AN公共机构
ANSSI
French national cybersecurity agency.
国际网络安全门户 / DIRECTORY
连接全球专业知识。
公共机构、响应团队、企业与研究。寻找适合您所在国家和需求的信息源。
FIRST资料分布 · 883
快照中的资料数 : 883 ·
- Government, Private and Public sectors
252 / 883 252 - Other commercial
207 / 883 207 - Industrial sector
95 / 883 95 - Financial sector
94 / 883 94 - ICT vendor customer base
57 / 883 57 - 未说明领域
50 / 883 50 - Government & military
46 / 883 46 - Research & education
45 / 883 45 - ISP customer base
37 / 883 37
国家和领域不能确定其服务范围。请在官方资料中确认服务条件。 FIRST ↗
CN公共机构
CNIL
Personal data protection and AI resources.
EN公共机构
ENISA
European Union Agency for Cybersecurity.
EU公共机构
European Data Protection Board
European data protection guidance.
NI公共机构
NIST
Risk frameworks, research and technical standards.
身份：认证要素、会话与恢复
References use NIST SP 800-63B-4, finalised in July 2025, and WebAuthn Level 3, a W3C Recommendation since 25 August 2026. AALs describe authentication transactions rather than product scores or certifications earned by ticking this table. Application depends on service scope and risk assessment.
These values are not cookie lifetimes to copy blindly. NIST distinguishes overall and inactivity limits and then defines reauthentication rules. Applications may choose shorter periods based on risk. IAL concerns identity proofing and FAL federation: AAL does not replace either dimension.
- NIST SP 800-63B-4 · final publication ·
- NIST · Authentication Assurance Levels ·
- NIST · Authenticators and password requirements ·
- NIST · Authenticator Event Management ·
- NIST · Session Management ·
- NIST · Syncable Authenticators ·
Open the authenticator and recovery comparison →
Sources consulted on
KI公共机构
KISA
Korea Internet & Security Agency.
DG公共机构
DGSSI · Maroc
Morocco information systems security authority.
NA公共机构
National Cybersecurity Authority · Saudi Arabia
National cybersecurity guidance and controls.
UN研究与教育
UNIDIR
Research on disarmament, security and technology.
IT公共机构
ITU · Cybersecurity
International cooperation and digital capacity building.
FI社区与标准
FIRST · Traffic Light Protocol
Security information-sharing designations set by the source. Check their meaning before redistribution.
参考资料详情
- 已核实的数据或指标
- TLP 2.0 uses RED, AMBER, GREEN and CLEAR; AMBER+STRICT restricts sharing to the recipient organisation. Labels must not be translated.
- 使用方法
- Keep the marking with the information and check recipients before forwarding. Ask the source to clarify any ambiguity.
- 需要保留的局限
- TLP is neither a formal classification nor a reuse licence. It does not guarantee content accuracy.
文档核查日期
STIX 指标与 TLP 共享
A traceable note does not by itself grant permission to redistribute it. TLP markings, additional restrictions and intended recipients must accompany a redaction or publication decision.
TLP describes a sharing scope; it certifies neither accuracy, official classification nor a usage licence. Encryption and retention rules need separate definition. Obtain explicit source permission before widening the received scope.
Read the STIX, observations and TLP sharing reference →
References and verification scope
- FIRST · Traffic Light Protocol 2.0 · TLP 2.0 · 2022-08
§1, §2, §3 · TLP:AMBER+STRICT
Sources checked on
NI公共机构
NIST · Cybersecurity Framework
Cyber risk management framework and implementation resources. Organises intended outcomes rather than providing certification.
参考资料详情
- 已核实的数据或指标
- CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. It does not prescribe a single way to achieve outcomes.
- 使用方法
- Describe current and target profiles with evidence, gaps and owners. Connect each priority to the services it helps protect.
- 需要保留的局限
- Mapping to the framework is neither certification nor proof that every control works.
文档核查日期
网络事件：恢复决策与证据
Qualifying a signal, preserving investigative material and restoring a service answer different questions. CSF 2.0 distinguishes recovery initiation, integrity of restoration assets, validation of restored assets and the end of recovery. These are outcomes to document, not certification or one mandatory procedure.
The twelve entries below are a selected, paraphrased part of CSF 2.0. Evidence columns, timelines and injects are original teaching proposals. They do not replace a local plan and imply no universal timing, severity level or authority. SP 800-61 Revision 3 has been final since April 2025 and supersedes Revision 2.
Explore NIST outcomes and the timeline →
Primary references and limits
Identifiers and outcome meanings come from CSF 2.0; SP 800-61r3 adds incident response and recovery recommendations. Evidence tables, times and scenarios are educational, with no client results, certification or actual notification.
- NIST · SP 800-61 Rev. 3 · Final · 2025-04-03
Community Profile CSF 2.0 ; remplace / supersedes Rev. 2 - NIST · SP 800-61r3 — recommandations détaillées / detailed recommendations · April 2025
Pages imprimées / printed pages 27–29, 34–35 : RS.MA, RS.AN, RC.RP, RC.CO - NIST · Cybersecurity Framework 2.0 · 2024-02-26 · NIST CSWP 29
Appendix A, printed pages 22–23 : official outcome identifiers - NIST · SP 800-184 — Guide for Cybersecurity Event Recovery · Final · 2016-12-22
Recovery planning, playbooks, testing and improvement
References reviewed
NI公共机构
NIST · AI Risk Management Framework
Voluntary framework and resources for documenting AI risks. Check the version and status of consulted documents.
参考资料详情
- 已核实的数据或指标
- The AI RMF Core is organised around Govern, Map, Measure and Manage. It is a voluntary risk-management framework.
- 使用方法
- Define intended use, affected people and error consequences. Connect each risk to an evaluation, owner and stop or recovery mechanism.
- 需要保留的局限
- The framework certifies neither a model nor an application. Using it does not remove the need to examine applicable requirements.
文档核查日期
W3社区与标准
W3C · Web Accessibility Initiative
Standards, evaluation methods and web accessibility resources. Supports complete journey testing beyond automated checks.
IC社区与标准
ICANN · Registration Data Lookup
Domain registration data lookup. Redacted data or a technical provider alone cannot establish control by an entity.
参考资料详情
- 已核实的数据或指标
- RDAP is the registration data access protocol. ICANN Lookup provides access to available public registration data.
- 使用方法
- Keep the exact domain, consultation date and result. Distinguish registrar, technical service and the entity operating a website.
- 需要保留的局限
- Data may be redacted or limited. Domain information alone cannot attribute content or an operation to a person.
文档核查日期
SP社区与标准
SPDX · Specifications
Describe components and information in a software bill of materials.
参考资料详情
- 已核实的数据或指标
- The official specifications page distinguishes SPDX 3.0 from earlier versions such as 2.3. Document version affects schema and tool compatibility.
- 使用方法
- Request format, version, build scope and component identifiers. Compare the bill of materials with the delivered artefact.
- 需要保留的局限
- A bill of materials alone proves neither vulnerability absence, dependency completeness nor compliance with every licence.
文档核查日期
NI公共机构
NIST · Privacy Framework
Examine risks to people arising from data processing.
参考资料详情
- 已核实的数据或指标
- The Privacy Framework is a voluntary privacy risk-management tool. It is distinct from a universal legal compliance checklist.
- 使用方法
- Describe actual processing: data, purposes, recipients, access and retention. Compare documents, settings and deletion or retrieval tests.
- 需要保留的局限
- Using the framework alone does not determine compliance with applicable law. Processing context and jurisdiction still need examination.
文档核查日期