ANInstituições
ANSSI
French national cybersecurity agency.
O PORTAL CIBER INTERNACIONAL / DIRECTORY
Um mundo de conhecimento.
Instituições públicas, equipas de resposta, empresas e investigação. Encontre recursos para o seu país e os seus desafios.
Distribuição dos perfis FIRST · 883
Perfis no instantâneo : 883 ·
- Government, Private and Public sectors
252 / 883 252 - Other commercial
207 / 883 207 - Industrial sector
95 / 883 95 - Financial sector
94 / 883 94 - ICT vendor customer base
57 / 883 57 - Setor não indicado
50 / 883 50 - Government & military
46 / 883 46 - Research & education
45 / 883 45 - ISP customer base
37 / 883 37
O país e o setor não determinam o âmbito de intervenção. Confirme as condições no perfil oficial. FIRST ↗
CNInstituições
CNIL
Personal data protection and AI resources.
ENInstituições
ENISA
European Union Agency for Cybersecurity.
EUInstituições
European Data Protection Board
European data protection guidance.
NIInstituições
NIST
Risk frameworks, research and technical standards.
Identidade: fatores, sessões e recuperação
References use NIST SP 800-63B-4, finalised in July 2025, and WebAuthn Level 3, a W3C Recommendation since 25 August 2026. AALs describe authentication transactions rather than product scores or certifications earned by ticking this table. Application depends on service scope and risk assessment.
These values are not cookie lifetimes to copy blindly. NIST distinguishes overall and inactivity limits and then defines reauthentication rules. Applications may choose shorter periods based on risk. IAL concerns identity proofing and FAL federation: AAL does not replace either dimension.
- NIST SP 800-63B-4 · final publication ·
- NIST · Authentication Assurance Levels ·
- NIST · Authenticators and password requirements ·
- NIST · Authenticator Event Management ·
- NIST · Session Management ·
- NIST · Syncable Authenticators ·
Open the authenticator and recovery comparison →
Sources consulted on
KIInstituições
KISA
Korea Internet & Security Agency.
DGInstituições
DGSSI · Maroc
Morocco information systems security authority.
NAInstituições
National Cybersecurity Authority · Saudi Arabia
National cybersecurity guidance and controls.
UNInvestigação e formação
UNIDIR
Research on disarmament, security and technology.
ITInstituições
ITU · Cybersecurity
International cooperation and digital capacity building.
FIComunidades e normas
FIRST · Traffic Light Protocol
Security information-sharing designations set by the source. Check their meaning before redistribution.
Informação documental
- Dado ou referência verificada
- TLP 2.0 uses RED, AMBER, GREEN and CLEAR; AMBER+STRICT restricts sharing to the recipient organisation. Labels must not be translated.
- Como utilizar
- Keep the marking with the information and check recipients before forwarding. Ask the source to clarify any ambiguity.
- Limite a preservar
- TLP is neither a formal classification nor a reuse licence. It does not guarantee content accuracy.
Documentação consultada em
Indicadores STIX e partilha TLP
A traceable note does not by itself grant permission to redistribute it. TLP markings, additional restrictions and intended recipients must accompany a redaction or publication decision.
TLP describes a sharing scope; it certifies neither accuracy, official classification nor a usage licence. Encryption and retention rules need separate definition. Obtain explicit source permission before widening the received scope.
Read the STIX, observations and TLP sharing reference →
References and verification scope
- FIRST · Traffic Light Protocol 2.0 · TLP 2.0 · 2022-08
§1, §2, §3 · TLP:AMBER+STRICT
Sources checked on
NIInstituições
NIST · Cybersecurity Framework
Cyber risk management framework and implementation resources. Organises intended outcomes rather than providing certification.
Informação documental
- Dado ou referência verificada
- CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. It does not prescribe a single way to achieve outcomes.
- Como utilizar
- Describe current and target profiles with evidence, gaps and owners. Connect each priority to the services it helps protect.
