CN公共机构
CNIL
Personal data protection and AI resources.
国际网络安全门户 / DIRECTORY
连接全球专业知识。
公共机构、响应团队、企业与研究。寻找适合您所在国家和需求的信息源。
FIRST资料分布 · 883
快照中的资料数 : 883 ·
- Government, Private and Public sectors
252 / 883 252 - Other commercial
207 / 883 207 - Industrial sector
95 / 883 95 - Financial sector
94 / 883 94 - ICT vendor customer base
57 / 883 57 - 未说明领域
50 / 883 50 - Government & military
46 / 883 46 - Research & education
45 / 883 45 - ISP customer base
37 / 883 37
国家和领域不能确定其服务范围。请在官方资料中确认服务条件。 FIRST ↗
IN研究与教育
Inria
Research in digital science and technology.
EU公共机构
European Data Protection Board
European data protection guidance.
NI公共机构
NIST
Risk frameworks, research and technical standards.
身份：认证要素、会话与恢复
References use NIST SP 800-63B-4, finalised in July 2025, and WebAuthn Level 3, a W3C Recommendation since 25 August 2026. AALs describe authentication transactions rather than product scores or certifications earned by ticking this table. Application depends on service scope and risk assessment.
These values are not cookie lifetimes to copy blindly. NIST distinguishes overall and inactivity limits and then defines reauthentication rules. Applications may choose shorter periods based on risk. IAL concerns identity proofing and FAL federation: AAL does not replace either dimension.
- NIST SP 800-63B-4 · final publication ·
- NIST · Authentication Assurance Levels ·
- NIST · Authenticators and password requirements ·
- NIST · Authenticator Event Management ·
- NIST · Session Management ·
- NIST · Syncable Authenticators ·
Open the authenticator and recovery comparison →
Sources consulted on
OW社区与标准
OWASP Foundation
Open projects for application and AI security.
MI研究与教育
MITRE ATLAS
Knowledge base of threats to AI systems.
参考资料详情
- 已核实的数据或指标
- The official repository publishes ATLAS tactics, techniques and case-study data. They support analysis of the actual deployed system.
- 使用方法
- Select scenarios matching your application’s data, interfaces and tools. Test permissions and consequences, not only model responses.
- 需要保留的局限
- A technique catalogue is neither an exhaustive coverage guarantee nor a test result for your system.
文档核查日期
AR研究与教育
arXiv
Scientific preprints; peer review is not guaranteed.
HU私营部门
Hugging Face
AI models, datasets and open tools.
MI私营部门
Microsoft Security
Security research and analysis published by Microsoft.
NI公共机构
NIST · AI Risk Management Framework
Voluntary framework and resources for documenting AI risks. Check the version and status of consulted documents.
参考资料详情
- 已核实的数据或指标
- The AI RMF Core is organised around Govern, Map, Measure and Manage. It is a voluntary risk-management framework.
- 使用方法
- Define intended use, affected people and error consequences. Connect each risk to an evaluation, owner and stop or recovery mechanism.
- 需要保留的局限
- The framework certifies neither a model nor an application. Using it does not remove the need to examine applicable requirements.
文档核查日期
OW社区与标准
OWASP · GenAI Security Project
Open risk reference for LLM and generative AI applications, including prompt injection, disclosure and excessive permissions.
参考资料详情
- 已核实的数据或指标
- The 2025 edition includes Prompt Injection, Sensitive Information Disclosure and Excessive Agency.
- 使用方法
- Turn a risk into an observable scenario: hostile document, restricted data or out-of-scope tool. Record expected behaviour and evidence of refusal.
- 需要保留的局限
- A risk list is not a complete assessment. Input filtering alone does not establish authorisation for every action.
文档核查日期
RAG：访问权限、引用与缓存
An accurate answer can disclose a forbidden document. Retrieval relevance, citation validity and access authorisation are separate checks. The service providing passages must enforce the current identity’s rights before exposing them to the model.
