CNОрганизации
CNIL
Personal data protection and AI resources.
МЕЖДУНАРОДНЫЙ КИБЕРПОРТАЛ / DIRECTORY
Мир экспертизы.
Государственные организации, команды реагирования, компании и исследования. Найдите ресурсы для вашей страны и задач.
Распределение профилей FIRST · 883
Профилей в снимке данных : 883 ·
- Government, Private and Public sectors
252 / 883 252 - Other commercial
207 / 883 207 - Industrial sector
95 / 883 95 - Financial sector
94 / 883 94 - ICT vendor customer base
57 / 883 57 - Сектор не указан
50 / 883 50 - Government & military
46 / 883 46 - Research & education
45 / 883 45 - ISP customer base
37 / 883 37
Страна и сектор не определяют круг обслуживаемых организаций. Проверьте условия в официальном профиле. FIRST ↗
INНаука и обучение
Inria
Research in digital science and technology.
EUОрганизации
European Data Protection Board
European data protection guidance.
NIОрганизации
NIST
Risk frameworks, research and technical standards.
Идентификация: факторы, сеансы и восстановление
References use NIST SP 800-63B-4, finalised in July 2025, and WebAuthn Level 3, a W3C Recommendation since 25 August 2026. AALs describe authentication transactions rather than product scores or certifications earned by ticking this table. Application depends on service scope and risk assessment.
These values are not cookie lifetimes to copy blindly. NIST distinguishes overall and inactivity limits and then defines reauthentication rules. Applications may choose shorter periods based on risk. IAL concerns identity proofing and FAL federation: AAL does not replace either dimension.
- NIST SP 800-63B-4 · final publication ·
- NIST · Authentication Assurance Levels ·
- NIST · Authenticators and password requirements ·
- NIST · Authenticator Event Management ·
- NIST · Session Management ·
- NIST · Syncable Authenticators ·
Open the authenticator and recovery comparison →
Sources consulted on
OWСообщества и стандарты
OWASP Foundation
Open projects for application and AI security.
MIНаука и обучение
MITRE ATLAS
Knowledge base of threats to AI systems.
Документальные сведения
- Проверенные данные или ориентир
- The official repository publishes ATLAS tactics, techniques and case-study data. They support analysis of the actual deployed system.
- Как использовать
- Select scenarios matching your application’s data, interfaces and tools. Test permissions and consequences, not only model responses.
- Сохраняемое ограничение
- A technique catalogue is neither an exhaustive coverage guarantee nor a test result for your system.
Документация проверена
ARНаука и обучение
arXiv
Scientific preprints; peer review is not guaranteed.
HUЧастный сектор
Hugging Face
AI models, datasets and open tools.
MIЧастный сектор
Microsoft Security
Security research and analysis published by Microsoft.
NIОрганизации
NIST · AI Risk Management Framework
Voluntary framework and resources for documenting AI risks. Check the version and status of consulted documents.
Документальные сведения
- Проверенные данные или ориентир
- The AI RMF Core is organised around Govern, Map, Measure and Manage. It is a voluntary risk-management framework.
- Как использовать
- Define intended use, affected people and error consequences. Connect each risk to an evaluation, owner and stop or recovery mechanism.
- Сохраняемое ограничение
- The framework certifies neither a model nor an application. Using it does not remove the need to examine applicable requirements.
Документация проверена
OWСообщества и стандарты
OWASP · GenAI Security Project
Open risk reference for LLM and generative AI applications, including prompt injection, disclosure and excessive permissions.
Документальные сведения
- Проверенные данные или ориентир
- The 2025 edition includes Prompt Injection, Sensitive Information Disclosure and Excessive Agency.
- Как использовать
- Turn a risk into an observable scenario: hostile document, restricted data or out-of-scope tool. Record expected behaviour and evidence of refusal.
- Сохраняемое ограничение
- A risk list is not a complete assessment. Input filtering alone does not establish authorisation for every action.
Документация проверена
RAG: права доступа, ссылки и кеши
An accurate answer can disclose a forbidden document. Retrieval relevance, citation validity and access authorisation are separate checks. The service providing passages must enforce the current identity’s rights before exposing them to the model.
