Skip to content

GRF · 人工智能与数字治理

网络与公共基础设施

Public services and 关键基础设施 run on digital 系统 that attackers target and that fail through error. Cyber governance sets security obligations, incident reporting duties and the authorities that coordinate response. This page sets out how cyber risk to public infrastructure develops and how governance responds, the records that show it, and who holds the decisions.

01画布

工作如何开展。

系统 · 围绕本主题示意

公共算法登记册

Cyber and public infrastructure · Algorithm register · Quarter 3

两个未经评估的高风险系统GRF · 人工智能与数字治理

已登记的系统

福利欺诈标记社会能动性高缺失部分
许可分诊规划有限已完成是
入学安置教育高已完成是
聊天助手税务局极少已完成n/a

监督行动

系统
福利欺诈标记
必填
影响评估、申诉途径
截止日期
38 days
权限
监督机构

关于自动化决策的投诉

Public algorithm register: the screen’s structure, terms and states for Cyber and public infrastructure.示例名称和示意数值;是设计方案,并非记录或实时系统。

图Public algorithm register: example names and illustrative values, not a record or a live system.

02问题

Cyber and public infrastructure: how the risk develops.

Governance of digital dependencies. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.

机制

Legacy systems persist

Public bodies run old software that is costly to replace and hard to secure. Budget cycles favour new services over patching and replacement, so known weaknesses stay.

机制

Suppliers carry shared risk

Many agencies use the same software, cloud and managed service providers. A compromise of one supplier reaches all its customers at once.

机制

Incidents cross sectors

Ransomware at a hospital, utility or local council disrupts physical services. Dependencies between digital and physical infrastructure turn a 网络事件 into a public safety event.

机制

Reporting shapes response

Mandatory incident reporting to national authorities lets them warn others and coordinate. Late or partial reporting leaves other targets exposed.

03地理

东亚的关联活动。

来自 NASA GIBS 的东亚夜间灯光、人口密度与洪水。每个图层都注明其日期。

交互式地图需要JavaScript;图层列表和来源见下文。

图层 3

本页的互联活动

关于此图层
证据
观测
来源
VIIRS 黑色大理石(VNP46A2)(NASA LAADS DAAC)
提供方
NASA LAADS DAAC
许可协议
NASA 开放数据
年份版本
每日;卫星辐亮度,已校正月光和大气影响
构建时的最新内容
2026-10-12
分辨率
约 500 米网格
不确定性
所示日期的卫星夜间辐亮度;灯光是用电和停电情况的代理指标,不是对供应或可及性的测量。
可通过以下方式到达
gibs.earthdata.nasa.gov,仅在您允许加载实时地图后访问
关于此图层
证据
估计值
来源
世界网格化人口 v4.11(NASA SEDAC(哥伦比亚大学 CIESIN))
提供方
NASA SEDAC(CIESIN,哥伦比亚大学)
许可协议
CC BY 4.0
年份版本
null;基于人口普查的估算,静态(2020)
分辨率
约 1 公里网格
不确定性
基于普查的 2020 年每平方公里人口估算,作为风险暴露背景展示;不是受任何危害影响的人口数。
可通过以下方式到达
gibs.earthdata.nasa.gov,仅在您允许加载实时地图后访问
关于此图层
证据
观测
来源
VIIRS NOAA-20 校正反射率(NASA LANCE)
提供方
NASA LANCE
许可协议
NASA 开放数据
年份版本
每日;卫星图像
构建时的最新内容
2026-10-14
分辨率
约 250 米网格
不确定性
卫星图像。卫星或模型栅格数据,按提供方发布的原样呈现。云层、条带缺口和反演误差会造成缺口和噪声;数值是指标,而非某地的测量值。
可通过以下方式到达
gibs.earthdata.nasa.gov,仅在您允许加载实时地图后访问
关于此图层
证据
观测(云层造成缺口)
来源
VIIRS 全球洪水产品(NASA LANCE)
提供方
NASA LANCE
许可协议
NASA 开放数据
年份版本
每日;卫星探测;云层造成缺口
构建时的最新内容
2026-10-14
分辨率
约 250 米网格
不确定性
卫星探测;云层造成缺口。按提供方发布的原样提供的卫星或模型栅格数据。云层、扫描带缺口和反演误差会造成缺口和噪声;这些数值是指标,不是某一地点的测量值。
可通过以下方式到达
gibs.earthdata.nasa.gov,仅在您允许加载实时地图后访问
关于此图层
证据
观测(云层和过境时间造成缺口)
来源
VIIRS NOAA-20 375 米(FIRMS)(NASA LANCE FIRMS)
提供方
NASA LANCE FIRMS
许可协议
NASA 开放数据
年份版本
每日;卫星探测;云层和过境时间造成缺口
构建时的最新内容
2026-10-13
分辨率
约 500 米网格
不确定性
所示日期的卫星热点探测结果,包括天然气火炬和工业热源;不是已确认的火情、事件报告或预警。
可通过以下方式到达
gibs.earthdata.nasa.gov,仅在您允许加载实时地图后访问
关于此图层
证据
模型生成(GIBS 发布的最新年份)
来源
MODIS Terra 和 Aqua 土地覆盖(MCD12Q1)(NASA LP DAAC)
提供方
NASA LP DAAC
许可协议
NASA 开放数据
年份版本
每年;卫星分类;GIBS 发布的最新年份
构建时的最新内容
2024-01-01
分辨率
约 500 米网格
不确定性
所示年份的卫星土地覆盖类别,含农田;该分类存在已知误差,并非农场登记册。
可通过以下方式到达
gibs.earthdata.nasa.gov,仅在您允许加载实时地图后访问

