Descobreix Pandipedia
Un directori creixent de respostes útils seleccionades per la comunitat de Pandi. Cerca a la col·lecció o explora els darrers descobriments.
2322 entrades disponibles
Are your passwords future-proof?
Veiem alternatives:
- Modifica la consulta.
- Inicia un nou fil.
- Elimina les fonts (si s'han afegit manualment).
Internet fraud law milestones, from CFAA to DSA
Veiem alternatives:
- Modifica la consulta.
- Inicia un nou fil.
- Elimina les fonts (si s'han afegit manualment).
WHO guidelines on sedentary behavior. Access global health recommendations about screen related inactivity. Applicable in policy and education.
WHO sedentary behaviour and screen-time sources
I found a small set of official WHO sources that are relevant to sedentary behaviour, screen-related inactivity, and school policy use. The search did not retrieve the direct 2020 WHO guideline page, so the list below emphasizes the closest official WHO guidance and implementation resources that were found[1][2].
Core global guidance
Closest WHO global-level sources found in the search, including WHO publication entry points and general guidance that can anchor policy work on sedentary behaviour and screen-related inactivity.
Child and adolescent screen-time or sedentary-behaviour guidance
WHO sources focused on children, adolescents, and early-life digital exposure. These are the most directly relevant to screen-time, childhood obesity, and adolescent health framing, though the searches did not surface the exact sedentary-behaviour threshold page.
Adult and older-adult recommendations
WHO sources relevant to adults and older adults, especially where sedentary behaviour sits alongside broader physical activity and noncommunicable disease prevention guidance.
School, education, and policy implementation resources
WHO resources that are useful for policy makers, education ministries, and school leaders translating guidance into practice, especially in whole-school and health-promoting-school settings.
Veiem alternatives:
- Modifica la consulta.
- Inicia un nou fil.
- Elimina les fonts (si s'han afegit manualment).
Which UK procurement signals point to better competition?. Build a structured briefing for capture teams and analysts on what the first year of UK Procurement Act data says about open methods, direct awards, single-bid lots, pre-market engagement, SME participation, and remaining data gaps. Include practical watchpoints for opportunity qualification, incumbent analysis, and buyer monitoring.
UK Procurement Act: what the first year says about competition
The first year of UK Procurement Act data points to improving competition signals, led by a clear shift away from direct procedures and toward open procedures, alongside rising pre-market engagement and stronger SME participation[1][2][3][4].
At the same time, the data is still incomplete in important ways, so the best read is directional rather than definitive: procedure method is missing for a share of notices, supplier identifiers are absent for many below-threshold contracts, and the report calls for better validation and standardized UK-specific fields[5][6][7].
Signals that competition is strengthening
- Open procedures are rising. Open tenders increased from 27% in March 2025 to 41% in February 2026, and in the last two months of the year they became the majority method by count, even though direct procedures were still about 41% across the full year[8][9][10].
- Direct awards and other direct procedures are falling. Direct procedures declined from 53% in March 2025 to 34% in February 2026, which is the clearest shift toward a more competitive posture[11].
- Single-bid lots are easing down. Among above-threshold open and competitive flexible procedures, the single-bid share fell from about 21% at regime start to about 16% by year-end[12].
- Pre-market engagement is becoming a stronger early signal. PME notices now exceed 600 per month and topped 700 in February; about 29% were associated with a tender, so PME should be treated as a useful early indicator, not proof of an open contest[13][14].
- SME participation is improving. SMEs and VCSEs accounted for 54% of bids in March and 67% in February 2026, while lots marked suitable for them rose from 57% to 72%[15][16].
- Single-bid tenders appear costlier. The report says single-bid tenders are about 7% more expensive than those with more than one bid, which makes bid concentration a practical risk flag[17][18].
Practical watchpoints for qualification, incumbents, and buyer monitoring
- For opportunity qualification: prioritize procedure type, PME presence, SME suitability, bid-count risk, value, and duration; these are the strongest screening fields available from the first-year data.
- For incumbent analysis: use award-to-supplier links to identify who is actually winning, but flag gaps where supplier identifiers are missing or where multiple-supplier contracts make attribution less clean.
- For buyer monitoring: watch for buyers shifting toward open procedures, repeated direct awards, more PME activity, persistent single-bid patterns, and more frequent SME-suitable designations.
