Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Organisations running PHP / Inside any one organisation / CISO

CISO: its risk register

Owns the security risk register and reports it upward.

Kind role · Assigned here 2 · In its register 2 · the briefing for a ciso

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R08 Frontier AI finds critical flaws faster than maintainers can fix them20 criticalStrategicbearerEU AI Act Art.55, NIST AI RMF GOVERN-6.1, NIST AI RMF MEASURE-2.7, ISO/IEC 42001 6.1.2
R06-2 Essential and financial entities miss their reporting clocks12 highCompliancetreaterNIS2 Art.23, NIS2 Art.20, DORA Art.19, DORA Art.10 +1

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 25
4 Likely4 8 12 16 20 R08
3 Possible3 6 9 12 R06-215
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Who it shares risks with

Critical infrastructure providers (1), Banks, insurers and financial entities (1), EU and member-state CERTs (1), OpenAI (Patch the Planet) (1), The finders (1), The PHP project (1), Everyone with PHP in the path (1)

The standards its register touches

NIS2 (2), DORA (2), NIST AI RMF (2), NIST SP 800-53 (1), EU AI Act (1), ISO/IEC 42001 (1)