最新可用

NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap贡献者 (ODbL) · Natural Earth

正在加载最新的NASA影像。

拖动以移动。按住 Ctrl 或 ⌘ 并滚动、双指缩放或使用按钮缩放;悬停可查看指针下的数值;重置可返回该区域。

东亚的关联活动。NASA 发布的卫星和模型产品,各带自己的日期。它们是指标,而非对任何地点的评估。

数据:NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap 贡献者 · Natural Earth · NASA EONET · NASA/NOAA VIIRS · 美国地质调查局来源与许可

  • We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA 开放数据
  • We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA 开放数据
  • VIIRS Black Marble 夜间灯光,NASA 戈达德航天中心;由 NASA Level-1 与大气档案和分发系统(LAADS DAAC)分发;影像来自 NASA GIBS。颜色依据已发布的色标重绘;显示处的数值已按六边形网格平均(经修改)。 NASA 开放数据
  • Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). 采用 CC BY 4.0 许可。颜色依据已发布的色标重绘;显示处的数值已按六边形网格平均(经修改)。 doi:10.7927/H49C6VHW. CC BY 4.0
  • VIIRS 近实时产品(洪水、地表温度、积雪覆盖、校正反射率),NASA LANCE;影像来自 NASA GIBS。颜色依据已发布的色标重绘;显示处的数值已按六边形网格平均(经修改)。 NASA 开放数据
  • NASA 资源管理火灾信息系统(FIRMS),VIIRS 375 m 活跃火点产品,NASA LANCE;矢量瓦片来自 NASA GIBS。颜色依据已发布的色标重绘;显示处的数值已按六边形网格平均(经修改)。 NASA 开放数据
  • MODIS 陆地产品(植被指数、总初级生产力、土地覆盖),NASA LP DAAC 和 LANCE;影像来自 NASA GIBS。颜色依据已发布的色标重绘;显示处的数值已按六边形网格平均(经修改)。 NASA 开放数据
  • ASTER GDEM 是 METI 和 NASA 的产品(ASTER Global Digital Elevation Model V003,NASA LP DAAC);影像来自 NASA GIBS。颜色依据已发布的色标重绘;显示处的数值已按六边形网格平均(经修改)。引用格式:NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA 开放数据
  • 使用 Natural Earth 制作。免费矢量和栅格地图数据,见 naturalearthdata.com。 公有领域
  • © OpenStreetMap 贡献者(ODbL),经由 NASA GIBS(海岸线、边界、道路和地名)。颜色依据已发布的色标重绘;显示处的数值已按六边形网格平均(经修改)。 ODbL
  • Blue Marble,NASA Earth Observatory;影像来自 NASA GIBS。颜色依据已发布的色标重绘;显示处的数值已按六边形网格平均(经修改)。 NASA 开放数据
  • 地球仪和平面地图上的背景信息:海岸线、边界、道路和地名来自 NASA GIBS 参考图层(OpenStreetMap 数据,ODbL,© OpenStreetMap contributors);Blue Marble 影像可作为可选底图;3D 地形和高程读数来自 ASTER GDEM 高程色彩指数(5 m 至 200 m 分级,为便于辨识而作了夸张处理)。边界按已发布的样式绘制,不代表对任何领土的立场。
  • 实时事件:NASA Earth Observatory Natural Event Tracker(EONET);事件仅供参考,并保留其原始来源链接。
  • Observed (EO): NASA/NOAA VIIRS (Suomi NPP). We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS).
  • 实时:NASA EONET。事件仅供参考,不是主管机构的预警。
  • 实时:美国地质调查局。事件仅供参考,不是主管机构的预警。
  • NASA GIBS: We acknowledge the use of imagery provided by services from NASA’s Global Imagery Browse Services (GIBS), part of NASA’s Earth Science Data and Information System (ESDIS).
  • 可选图层(图层列表中有 5 个来源:实时、预报、观测和背景)在打开时会在地图上和此处显示其提供方署名;预报为模型输出,派生指数为估计值。

