Cybersecurity and Digital Resilience
The Global Centre for Risk and Innovation (GCRI)
Where Cybersecurity and Digital Resilience gets its data, on what terms, with what quality and with which known gaps.
GCRI · In development · service level R0
The Cybersecurity and Digital Resilience source register lists the datasets and records the platform draws on, such as NIST Cybersecurity Framework 2.0, each with its producer, licence and permitted uses, quality and known gaps. A source is listed only once its terms permit the use described, and data held by agreement is used under those terms and never republished.
Fig.How a finding is reviewed before it is published. Design, not a record.
For source and data register, in GCRI's spatial-intelligence reading, the map opens on true-colour imagery, night lights and land cover with true colour from NASA GIBS, framed on Europe; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Connected activity, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For source and data register, in GCRI's spatial-intelligence reading, the map opens on true-colour imagery, night lights and land cover with true colour from NASA GIBS, framed on Europe; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
Who produces the data and how.
Licence, restrictions and permitted uses.
Coverage, resolution, update frequency and known errors.
How the data reached the platform and what was changed.
What is missing and how the gap is handled.
| Source | What it gives | Terms | Used in |
|---|---|---|---|
| Verizon Data Breach Investigations Report | Patterns in breaches and incidents | Public report, Verizon terms | Cyber risk management, Identity and data security |
| Atlantic Council DFRLab and academic case studies | Investigations of operations with methods | Public, terms per publisher | Information operations |
| CISA industrial control systems advisories | Vulnerabilities and mitigations for control system products | Public domain, US government | Critical service cyber |
| CISA Known Exploited Vulnerabilities catalogue | Vulnerabilities confirmed as exploited in the wild | Public domain, US government | Cyber risk management |
| Cloudflare Radar post-quantum adoption data | Share of web traffic using post-quantum key agreement | Public, terms per provider (to check) | Post quantum migration |
| Competition authority cloud market studies | Market structure and concentration | Public records, licence per authority | Cloud and third parties |
| CycloneDX and SPDX specifications | Standard formats for software bills of materials | Open standards (SPDX is ISO/IEC 5962) | Supply chain security |
| Data protection authority annual reports and breach statistics | Breach notifications and enforcement | Public records, licence per authority | Identity and data security |
| DORA register of information and ICT third-party oversight materials | Requirements and oversight of critical ICT providers in EU finance | Public, EU terms | Cloud and third parties |
| DSA Transparency Database | Statements of reasons for content moderation decisions in the EU | Open, EU terms | Information operations |
| EEAS reports on foreign information manipulation and interference | Documented FIMI incidents and analytical framework | Public, EU terms | Information operations |
| Election observation mission reports | Assessments of information environments around elections | Public, terms per mission | Information operations |
| ENISA annual reports on NIS incidents | Aggregated incident reports from essential sectors | Public, ENISA terms | Critical service cyber |
| ENISA Threat Landscape | Annual analysis of threats and trends in Europe | Public, ENISA terms | Cyber risk management |
| EU Cyber Resilience Act and NIST Secure Software Development Framework | Requirements and practices for secure products | Public, EU and US government terms | Supply chain security |
| Expert surveys on quantum threat timelines | Distribution of expert expectations | Public reports, licence to check | Post quantum migration |
| FIDO Alliance specifications | Standards for phishing-resistant authentication | Public, FIDO terms | Identity and data security |
| Financial Stability Board work on third-party risk | Toolkit for third-party risk management and oversight | Public, FSB terms | Cloud and third parties |
| FIRST Exploit Prediction Scoring System (EPSS) | Estimated probability that a vulnerability will be exploited | Free, FIRST terms | Cyber risk management |
| Have I Been Pwned | Aggregated data from public breaches for exposure checks | Free service, terms of use | Identity and data security |
| IEC 62443 series | Security requirements for industrial automation and control systems | Licensed standards, purchase required | Critical service cyber |
| IETF drafts and standards for post-quantum and hybrid protocols | Protocol integration of new algorithms | Open, IETF Trust terms | Post quantum migration |
| Incident response industry reports such as Mandiant M-Trends | Dwell time and intrusion patterns | Public reports, terms per publisher | Incident response recovery |
| Joint advisories from national cyber agencies on threats to critical infrastructure | Assessments of actor behaviour and mitigations | Public, terms per agency | Critical service cyber |
| Joint agency guidance on managed service provider security | Practices for customers and providers | Public, terms per agency | Cloud and third parties |
| National CSIRT and agency annual reports | Incident statistics and trends | Public, terms per agency | Incident response recovery |
| National cyber agency migration guidance, such as UK NCSC and German BSI | Timelines and practices for migration | Public, terms per agency | Post quantum migration |
| NIST Cybersecurity Framework 2.0 | Functions, categories and outcomes for managing cyber risk | Public domain, US government | Cyber risk management |
| NIST Digital Identity Guidelines (SP 800-63) | Requirements for identity proofing and authentication | Public domain, US government | Identity and data security |
| NIST FIPS 203, 204 and 205 and the NIST post-quantum project | Standard post-quantum algorithms and transition guidance | Public domain, US government | Post quantum migration |
| NIST SP 800-61 incident handling guidance | Incident response life cycle and practices | Public domain, US government | Incident response recovery |
| No More Ransom project | Decryption tools and ransomware guidance from law enforcement and industry | Public, project terms | Incident response recovery |
| OpenSSF Scorecard | Automated checks of open-source project security practices | Open source, Apache 2.0 | Supply chain security |
| OSV open source vulnerability database | Vulnerabilities mapped to open-source package versions | Open, CC BY 4.0 | Supply chain security |
| Platform adversarial threat reports | Networks removed with tactics described | Public documents, terms per platform | Information operations |
| Provider public incident and status histories | Records of cloud outages | Public, terms per provider | Cloud and third parties |
| Published post-incident reviews | Lessons from major incidents | Public records, terms per publisher | Incident response recovery |
| Published post-incident reviews from operators and regulators | Causes and effects of critical service incidents | Public records, terms per publisher | Critical service cyber |
| SLSA framework | Levels of supply chain integrity for software builds | Open, community specification | Supply chain security |
Sources are added to the register as they are reviewed. A source is listed only once its terms permit the use described.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Provenance | Information about the entities, activities and people involved in producing a record, used to judge its quality and reliability, in the W3C PROV model. |
| FAIR principles | Guiding principles that make data findable, accessible, interoperable and reusable by people and machines. |
| Open licence | A licence that allows anyone to access, reuse and redistribute data, sometimes with attribution. |
| Data lineage | The traceable path of data from its origin through each transformation to its current form. |
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.