Cyber threats exploit shared software, cloud concentration and interconnected supply chains, so one vulnerability or provider outage can propagate across thousands of organisations and sectors at once. This section of the Digital, Cyber and AI subsite sets records for threat intelligence, vulnerabilities, software supply-chain attestations and incidents, built on open exchange formats, so that defenders and supervisors share evidence that can be verified rather than asserted. Every artifact of the area carries a UNI (Unique Nexus Identifier), which identifies and never certifies.
Nexus Standards (2026). Cyber and digital risk standards: area brief, Digital, Cyber and AI (PROPOSED). https://nexustandards.com/digital-ai/cyber-and-digital-risk-standards/. Last reviewed 2026-10-17.
Files carry the credits and the licence line; they are generated in your browser and nothing is sent. Downloads need script.
The hazard and threat families section of Digital, Cyber and AI. Scope as the area context entry states it (PROPOSED).
In scope 5
Out of scope 3
Jurisdictions No jurisdiction note is recorded for this area yet; jurisdiction narrows what applies and never implies that a Nexus profile satisfies a law.
Hazards and threats 5
Sectors 4
Sources the area reads or proposes. Delivery follows GRIx first; a source is shown live only after an owner decision admits it for public pages.
No legal register row admits any of these sources for live display on public pages yet, so nothing is read from them here. A register row that exists records the source for the governed GRIx path; admission for public pages is a separate owner decision.
Known Exploited Vulnerabilities cataloguepending admission
U.S. Cybersecurity and Infrastructure Security Agency · daily
U.S. Government work, public domain
GRIx governed readproposed register row
MITRE ATT&CK knowledge base (STIX 2.1)pending admission
The MITRE Corporation · semi-annual releases
MITRE ATT&CK terms of use (royalty-free licence with attribution)
build-time snapshotproposed register row
National Vulnerability Database (CVE enrichment API)pending admission
NIST · continuous
U.S. Government work, public domain
GRIx governed readproposed register row
OSV open source vulnerability databasepending admission
OSV project (Google, OpenSSF) · continuous
Per-source licences; OSV schema CC BY 4.0
GRIx governed readproposed register row
Each coupling names the mechanism that links this area to another; select a card on the canvas to trace it. Mechanisms are stated in the context bank (PROPOSED).
Fig.RUNNING marks the area you are reading; DONE an area in the same subsite, QUEUED an area elsewhere and GATE a subsite reached. Tags give reading order only, never a status. Design, not a record.
Relations are register entries (NS-14), never conformance or equivalence statements; hover or focus a relation for its meaning. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here.
adopt6
STIX Version 2.1OASIS Cyber Threat Intelligence TCregister · oasis-stix-2-1TAXII Version 2.1OASIS Cyber Threat Intelligence TCregister · oasis-taxii-2-1Common Security Advisory Framework 2.0OASIS CSAF TCregister · oasis-csaf-2Supply-chain Levels for Software Artifacts (SLSA) 1.1OpenSSFregister · slsaNIST SP 800-207 Zero Trust ArchitectureNISTregister · nist-sp-800-207Open Security Controls Assessment Language (OSCAL)NISTregister · nist-oscalClosed or paywalled standards appear by name and link only; any compatibility profile of one is built on simulated data and kept on protected pages until an institutional arrangement with the issuing body is recorded. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
The Nexus Standards the area context entry lists; the registry row lists NS-0, NS-9, NS-10, NS-11, NS-12. Every one is proposed or specified; none is adopted by an authority.
Status proposed · 12 rules stated. Read NS-0 · The rules for this area
Status proposed · 5 rules stated. Read NS-9 · The rules for this area
Status proposed · 7 rules stated. Read NS-10 · The rules for this area
Status proposed · 6 rules stated. Read NS-11 · The rules for this area
Status proposed · 4 rules stated. Read NS-12 · The rules for this area
Indicator names and codes as their stewards publish them; values appear only from a governed GRIx source, never typed into a page.
Test suites, conformance statements and attestations per standard; no attestation is recorded yet, and none would certify.
Pending admissionVersion and feed state per standard; every row reads source feed pending admission until a register row admits a feed.
PlannedReference deployments and the sandbox on simulated data; planned until the path is wired.
A console computes from the registry and shows its reasons; it never decides, approves or certifies.
GCRI Canada may admit incident and vulnerability records with source, timestamp and verification status as research evidence on digital systemic risk; GCRI Canada decides under its own evidence and research rules, and no approval is implied.
GRF may record organisations that publish attestations and advisories on the shared profiles as a trust dialogue item; GRF decides under its own recognition rules, and no recognition or endorsement is implied.
GRA may read supply-chain attestation and control-evidence records when it considers digital risk in investments; GRA decides under its own capital-readiness rules, and no approval, rating or investment view is implied.
Each institution decides under its own rules what it reads as evidence; no pathway is an approval, a readiness statement or investment advice.
Threat, vulnerability, attestation and incident records on open exchange formats, with control evidence for verification.
No working group is chartered yet; a community may charter this one under NS-13 through a docket.
This area has a row in registry/subsites.yaml (status planned), so it carries five depth pages and the register crosswalk of its domains.