- Limite a preservar
- Mapping to the framework is neither certification nor proof that every control works.
Documentação consultada em
Incidentes cibernéticos: decisões e evidências
Qualifying a signal, preserving investigative material and restoring a service answer different questions. CSF 2.0 distinguishes recovery initiation, integrity of restoration assets, validation of restored assets and the end of recovery. These are outcomes to document, not certification or one mandatory procedure.
The twelve entries below are a selected, paraphrased part of CSF 2.0. Evidence columns, timelines and injects are original teaching proposals. They do not replace a local plan and imply no universal timing, severity level or authority. SP 800-61 Revision 3 has been final since April 2025 and supersedes Revision 2.
Explore NIST outcomes and the timeline →
Primary references and limits
Identifiers and outcome meanings come from CSF 2.0; SP 800-61r3 adds incident response and recovery recommendations. Evidence tables, times and scenarios are educational, with no client results, certification or actual notification.
- NIST · SP 800-61 Rev. 3 · Final · 2025-04-03
Community Profile CSF 2.0 ; remplace / supersedes Rev. 2 - NIST · SP 800-61r3 — recommandations détaillées / detailed recommendations · April 2025
Pages imprimées / printed pages 27–29, 34–35 : RS.MA, RS.AN, RC.RP, RC.CO - NIST · Cybersecurity Framework 2.0 · 2024-02-26 · NIST CSWP 29
Appendix A, printed pages 22–23 : official outcome identifiers - NIST · SP 800-184 — Guide for Cybersecurity Event Recovery · Final · 2016-12-22
Recovery planning, playbooks, testing and improvement
References reviewed
NIInstituições
NIST · AI Risk Management Framework
Voluntary framework and resources for documenting AI risks. Check the version and status of consulted documents.
Informação documental
- Dado ou referência verificada
- The AI RMF Core is organised around Govern, Map, Measure and Manage. It is a voluntary risk-management framework.
- Como utilizar
- Define intended use, affected people and error consequences. Connect each risk to an evaluation, owner and stop or recovery mechanism.
- Limite a preservar
- The framework certifies neither a model nor an application. Using it does not remove the need to examine applicable requirements.
Documentação consultada em
W3Comunidades e normas
W3C · Web Accessibility Initiative
Standards, evaluation methods and web accessibility resources. Supports complete journey testing beyond automated checks.
ICComunidades e normas
ICANN · Registration Data Lookup
Domain registration data lookup. Redacted data or a technical provider alone cannot establish control by an entity.
Informação documental
- Dado ou referência verificada
- RDAP is the registration data access protocol. ICANN Lookup provides access to available public registration data.
- Como utilizar
- Keep the exact domain, consultation date and result. Distinguish registrar, technical service and the entity operating a website.
- Limite a preservar
- Data may be redacted or limited. Domain information alone cannot attribute content or an operation to a person.
Documentação consultada em
SPComunidades e normas
SPDX · Specifications
Describe components and information in a software bill of materials.
Informação documental
- Dado ou referência verificada
- The official specifications page distinguishes SPDX 3.0 from earlier versions such as 2.3. Document version affects schema and tool compatibility.
- Como utilizar
- Request format, version, build scope and component identifiers. Compare the bill of materials with the delivered artefact.
- Limite a preservar
- A bill of materials alone proves neither vulnerability absence, dependency completeness nor compliance with every licence.
Documentação consultada em
NIInstituições
NIST · Privacy Framework
Examine risks to people arising from data processing.
Informação documental
- Dado ou referência verificada
- The Privacy Framework is a voluntary privacy risk-management tool. It is distinct from a universal legal compliance checklist.
- Como utilizar
- Describe actual processing: data, purposes, recipients, access and retention. Compare documents, settings and deletion or retrieval tests.
- Limite a preservar
- Using the framework alone does not determine compliance with applicable law. Processing context and jurisdiction still need examination.
Documentação consultada em