- OWASP · LLM08:2025 Vector and Embedding Weaknesses · 2025
- OWASP · LLM01:2025 Prompt Injection · 2025
- OWASP · LLM06:2025 Excessive Agency · 2025
- OWASP · LLM05:2025 Improper Output Handling · 2025
- OWASP · LLM07:2025 System Prompt Leakage · 2025
- OWASP · LLM10:2025 Unbounded Consumption · 2025
- OWASP · API1:2023 Broken Object Level Authorization · 2023
Explore the RAG access matrix and replay cases →
References consulted on
GO私营部门
Google · AI features and your website
Understand inclusion in Google Search AI features.
参考资料详情
- 已核实的数据或指标
- Google states that AI Overviews and AI Mode add no special technical requirements beyond applicable Search fundamentals.
- 使用方法
- Check page access, indexability, snippet eligibility, links and useful textual content. Measure observed appearance, clicks and business outcomes separately.
- 需要保留的局限
- Eligibility guarantees neither crawling, indexing nor display. This documentation concerns Google Search, not every AI assistant.
文档核查日期
发布与 AI 搜索可见性
Google states worldwide rollout of the Search generative AI control on 31 August 2026. Its effective value may be inherited from a parent property. Record the exact property, explicit or inherited setting and observation date; do not infer the value from robots.txt alone.
The Search generative AI control does not govern model training. Google points to Google-Extended for that separate usage; Search AI exclusion does not mean general deindexing. This distinction belongs to the documented Google service and needs review when policies change.
Compare AI controls and report data →
Primary sources and scope
REP rules come from RFC 9309; Google-specific details are attributed to its own documentation. Examples and the diagram are educational. Filtering performs no crawling and the tables contain no client results.
- Google Search Central · Robots meta, X-Robots-Tag, data-nosnippet · Documentation consultée / accessed 2026-10-22
noindex; nosnippet; max-snippet; data-nosnippet; combined rules - Google Search Central · Generative AI search guidance · Documentation consultée / accessed 2026-10-22
Technical requirements; unsupported special markup; measurement - Google Search Console · Search generative AI control · Déploiement mondial annoncé / worldwide rollout stated: 2026-08-31
Include, exclude, inheritance; scope and training distinction - Google Search Console · Generative AI performance report (Search) · Déploiement mondial annoncé / worldwide rollout stated: 2026-08-31
Impressions; dimensions; aggregation; absent report
References reviewed
C2社区与标准
C2PA · Content Credentials
Describe and verify certain content provenance information.
参考资料详情
- 已核实的数据或指标
- C2PA specification 2.4 defines manifests, assertions and cryptographic binding mechanisms associated with media.
- 使用方法
- Examine what the manifest asserts, who signed it and whether validation succeeds. Test preservation after transformations and distribution.
- 需要保留的局限
- Validated provenance does not establish the truth of a scene. Absence of a manifest does not demonstrate a fake.
文档核查日期
媒体来源与 C2PA 验证
A provenance report combines findings with different scopes. Signature, credential trust, content binding and scene context are separate assurances. Retain the exact asset and full report before summarising a result.
This JSON-LD representation is a derived view of C2PA data for reporting and interoperability. It is not independently verifiable or a validation input format.
- C2PA · Content Credentials Technical Specification 2.4 · 2.4 · April 2026
- C2PA · Content Credentials Explainer · 2.4
- C2PA · Security Considerations · 2.4
Open the C2PA explorer and publication cases →
References consulted on
NI公共机构
NIST · Privacy Framework
Examine risks to people arising from data processing.
参考资料详情
- 已核实的数据或指标
- The Privacy Framework is a voluntary privacy risk-management tool. It is distinct from a universal legal compliance checklist.
- 使用方法
- Describe actual processing: data, purposes, recipients, access and retention. Compare documents, settings and deletion or retrieval tests.
- 需要保留的局限
- Using the framework alone does not determine compliance with applicable law. Processing context and jurisdiction still need examination.
文档核查日期