图层与日期

  • 夜间灯光,每日:VIIRS Black Marble(VNP46A2),NASA LAADS DAAC · 2026年10月12日
  • 人口密度,2020 年:人口:哥伦比亚大学 CIESIN,世界网格化人口 v4.11(2018),NASA SEDAC, CC BY 4.0 · 静态
  • 真彩色:VIIRS NOAA-20 校正反射率,NASA LANCE · 2026年10月13日
  • 洪水水体,3 日合成:VIIRS 全球洪水产品,NASA LANCE · 2026年10月14日
  • 活跃火点与热异常:VIIRS NOAA-20 375 m(FIRMS),NASA LANCE FIRMS · 2026年10月13日
  • 土地覆盖类型(IGBP),年度:MODIS Terra 和 Aqua 土地覆盖(MCD12Q1),NASA LP DAAC · 2024

04指标

衡量什么,以及衡量得如何。

每个指标都注明其单位、频率、背后的来源类型以及数值将附带的证据标签。此处不显示数值:数值由计划依据其自身权限提供。

指标单位节奏来源类型标签
National cybersecurity strategy in force是或否变更时政府记录已发布统计
National computer security incident response team是或否,附职责授权变更时FIRST and ITU records已发布统计
Significant incidents reported by public bodiescount by sector年度National authority reports已发布统计
Global Cybersecurity Index tiertier, categorical定期ITU估算
Known exploited vulnerabilities remediated within deadlineshare定期Agency compliance reports已报告
Public service downtime from cyber incidentshoursper incidentIncident reports已报告
05决策模型

耦合在何处将损害变为中断。

How spare capacity and dependencies between sectors decide whether local damage stays local, the levers resilience regulation and investment can pull. Teaching model with stated illustrative values, not a prediction. The map on this page shows East Asia; the model itself is not tied to a place.

