Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Stakeholders / Everyone with PHP in the path / Software built on PHP / Suppliers in the NCSC-NL inventory
Suppliers in the NCSC-NL inventory: its risk register
674 products tracked by NCSC-NL: some fixed, most vulnerable or under investigation as at the vault's last capture.
Kind group · Assigned here 3 · In its register 3
The register
Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.
| Risk | Rating | Kind | Part played | Controls |
|---|---|---|---|---|
| R01-6 Products that embed PHP stay vulnerable while their suppliers investigate | 16 high | Supply chain | owner | Cyber Resilience Act Art.13, Cyber Resilience Act AnnexI.II, OWASP Top 10s A03:2025, NIS2 Art.21(2)(d) +4 |
| R09 Not knowing where PHP runs | 16 high | Operational | informer | NIST CSF 2.0 ID.AM-02, NIST SP 800-53 CM-8, CIS Controls 16.4, DORA Art.8 +2 |
| R06-3 Manufacturers under the Cyber Resilience Act owe a 24-hour report | 12 high | Compliance | owner | Cyber Resilience Act Art.14, Cyber Resilience Act Art.13, Cyber Resilience Act Art.24, Cyber Resilience Act AnnexI.II |
Where its risks sit
The standards its register touches
Cyber Resilience Act (4), ISO/IEC 27001 (2), NIST CSF 2.0 (2), DORA (2), OWASP Top 10s (1), NIS2 (1), SOC 2 (1), NIST SP 800-53 (1), CIS Controls (1)