYksityinen sektori
Microsoft Security
Security research and analysis published by Microsoft.
NIInstituutiot
NIST · AI Risk Management Framework
Voluntary framework and resources for documenting AI risks. Check the version and status of consulted documents.
Lähdetiedot
- Tarkistettu tieto tai vertailukohta
- The AI RMF Core is organised around Govern, Map, Measure and Manage. It is a voluntary risk-management framework.
- Käyttö käytännössä
- Define intended use, affected people and error consequences. Connect each risk to an evaluation, owner and stop or recovery mechanism.
- Huomioitava rajoitus
- The framework certifies neither a model nor an application. Using it does not remove the need to examine applicable requirements.
Aineisto tarkistettu
OWYhteisöt ja standardit
OWASP · GenAI Security Project
Open risk reference for LLM and generative AI applications, including prompt injection, disclosure and excessive permissions.
Lähdetiedot
- Tarkistettu tieto tai vertailukohta
- The 2025 edition includes Prompt Injection, Sensitive Information Disclosure and Excessive Agency.
- Käyttö käytännössä
- Turn a risk into an observable scenario: hostile document, restricted data or out-of-scope tool. Record expected behaviour and evidence of refusal.
- Huomioitava rajoitus
- A risk list is not a complete assessment. Input filtering alone does not establish authorisation for every action.
Aineisto tarkistettu
RAG: käyttöoikeudet, viitteet ja välimuistit
An accurate answer can disclose a forbidden document. Retrieval relevance, citation validity and access authorisation are separate checks. The service providing passages must enforce the current identity’s rights before exposing them to the model.
- OWASP · LLM08:2025 Vector and Embedding Weaknesses · 2025
- OWASP · LLM01:2025 Prompt Injection · 2025
- OWASP · LLM06:2025 Excessive Agency · 2025
- OWASP · LLM05:2025 Improper Output Handling · 2025
- OWASP · LLM07:2025 System Prompt Leakage · 2025
- OWASP · LLM10:2025 Unbounded Consumption · 2025
- OWASP · API1:2023 Broken Object Level Authorization · 2023
Explore the RAG access matrix and replay cases →
References consulted on
GOYksityinen sektori
Google · AI features and your website
Understand inclusion in Google Search AI features.
Lähdetiedot
- Tarkistettu tieto tai vertailukohta
- Google states that AI Overviews and AI Mode add no special technical requirements beyond applicable Search fundamentals.
- Käyttö käytännössä
- Check page access, indexability, snippet eligibility, links and useful textual content. Measure observed appearance, clicks and business outcomes separately.
- Huomioitava rajoitus
- Eligibility guarantees neither crawling, indexing nor display. This documentation concerns Google Search, not every AI assistant.
Aineisto tarkistettu
Julkaiseminen ja näkyvyys tekoälyhaussa
Google states worldwide rollout of the Search generative AI control on 31 August 2026. Its effective value may be inherited from a parent property. Record the exact property, explicit or inherited setting and observation date; do not infer the value from robots.txt alone.
The Search generative AI control does not govern model training. Google points to Google-Extended for that separate usage; Search AI exclusion does not mean general deindexing. This distinction belongs to the documented Google service and needs review when policies change.
Compare AI controls and report data →
Primary sources and scope
REP rules come from RFC 9309; Google-specific details are attributed to its own documentation. Examples and the diagram are educational. Filtering performs no crawling and the tables contain no client results.
- Google Search Central · Robots meta, X-Robots-Tag, data-nosnippet · Documentation consultée / accessed 2026-10-22
noindex; nosnippet; max-snippet; data-nosnippet; combined rules - Google Search Central · Generative AI search guidance · Documentation consultée / accessed 2026-10-22
Technical requirements; unsupported special markup; measurement - Google Search Console · Search generative AI control · Déploiement mondial annoncé / worldwide rollout stated: 2026-08-31
Include, exclude, inheritance; scope and training distinction - Google Search Console · Generative AI performance report (Search) · Déploiement mondial annoncé / worldwide rollout stated: 2026-08-31
Impressions; dimensions; aggregation; absent report
References reviewed
C2Yhteisöt ja standardit
C2PA · Content Credentials
Describe and verify certain content provenance information.
Lähdetiedot
- Tarkistettu tieto tai vertailukohta
- C2PA specification 2.4 defines manifests, assertions and cryptographic binding mechanisms associated with media.
- Käyttö käytännössä
- Examine what the manifest asserts, who signed it and whether validation succeeds. Test preservation after transformations and distribution.
- Huomioitava rajoitus
- Validated provenance does not establish the truth of a scene. Absence of a manifest does not demonstrate a fake.
Aineisto tarkistettu
Median alkuperä ja C2PA-validointi
A provenance report combines findings with different scopes. Signature, credential trust, content binding and scene context are separate assurances. Retain the exact asset and full report before summarising a result.
This JSON-LD representation is a derived view of C2PA data for reporting and interoperability. It is not independently verifiable or a validation input format.
- C2PA · Content Credentials Technical Specification 2.4 · 2.4 · April 2026
- C2PA · Content Credentials Explainer · 2.4
- C2PA · Security Considerations · 2.4
Open the C2PA explorer and publication cases →
References consulted on
NIInstituutiot
NIST · Privacy Framework
Examine risks to people arising from data processing.
Lähdetiedot
- Tarkistettu tieto tai vertailukohta
- The Privacy Framework is a voluntary privacy risk-management tool. It is distinct from a universal legal compliance checklist.
- Käyttö käytännössä
- Describe actual processing: data, purposes, recipients, access and retention. Compare documents, settings and deletion or retrieval tests.
- Huomioitava rajoitus
- Using the framework alone does not determine compliance with applicable law. Processing context and jurisdiction still need examination.
Aineisto tarkistettu