控制措施

每个图层的资产
18
危害足迹
占面积的 8%
依赖其他图层的资产
60%
备用容量(容差)
30%

读数

受危害冲击的资产
7%
仍在运行的资产
20%
初始损害的放大
10.8 times
结算步数
4
数字、方法与来源
步骤运行中的数据中心(%)运行中的网络(%)电力运行(%)
08989100
1567294
2503328
3333311
422336

方法

  1. 相互依存网络 Buldyrev 等(2010),Catastrophic cascade of failures in interdependent networks,Nature 464
  2. 过载级联 Motter and Lai (2002), Physical Review E 66
  3. 介数负载 Brandes (2001), Journal of Mathematical Sociology 25
  4. 多层网络 Kivela and others (2014), Journal of Complex Networks 2
  5. 基础设施相互依赖 Rinaldi, Peerenboom and Kelly (2001), IEEE Control Systems 21(6)
  6. 不确定性扇形图(参数蒙特卡罗) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
  7. 单因素敏感性(龙卷风图) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley

数据

The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page’s map can draw:

  • 主要道路 Natural Earth
  • 铁路 Natural Earth
  • 海港 Natural Earth
  • 机场 Natural Earth
  • 城市范围 Natural Earth
  • 今晚的夜间灯光、停电(VIIRS 昼夜波段) NASA/NOAA VIIRS(Suomi NPP)· 登记 nasa.gibs.context-live-layers
  • 自然事件(NASA EONET) NASA EONET · 登记 nasa.eonet.events
耦合在何处将损害变为中断。示意性教学模型:它基于控件设定的数值运行,而非实测数据。方法:相互依存网络(Buldyrev 等(2010),Catastrophic cascade of failures in interdependent networks,Nature 464);过载级联(Motter 和 Lai(2002),Physical Review E 66);介数负载(Brandes(2001),Journal of Mathematical Sociology 25)。
06来源

证据来自何处。

具名公共数据集与机构记录,各自注明许可类别。依协议获得的来源仅按其条款使用,绝不再次发布。

来源它提供什么许可类别
ITU Global Cybersecurity IndexCountry commitments on legal, technical, organisational, capacity and cooperation measuresFree to read, ITU terms
ENISA Threat Landscape and NIS incident reportsThreats and incidents across EU sectorsFree, ENISA terms
CISA Known Exploited Vulnerabilities catalogueVulnerabilities known to be exploited, with remediation deadlines for US federal agencies公有领域
National cyber security centre annual reviewsIncidents handled and threat assessmentsPublic records, terms per centre
FIRST member directoryIncident response teams and their constituenciesFree to read, FIRST terms
07实施

从授权到评估,按支柱划分。

The steps an instrument takes from mandate to evaluation, each with the pillar that runs it, and the decisions that stay with the authority. Teaching model with stated illustrative values, not a prediction. The map on this page shows East Asia; the model itself is not tied to a place.

  1. 授权与问题界定 主管当局(计划之外)
    主管当局依其自身规则界定问题和授权。 Howlett、Ramesh 和 Perl(2009)
  2. 证据与系统模型 Foundry
    对系统及其反馈、数据和已说明的局限进行建模。 OECD (2014),原则 2
  3. 在情景下评估备选方案 Foundry
    在情景下比较各项政策工具,并显示不确定性。 Hood (1983)
  4. 与利益相关方演练 宇宙
    在演练中与将实施和承担这些方案的各方一起检验方案。 OECD(2014),原则 3
  5. 起草标准或指南 Nexus Standards
    行之有效的做法被编纂为标准或指南,并公开征求意见。 Nexus Standards 流程
  6. 由主管当局决定 主管当局(计划之外)
    主管当局在计划之外,依据记录在案的证据作出决定。 Howlett、Ramesh 和 Perl(2009)
  7. 能力与培训 Risk Academy
    负责实施的人员接受关于所决定文书及其数据的培训。 仙台框架(2015),优先事项 2
  8. 监测与公开报告 报告
    指标连同来源、局限和更正一并发布。 OECD(2014),原则 5
  9. 评估与修订 Nexus Standards
    结果反馈至标准和模型:循环闭合。 Howlett、Ramesh 和 Perl(2009)

方法

  1. 政策周期 Howlett, Ramesh and Perl (2009), Studying Public Policy, Oxford University Press
  2. 关键风险治理 OECD(2014),Recommendation of the Council on the Governance of Critical Risks
  3. 有向图的分层绘制 Sugiyama, Tagawa and Toda (1981), IEEE SMC 11
从授权到评估,按支柱划分:所记录的各个步骤及其所属支柱;来源按各步骤所引。
08决定

