GCRI · Cybersecurity and Digital Resilience
Source and data register
Where Cybersecurity and Digital Resilience gets its data: each source with its licence, lineage, resolution, quality checks and known gaps.
01Register
Source and data register on the record.
Cybersecurity and Digital Resilience
- 02STEM methods6 canonical methods applied
- 03Topics8 subject pages
- 04Counterparts7 platforms in shared fields
- 05PublisherThe Global Centre for Risk and Innovation
02What is recorded
Each source carries five facts.
01
Origin
Who produces the data and how.
02
Access terms
Licence, restrictions and permitted uses.
03
Quality
Coverage, resolution, update frequency and known errors.
04
Provenance
How the data reached the platform and what was changed.
05
Gaps
What is missing and how the gap is handled.
03Every source the topic
Every source the topic dossiers cite, with its terms.
| Source | What it gives | Terms | Used in |
|---|---|---|---|
| Verizon Data Breach Investigations Report | Patterns in breaches and incidents | Public report, Verizon terms | Cyber risk management, Identity and data security |
| Atlantic Council DFRLab and academic case studies | Investigations of operations with methods | Public, terms per publisher | Information operations |
| CISA industrial control systems advisories | Vulnerabilities and mitigations for control system products | Public domain, US government | Critical service cyber |
| CISA Known Exploited Vulnerabilities catalogue | Vulnerabilities confirmed as exploited in the wild | Public domain, US government | Cyber risk management |
| Cloudflare Radar post-quantum adoption data | Share of web traffic using post-quantum key agreement | Public, terms per provider (to check) | Post quantum migration |
| Competition authority cloud market studies | Market structure and concentration | Public records, licence per authority | Cloud and third parties |
| CycloneDX and SPDX specifications | Standard formats for software bills of materials | Open standards (SPDX is ISO/IEC 5962) | Supply chain security |
| Data protection authority annual reports and breach statistics | Breach notifications and enforcement | Public records, licence per authority | Identity and data security |
| DORA register of information and ICT third-party oversight materials | Requirements and oversight of critical ICT providers in EU finance | Public, EU terms | Cloud and third parties |
| DSA Transparency Database | Statements of reasons for content moderation decisions in the EU | Open, EU terms | Information operations |
| EEAS reports on foreign information manipulation and interference | Documented FIMI incidents and analytical framework | Public, EU terms | Information operations |
| Election observation mission reports | Assessments of information environments around elections | Public, terms per mission | Information operations |
| ENISA annual reports on NIS incidents | Aggregated incident reports from essential sectors | Public, ENISA terms | Critical service cyber |
| ENISA Threat Landscape | Annual analysis of threats and trends in Europe | Public, ENISA terms | Cyber risk management |
| EU Cyber Resilience Act and NIST Secure Software Development Framework | Requirements and practices for secure products | Public, EU and US government terms | Supply chain security |
| Expert surveys on quantum threat timelines | Distribution of expert expectations | Public reports, licence to check | Post quantum migration |
| FIDO Alliance specifications | Standards for phishing-resistant authentication | Public, FIDO terms | Identity and data security |
| Financial Stability Board work on third-party risk | Toolkit for third-party risk management and oversight | Public, FSB terms | Cloud and third parties |
| FIRST Exploit Prediction Scoring System (EPSS) | Estimated probability that a vulnerability will be exploited | Free, FIRST terms | Cyber risk management |
| Have I Been Pwned | Aggregated data from public breaches for exposure checks | Free service, terms of use | Identity and data security |
| IEC 62443 series | Security requirements for industrial automation and control systems | Licensed standards, purchase required | Critical service cyber |
| IETF drafts and standards for post-quantum and hybrid protocols | Protocol integration of new algorithms | Open, IETF Trust terms | Post quantum migration |
| Incident response industry reports such as Mandiant M-Trends | Dwell time and intrusion patterns | Public reports, terms per publisher | Incident response recovery |
| Joint advisories from national cyber agencies on threats to critical infrastructure | Assessments of actor behaviour and mitigations | Public, terms per agency | Critical service cyber |
| Joint agency guidance on managed service provider security | Practices for customers and providers | Public, terms per agency | Cloud and third parties |
| National CSIRT and agency annual reports | Incident statistics and trends | Public, terms per agency | Incident response recovery |
| National cyber agency migration guidance, such as UK NCSC and German BSI | Timelines and practices for migration | Public, terms per agency | Post quantum migration |
| NIST Cybersecurity Framework 2.0 | Functions, categories and outcomes for managing cyber risk | Public domain, US government | Cyber risk management |
| NIST Digital Identity Guidelines (SP 800-63) | Requirements for identity proofing and authentication | Public domain, US government | Identity and data security |
| NIST FIPS 203, 204 and 205 and the NIST post-quantum project | Standard post-quantum algorithms and transition guidance | Public domain, US government | Post quantum migration |
| NIST SP 800-61 incident handling guidance | Incident response life cycle and practices | Public domain, US government | Incident response recovery |
| No More Ransom project | Decryption tools and ransomware guidance from law enforcement and industry | Public, project terms | Incident response recovery |
| OpenSSF Scorecard | Automated checks of open-source project security practices | Open source, Apache 2.0 | Supply chain security |
| OSV open source vulnerability database | Vulnerabilities mapped to open-source package versions | Open, CC BY 4.0 | Supply chain security |
| Platform adversarial threat reports | Networks removed with tactics described | Public documents, terms per platform | Information operations |
| Provider public incident and status histories | Records of cloud outages | Public, terms per provider | Cloud and third parties |
| Published post-incident reviews | Lessons from major incidents | Public records, terms per publisher | Incident response recovery |
| Published post-incident reviews from operators and regulators | Causes and effects of critical service incidents | Public records, terms per publisher | Critical service cyber |
| SLSA framework | Levels of supply chain integrity for software builds | Open, community specification | Supply chain security |
04Known gaps
Where the cyber data record is thin.
- Mandatory incident reports, which are often confidential.
- Third-party dependency data.
- Operational technology incident data.
- Recovery time data after major incidents.
05Status
How the register grows.
Sources are added to the register as they are reviewed. A source is listed only once its terms permit the use described.
06Sources
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
07Questions
Questions and answers.
Can I suggest a data source?
Yes. Write to Contact with the source, its owner and its terms.
ReportsContribute
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
GCRICybersecurity and Digital ResilienceStrategic SystemsScenario and Stress-Test
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Cybersecurity and Digital Resilience
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.