Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Stakeholders / Everyone with PHP in the path / Organisations running PHP / Critical infrastructure providers

Critical infrastructure providers: its risk register

The few providers who received mitigation advice before disclosure; essential entities under NIS2.

Kind group · Assigned here 2 · In its register 2

The register

Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.

RiskRatingKindPart playedControls
R06-2 Essential and financial entities miss their reporting clocks12 highComplianceownerNIS2 Art.23, NIS2 Art.20, DORA Art.19, DORA Art.10 +1
R02-2 Early mitigation advice to a few providers leaked9 mediumDisclosure processsourceFIRST TLP 2.0 TLP:AMBER+STRICT, ISO/IEC 27001 A.5.14, ISO/IEC 29147 and 30111 29147:coordination

Where its risks sit

Likelihood / impact1 Minor2 Moderate3 Significant4 Major5 Severe
5 Happening5 10 15 20 25
4 Likely4 8 12 16 20
3 Possible3 6 9 R02-212 R06-215
2 Unlikely2 4 6 8 10
1 Rare1 2 3 4 5

Who it shares risks with

The PHP security team (1), Organisations running PHP (1), Banks, insurers and financial entities (1), EU and member-state CERTs (1), CISO (1)

The standards its register touches

NIS2 (2), DORA (2), FIRST TLP 2.0 (1), ISO/IEC 27001 (1), ISO/IEC 29147 and 30111 (1), NIST SP 800-53 (1)