由谁决定,以及证据服务于什么。

AI 与数字治理负责准备证据。以下决定由所列主管机构依据其自身规则作出,绝不由平台作出。

谁来决定问题本页面服务的证据
National cybersecurity authoritiesWhich obligations apply and how incidents are coordinatedComparative regimes and incident data
Public body leadershipHow much to invest in security and legacy replacementThreat data and comparable practice
立法机构Which sectors fall under cyber obligations and reporting dutiesComparative laws and incident evidence
Procurement authoritiesWhat security requirements suppliers must meetSupply chain incident evidence and standards

该主题产生的产出

  • Comparative notes on cyber obligations for public bodies
  • Guide to incident reporting regimes and timelines
  • Dialogue briefs on shared supplier risk in public services
  • Questions for public boards on cyber oversight
09孪生与级联模拟器

Exercise a cascade in cyber and public infrastructure with the people who decide.

Assembled from the Nexus Standards area profile 网络与数字风险标准: the hazards it names, the 系统 and communities that carry the loss, the controls and institutions that dampen it and the data that observe it. Pick an initiating event and step through the cascade to see where mandates meet and which decisions fall to whom. The Map view places the run on an example geography with open data. Every weight is a stated assumption. An exercise for dialogue, not a forecast, an assessment or a position. To model a place of your own choosing, open the full System Builder.

灾害

  • 溃坝
  • 河流洪水 (在下游引发)
  • 山洪 (在下游引发)
  • 大规模流离失所(在下游引发)
  • 大范围停电(在下游引发)
  • 供水短缺(在下游引发)

控制措施

  • NS-0 章程与原则
  • NS-9 情境 UNI(部署、实例、计划实例)
  • NS-10 政策和条款(机器可读的义务:定义、约束、评估和执行)
  • NS-11 验证与监测(证据、证明、零信任符合性观测)
  • NS-12 软件、模型和 AI/ML 制品(供应链、模型卡、数据集说明)
  • NRS-H94 危害族:系统性网络事件(NHS-1 cyber.systemic-cyber)
  • NRS-X6 网络与数字安全风险
  • NRS-H51 危害类别:恶意入侵(NHS-1 cyber.intrusion)
  • NRS-T8 软件与供应链完整性风险
  • NRS-H93 危害族:身份、信任与密码学失效(NHS-1 cyber.identity)
  • NRS-H54 危害类别:信号与平台中断(NHS-1 cyber.platform)

观测

  • National Vulnerability Database (CVE enrichment API) (listed for reference)
  • Known Exploited Vulnerabilities catalogue (listed for reference)
  • OSV open source vulnerability database (listed for reference)
  • MITRE ATT&CK knowledge base (STIX 2.1) (listed for reference)
  • Proportion of population covered by a mobile network, by technology
  • Fixed Internet broadband subscriptions per 100 inhabitants

示例地理范围

  • North America: 243 hexagonal cells
  • 今夜夜间灯光与停电(VIIRS 昼夜波段),NASA GIBS
  • 穿透云层的地表水,30 m(OPERA DSWx-S1 雷达),NASA GIBS
  • 过去半小时降雨率(IMERG),NASA GIBS
  • 地表土壤湿度(SMAP),NASA GIBS
10核心问题

What institutions ask about digital dependencies.

  • Which public services would stop if a given system, provider or network failed?
  • Who is responsible for securing each dependency, and are those responsibilities clear in contracts?
  • How are incidents reported, coordinated and communicated to the public?
  • How exposed is the public sector to a single provider or software component?
11工具与承诺

How cyber and public infrastructure is governed: instruments, mandates and commitments.

政策制定者、外交官或发展机构所使用的文书、授权、行为方和问责安排,并注明设定它们的协定。结构遵循所列框架。所绘制的任何状态或进展均为说明性,并非记录。

政策工具矩阵

The kinds of instrument available on cyber and public infrastructure, by level of government and cooperation.

