Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Stakeholders / Everyone with PHP in the path / Organisations running PHP / Inside any one organisation / CTO
CTO: its risk register
Owns the platforms, the inventory and the upgrade budget.
Kind role · Assigned here 3 · In its register 3 · the briefing for a cto
The register
Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.
| Risk | Rating | Kind | Part played | Controls |
|---|---|---|---|---|
| R01-3 Versions the PHP project no longer fixes stay vulnerable | 20 critical | Security | owner | NIST SP 800-53 SA-22, CIS Controls 2.2, NIST CSF 2.0 PR.PS-02, Cyber Essentials SUM +1 |
| R01-6 Products that embed PHP stay vulnerable while their suppliers investigate | 16 high | Supply chain | owner | Cyber Resilience Act Art.13, Cyber Resilience Act AnnexI.II, OWASP Top 10s A03:2025, NIS2 Art.21(2)(d) +4 |
| R09 Not knowing where PHP runs | 16 high | Operational | owner | NIST CSF 2.0 ID.AM-02, NIST SP 800-53 CM-8, CIS Controls 16.4, DORA Art.8 +2 |
Where its risks sit
The standards its register touches
NIST CSF 2.0 (3), NIST SP 800-53 (2), CIS Controls (2), Cyber Resilience Act (2), ISO/IEC 27001 (2), DORA (2), Cyber Essentials (1), PCI DSS (1), OWASP Top 10s (1), NIS2 (1), SOC 2 (1)