The rules of each listed standard, read through the specification reader.
Depth · CrosswalkEvery register entry in the area's domains, by relation, with the crosswalk graph.
Depth · Records and schemasScope, record, schema explorer and how a UNI resolves.
Depth · ConformanceClauses, evidence and attestations; no step is a certification.
Depth · ReadinessThe area beside the three pathways, as a matrix.
5 Nexus Standards · 5 domains · 50 external standards · 25 issuing bodies · 1 consumers. Relations are register entries (adopt, profile, crosswalk, cite), never compliance claims; names belong to their stewards.
Crosswalk graph86 nodes and 128 links from registry/external-standards.yaml, registry/subsites.yaml and registry/consumers.yaml. Relations (adopt, profile, crosswalk, cite) are register entries, never compliance claims.
The registry holds no geography for the area itself: areas are not places. The one geography it implies is where the bodies that issue the area's external standards sit.
| Body | Seat | Register entries |
|---|---|---|
| NIST | Gaithersburg, Maryland, United States | 11 |
| ISO/IEC JTC 1/SC 42 | Geneva, Switzerland | 6 |
| European Parliament and Council | Brussels, Belgium | 4 |
| ISO/IEC JTC 1/SC 27 | Geneva, Switzerland | 4 |
| IEEE Standards Association | Piscataway, New Jersey, United States | 3 |
| OASIS Cyber Threat Intelligence TC | Woburn, Massachusetts, United States | 2 |
| Agentic AI Foundation (Linux Foundation) | San Francisco, California, United States | 1 |
| CEN-CENELEC JTC 21 | Brussels, Belgium | 1 |
| CISA (US Cybersecurity and Infrastructure Security Agency) | Washington, District of Columbia, United States | 1 |
| FIRST CVSS Special Interest Group | Cary, North Carolina, United States | 1 |
| IETF | Wilmington, Delaware, United States | 1 |
| IETF and OpenID Foundation | Wilmington, Delaware, United States | 1 |
| ISO/IEC JTC 1/SC 7 | Geneva, Switzerland | 1 |
| ISO/TC 292 | Geneva, Switzerland | 1 |
| OASIS CSAF TC | Woburn, Massachusetts, United States | 1 |
| OpenSSF (Linux Foundation) | San Francisco, California, United States | 1 |
| OpenVEX community (OpenSSF project) | San Francisco, California, United States | 1 |
| UN Office of the Secretary-General's Envoy on Technology and UNDP | New York, New York, United States | 1 |
1 subsites: no geography in the registry (areas, not places) · 2 consumers: repositories, no geography · 19 Nexus Standards: documents, no geography · 7 issuing bodies without a fixed public seat, listed not drawn: Mitchell et al. (FAT* 2019); World Customs Organization; OECD; UNESCO; United Nations; International Atomic Energy Agency; and more · Programme regions of the ecosystem coverage register: named, not drawn (no coordinates in the registry)
Standards globe18 issuing bodies with a public seat, 50 register entries, H3 cells at resolutions 1 to 4. Seats are city coordinates, not registry fields; subsites, consumers and standards have no geography, so none is drawn. Plate carrée still map; globe with script.
| Area on the sites | Artifact kinds | Governing standards | Pages |
|---|---|---|---|
| Ransomware, critical infrastructure attacks, data breaches, AI misuse | data, dataset, model, map, report | NS-1, NS-3, NS-3b, NS-5 | therisk.global/challenges/ |
| Cyber and digital resilience (GCRI Canada field gateway; GRF and GRA counterparts) | data, dataset, report, map, documentation | NS-1, NS-3, NS-3b, NS-4, NS-5 | therisk.global/fields/cyber/ |
From the ecosystem coverage register: what the GCRI Canada, The Global Risks Forum (GRF) and The Global Risks Alliance (GRA) sites publish on this area, as claimed there and not evaluated here.
Peer-reviewed sources and published statistics on the publishers' own domains, as the context entry cites them. No Risk Academy faculty pathway is linked to this area yet; one is linked when a faculty publishes a pathway that fits.
Risk Academy disciplines that teach Cyber and digital risk standards, with their courses; the GCRI Canada, The Global Risks Forum (GRF) and The Global Risks Alliance (GRA) subsites that carry those disciplines; and the Nexus Foundry systems the standards name. Mappings are proposed for review (Risk Academy standards map, 2026-10-17); a link says a page on the same subject exists, never an endorsement or a conformance statement; framework names in course titles are named and linked, never reproduced.
Propose a change, join the working group or name a source. Area entries are PROPOSED content for the Nexus Standards registry; a UNI identifies and never certifies, and nothing on this site is a certification, an approval or a readiness statement.
Nexus Standards documents CC BY 4.0 · tooling Apache-2.0 · counsel review pending (DEC-2026-10-16-NEXUS-STANDARDS-OPEN-LICENCE). External standards are named and linked under their own licences; a UNI (Unique Nexus Identifier) identifies, it never certifies. · Generated from the Nexus Standards corpus at commit 437ae044c5cb (2026-10-17); proposed and open.