Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Stakeholders / Everyone with PHP in the path / People who use PHP services
People who use PHP services: its risk register
Citizens, customers and readers: they cannot patch anything, and they bear the outage and the breach.
Kind group · Assigned here 1 · In its register 5
The register
Assigned here, or arriving through a part of this stakeholder. The part played is the one recorded for whoever holds the assignment.
| Risk | Rating | Kind | Part played | Controls |
|---|---|---|---|---|
| R04 Services lost to precautionary shutdowns | 20 critical | Operational | through People who need a service that went offline (bearer) | ISO/IEC 27001 A.5.29, ISO/IEC 27001 A.5.30, NIS2 Art.21(2)(c), DORA Art.11 +2 |
| R04-1 National government services offline | 20 critical | Operational | through People who need a service that went offline (bearer) | NIS2 Art.21(2)(c), ISO/IEC 27001 A.5.29, NIST CSF 2.0 RC.RP-01 |
| R01 Remote code execution on internet-facing PHP servers | 15 high | Security | bearer | ISO/IEC 27001 A.8.8, NIST CSF 2.0 ID.RA-01, NIST SP 800-53 SI-2, CIS Controls 7.7 +3 |
| R06 A compromise becomes a reportable breach | 15 high | Compliance | through People whose data is held in PHP applications (bearer) | GDPR Art.32, GDPR Art.33, GDPR Art.34, NIS2 Art.23 +2 |
| R06-1 Personal data taken from a compromised PHP application | 15 high | Compliance | through People whose data is held in PHP applications (bearer) | GDPR Art.5(1)(f), GDPR Art.24, GDPR Art.28, GDPR Art.32 +2 |
Where its risks sit
Its parts
The standards its register touches
GDPR (6), ISO/IEC 27001 (3), NIS2 (3), NIST CSF 2.0 (2), NIST SP 800-53 (2), DORA (2), CIS Controls (1), MITRE ATT&CK (1), OWASP Top 10s (1), Cyber Resilience Act (1)