- OWASP · LLM08:2025 Vector and Embedding Weaknesses · 2025
- OWASP · LLM01:2025 Prompt Injection · 2025
- OWASP · LLM06:2025 Excessive Agency · 2025
- OWASP · LLM05:2025 Improper Output Handling · 2025
- OWASP · LLM07:2025 System Prompt Leakage · 2025
- OWASP · LLM10:2025 Unbounded Consumption · 2025
- OWASP · API1:2023 Broken Object Level Authorization · 2023
Explore the RAG access matrix and replay cases →
References consulted on
GOЧастный сектор
Google · AI features and your website
Understand inclusion in Google Search AI features.
Документальные сведения
- Проверенные данные или ориентир
- Google states that AI Overviews and AI Mode add no special technical requirements beyond applicable Search fundamentals.
- Как использовать
- Check page access, indexability, snippet eligibility, links and useful textual content. Measure observed appearance, clicks and business outcomes separately.
- Сохраняемое ограничение
- Eligibility guarantees neither crawling, indexing nor display. This documentation concerns Google Search, not every AI assistant.
Документация проверена
Публикация и видимость в ИИ-поиске
Google states worldwide rollout of the Search generative AI control on 31 August 2026. Its effective value may be inherited from a parent property. Record the exact property, explicit or inherited setting and observation date; do not infer the value from robots.txt alone.
The Search generative AI control does not govern model training. Google points to Google-Extended for that separate usage; Search AI exclusion does not mean general deindexing. This distinction belongs to the documented Google service and needs review when policies change.
Compare AI controls and report data →
Primary sources and scope
REP rules come from RFC 9309; Google-specific details are attributed to its own documentation. Examples and the diagram are educational. Filtering performs no crawling and the tables contain no client results.
- Google Search Central · Robots meta, X-Robots-Tag, data-nosnippet · Documentation consultée / accessed 2026-10-22
noindex; nosnippet; max-snippet; data-nosnippet; combined rules - Google Search Central · Generative AI search guidance · Documentation consultée / accessed 2026-10-22
Technical requirements; unsupported special markup; measurement - Google Search Console · Search generative AI control · Déploiement mondial annoncé / worldwide rollout stated: 2026-08-31
Include, exclude, inheritance; scope and training distinction - Google Search Console · Generative AI performance report (Search) · Déploiement mondial annoncé / worldwide rollout stated: 2026-08-31
Impressions; dimensions; aggregation; absent report
References reviewed
C2Сообщества и стандарты
C2PA · Content Credentials
Describe and verify certain content provenance information.
Документальные сведения
- Проверенные данные или ориентир
- C2PA specification 2.4 defines manifests, assertions and cryptographic binding mechanisms associated with media.
- Как использовать
- Examine what the manifest asserts, who signed it and whether validation succeeds. Test preservation after transformations and distribution.
- Сохраняемое ограничение
- Validated provenance does not establish the truth of a scene. Absence of a manifest does not demonstrate a fake.
Документация проверена
Происхождение медиа и проверка C2PA
A provenance report combines findings with different scopes. Signature, credential trust, content binding and scene context are separate assurances. Retain the exact asset and full report before summarising a result.
This JSON-LD representation is a derived view of C2PA data for reporting and interoperability. It is not independently verifiable or a validation input format.
- C2PA · Content Credentials Technical Specification 2.4 · 2.4 · April 2026
- C2PA · Content Credentials Explainer · 2.4
- C2PA · Security Considerations · 2.4
Open the C2PA explorer and publication cases →
References consulted on
NIОрганизации
NIST · Privacy Framework
Examine risks to people arising from data processing.
Документальные сведения
- Проверенные данные или ориентир
- The Privacy Framework is a voluntary privacy risk-management tool. It is distinct from a universal legal compliance checklist.
- Как использовать
- Describe actual processing: data, purposes, recipients, access and retention. Compare documents, settings and deletion or retrieval tests.
- Сохраняемое ограничение
- Using the framework alone does not determine compliance with applicable law. Processing context and jurisdiction still need examination.
Документация проверена