- For data quality: treat missing method values and absent supplier identifiers as a material coverage issue, not a minor nuisance; the report explicitly recommends a data dictionary, stronger validation, and standardized UK-specific fields[19][20][21].
- Analytical rule of thumb: anchor analysis on procedure, aggregate to contract or lot level before calculating metrics, and choose dates based on the question being asked.
Bottom line
The strongest UK procurement signals of competition are the rise in open procedures, the decline in direct procedures, the fall in single-bid lots, the growth in PME, and the increase in SME participation[22][23][24][25][26]. The main caveat is that data gaps still limit precise buyer-by-buyer and supplier-by-supplier conclusions[27][28][29].
Veiem alternatives:
- Modifica la consulta.
- Inicia un nou fil.
- Elimina les fonts (si s'han afegit manualment).
Imagination, beauty, and poetry in physics
I am enough of the artist to draw freely upon my imagination. Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world.Albert Einstein, 1929 intervie…[1]
Veiem alternatives:
- Modifica la consulta.
- Inicia un nou fil.
- Elimina les fonts (si s'han afegit manualment).
Comparing GRI, IFRS S1 and S2, and ESRS for reporting teams. Build a multi-section comparison across GRI impact reporting, ISSB investor-focused financial disclosures, and ESRS double materiality requirements. Include a table covering audience, core disclosure areas, effective timing, materiality approach, metrics, assurance or trust signals, and practical implications for avoiding duplicated reporting.
GRI, IFRS S1 and S2, and ESRS: how reporting teams should use them together
The attached sources treat the three frameworks as complementary rather than interchangeable: GRI is positioned as impact reporting for a multi-stakeholder audience, IFRS S1 and S2 as investor-focused sustainability-related financial disclosures, and ESRS as double-materiality reporting for a multi-stakeholder audience that includes investors[1][2].
For reporting teams, the main practical issue is not choosing one framework and ignoring the others, but assigning each its job, then reusing common data and narratives where interoperability allows so the same topic is not reported three different ways[3][4].
Framework comparison for reporting teams
This table pulls together the source-based distinctions that matter most for workflow, materiality, and duplication control.
| Framework | Audience | Core disclosure areas | Effective timing / boundary | Materiality approach | Metrics / trust signals | Practical implication for avoiding duplication |
|---|---|---|---|---|---|---|
| GRI | Multi-stakeholder audience[5] | Impact reporting and accountability through transparent, standards-based disclosure[6] | The provided sources do not give a detailed GRI timing or reporting-boundary rule[7] | Impact-first; the sources frame GRI as focused on impacts rather than investor decision-usefulness[8][9] | Credibility comes from accountability and transparency; standards can be reinforced through regulation, monitoring, governance and controls, assurance, and training[10] | Use GRI as the impact narrative layer, then map overlapping topics to ISSB or ESRS outputs instead of rewriting the same facts in different language[11] |
| IFRS S1 and S2 | Investors and users of general purpose financial reports[12][13] | IFRS S1 covers sustainability-related risks and opportunities; IFRS S2 covers climate-related risks and opportunities, both through governance, strategy, risk management, and metrics and targets[14][15] | Effective for annual reporting periods beginning on or after 1 January 2024, with disclosure provided simultaneously with the financial statements as part of general purpose financial reports[16][17] | Financial materiality, with disclosures intended to meet investor needs[18][19][20] | GHG emissions, Scope 1, Scope 2, Scope 3, cross-industry metric categories, industry-based metrics, targets, an explicit and unreserved compliance statement, and external high-quality assurance are highlighted as trust signals[21][22][23] | Use IFRS S1 and S2 as the investor-focused baseline and keep extra sustainability information from obscuring required material information[24] |
| ESRS | Multi-stakeholder audience, including investors[25] | Double materiality reporting, with the sources describing ESRS at a high level rather than giving a full topic-by-topic boundary rule[26][27] | The sources say ESRS and ISSB should be aligned where possible, but do not give a full ESRS timing or reporting-boundary rule in the material provided[28][29] | Double materiality, meaning both impact and financial perspectives[30] | Interoperability guidance is meant to improve alignment and avoid duplication in reporting[31] | Use ESRS to satisfy the EU double-materiality lens, then reuse ISSB-compatible data where common disclosures align[32] |
What GRI adds: impact reporting and accountability
The GRI source is explicit that its role is impact reporting for a multi-stakeholder audience, not investor-only financial disclosure[33]. The trust model in that source is also different: credibility is tied to accountability and transparency, with reinforcement through regulation, monitoring, governance and controls, assurance, and training[34].