工具类型地方国家区域全球
监管型分区、建筑规范法律、标准、许可统一规则公约与条约
经济地方税费、拨款预算项目、税收、保险计划风险池,区域基金融资机制
信息地方预警披露、预警、统计数据共享安排全球监测与报告
制度型地方委员会牵头机构,协调理事会区域机构与秘书处多边授权
合作型社区协议伙伴关系契约谅解备忘录与联合计划协定与共同承诺
A typology after the OECD Recommendation on the Governance of Critical Risks; examples of instrument types, not an inventory of any country’s measures.
《仙台框架》(减少灾害风险) · 联合国减少灾害风险办公室《巴黎协定》 · 《联合国气候变化框架公约》《2030 年可持续发展议程》和可持续发展目标 · 联合国《国际卫生条例》 · 世卫组织
12机制

How cyber risk reaches public services.

Ransomware attacks on hospitals, local governments and schools have shown how quickly encrypted 系统 can halt services, with patients diverted and payments delayed. Supply chain compromises, in which attackers enter through a trusted software update or provider, can reach many organisations at once. Faulty updates from a single vendor have also disrupted services widely without any attack at all.

Public bodies often have older systems, limited security staff and complex procurement, which makes them attractive targets. Responsibility is fragmented between the agency, its suppliers and national cyber authorities. Concentration on a few cloud and software providers creates efficiency and security benefits but also shared points of failure.

Why now: cyber incidents now halt hospitals, ports and payments, and the UN process on security in the use of information technologies agreed in 2025 to move to a permanent mechanism. The platform is designed to convene public infrastructure owners on decision rights during an incident and exercise them without touching live systems.

13方法与局限

Instruments of governance.

  1. 01

    Dependency mapping

    Identifying which services depend on which 系统 and providers. Limits: hidden sub-dependencies.

  2. 02

    Baseline security requirements

    Minimum controls for public bodies and suppliers. Limits: compliance does not ensure security.

  3. 03

    Incident reporting and coordination

    Mandatory reporting and national coordination. Limits: under-reporting and slow information sharing.

  4. 04

    演练

    Cross-agency cyber exercises. Limits: participants know it is an exercise.

14方法

如何研究,以及方法无法说明的内容。

  1. 政策、制度与决策科学比较 AI 制度 · 价值链问责梳理 · 论坛与职责授权梳理在此应用
  2. 数字身份与公共数字系统公共服务的保证等级 · 最小化披露 · 排斥分析在此应用
  3. 人工智能与机器学习模型在部署中如何失效 · 解读模型文档 · 智能体架构详解在此应用
15问题

问题与解答。

What is a CSIRT?
A computer security incident response team that receives, analyses and coordinates responses to cyber incidents for a defined constituency, such as a country or sector.
What does NIS2 require?
Essential and important entities in the EU must manage cybersecurity risks, report significant incidents within set deadlines and hold management bodies accountable.
Why are public bodies frequent targets?
They hold valuable data, run essential services, often use legacy systems and may pay to restore services, which attracts ransomware groups.
我应该向本平台报告网络事件吗?
No. Report incidents to your national cyber authority and follow your organisation’s incident procedures.
Is moving to cloud safer for public bodies?
It can improve security for many organisations, but it also creates dependence on providers. The trade-off should be assessed for each service.
Does the platform publish vulnerability information?
No. It discusses governance patterns, not specific vulnerabilities.
Why is responsibility for public cyber security fragmented?
Because agencies, suppliers and national authorities each hold part of it. Clear contracts and coordination arrangements reduce the gaps.
报告贡献

从本页贡献证据。

报告 is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

全球风险论坛(Global Risks Forum)人工智能与数字治理指数级技术证据简报
人工智能与数字治理

把一个治理问题带到论坛。

信息和咨询现已开放。每项咨询都会获得一个编号,并告知下一步;申请、付款、算力分配和注册只有在相应团队、条款和审查能力就绪时才会开放。