01
October 9, 2026
Security, privacy, suppliers: why NIST brings three plans around one system
NIST SP 800-18 Rev. 2 connects system security, privacy and supply chain risk plans. How can teams maintain consistent boundaries and reference data?
01 SECTION / CYBERCORIA
Information system mapping
Understand an information system through its objects, flows and, above all, its dependencies.
STARTING POINT
ANSSI methods, architecture, inventories, dependencies, repository governance and cybersecurity use cases.
A useful map is not a collection of diagrams. It is a living repository connecting business activities, applications, data, infrastructure, third parties and risks.
Questions we are trying to answer
- Where should an information system mapping initiative start?
- What level of detail is genuinely useful?
- How should inventory, dependencies and criticality be connected?
- How can the map stay current?
01 / Information system mapping
A useful map is a dependency model, not a collection of drawings
Inventory is the starting point, but value appears when objects are connected: a business activity depends on an application, and that application depends on identities, data, infrastructure and sometimes third parties. This structure makes impact explainable and produces views that can be reproduced rather than merely illustrated.
02 / Information system mapping
The right level of detail depends on the decision
A map built for an audit, disaster recovery or architecture review does not require exactly the same granularity. Cybercoria favours an incremental approach: define the questions, select the necessary objects, document relationships, then organise how the repository will stay current.
03 / Information system mapping
Quality is measured by how quickly the map answers real questions
A strong map helps teams find critical components, owners, flows and dependencies without reconstructing the environment during every incident. Articles in this section therefore distinguish inventory, relationships, views and data governance.
ANALYSES
7 publications
02
October 6, 2026
Tokens, APIs, workloads: the invisible identities your architecture should map
Applications and workloads also use identities, tokens and trust relationships. Mapping them reveals access paths that an inventory of human accounts cannot show.
03
October 1, 2026
False 5G base stations: when network infrastructure becomes a trust boundary
NIST’s new CSWP 36G draft tests six false-base-station scenarios and highlights a dependency enterprises rarely map: access infrastructure they do not own.
04
October 1, 2026
DGFiP: why changing a password may not be enough to stop an attack
ANSSI’s DGFiP incident report shows how compromised identities, reachable systems and incomplete monitoring can form one attack chain.
05
September 29, 2026
Does your building belong in your information-system map?
Building management, cooling, physical access control and maintenance can directly condition IT availability. Useful system boundaries can extend beyond traditional IT.
06
September 22, 2026
Active Directory: the component your map should treat as critical infrastructure
After an Active Directory compromise, restoring applications is not enough: trust must be rebuilt. Mapping identity and administration dependencies helps determine the real recovery order.
07
August 24, 2026
Information system mapping: turning ANSSI’s 5 steps into an operational plan
ANSSI proposes a pragmatic, incremental and sustainable approach to information system mapping. Here is how to turn it into a concrete working plan.
PUBLICATION CRITERION
A page is published only when it contributes information, a method, a synthesis or a verifiable angle that justifies its existence beyond a search-ranking objective.