That makes GRI useful when a reporting team needs to explain how the business affects people, planet, and society in a way that is understandable to a broad audience. The attached sources do not provide a detailed GRI boundary, timing, or metric-by-metric rule set, so those specifics should not be assumed from this source set alone[35][36].
What IFRS S1 and S2 add: investor-focused financial disclosures
The IFRS materials consistently frame S1 and S2 as standards for investors and users of general purpose financial reports[37][38][39]. S1 extends beyond climate to sustainability-related risks and opportunities expected to affect a company’s prospects, while S2 focuses on climate-related risks and opportunities across governance, strategy, risk management, and metrics and targets[40][41][42].
Operationally, the key workflow point is timing and boundary: sustainability-related financial information is to be provided simultaneously with the financial statements as part of general purpose financial reports, using the same reporting period and reporting entity[43][44][45]. The sources also note that companies may provide additional sustainability information, but only if it does not obscure required material information[46].
For reporters, the practical message is to treat ISSB disclosures as the investor-grade backbone: core metrics such as greenhouse gas emissions, Scope 1, Scope 2, Scope 3, cross-industry metric categories, industry-based metrics, and targets should be organized in a way that is audit-ready and easy to connect to the financial statements[47].
What ESRS adds: double materiality and interoperability
The ESRS source framing available here is higher level, but clear enough on purpose: ESRS is described as double-materiality reporting for a multi-stakeholder audience, including investors[48][49]. In the sources, that is the main differentiator from IFRS S1 and S2, which are investor-focused and based on financial materiality[50].
Because the attached sources do not provide a full ESRS boundary explanation, the safest conclusion is limited: reporting teams should expect ESRS to require both impact and financial perspectives, then use interoperability guidance to align common disclosures with ISSB where possible and avoid duplicate preparation effort[51][52].
How to avoid duplicated reporting in practice
- Build one underlying data model for the overlapping topics, especially governance, strategy, risk management, and metrics and targets, then map outputs to each framework's audience and materiality lens[53][54].
- Use IFRS S1 and S2 as the investor-focused disclosure spine, because the standards require alignment with the financial statements and clear reporting-period consistency[55][56].
- Use GRI for the broader impact narrative and accountability layer, rather than trying to force it into the same wording as investor disclosures[57][58].
- Use ESRS to cover the EU double-materiality requirement, then lean on interoperability materials to reuse common datapoints and reduce rework[59].
- Keep any extra narrative or voluntary content from obscuring the material information required by ISSB[60].
Bottom line
From the attached sources, the cleanest way to think about the three frameworks is: GRI = impact accountability, IFRS S1 and S2 = investor-focused financial disclosure, and ESRS = double materiality[61][62]. The most practical reporting strategy is to prepare one common source of truth, then publish framework-specific views that preserve each standard’s materiality logic and avoid duplicate reporting work[63][64].
Veiem alternatives:
- Modifica la consulta.
- Inicia un nou fil.
- Elimina les fonts (si s'han afegit manualment).
Past ClinicalTrials.gov quality signals, not current performance
Veiem alternatives:
- Modifica la consulta.
- Inicia un nou fil.
- Elimina les fonts (si s'han afegit manualment).
EU AI Act risk categories and obligations. Produce a multi-section, jurisdiction-aware report that maps unacceptable risk, high risk, transparency risk, and minimal or no risk to the obligations described in the EU materials. Include a timing section that distinguishes entry into force from later application dates, with clear caveats that teams should confirm current legal status before implementation.
EU AI Act mapping: evidence status
I found the attached EU AI Act page at the European Commission digital strategy site, but the available search pass returned no extractable evidence from that source, so I cannot responsibly provide a substantive jurisdiction-aware mapping from the material on hand.
As a result, the risk-category obligations below are unverified placeholders rather than confirmed statements from the attached material, and the timing notes are likewise unverified until checked against the current official EU legal text.
Unverified risk-category map
- Unacceptable risk: unverified in the available evidence; do not implement any presumed obligation without checking the latest official EU text.
- High risk: unverified in the available evidence; any compliance duties should be confirmed directly against the current legal act and related EU guidance.
- Transparency risk: unverified in the available evidence; confirm whether disclosure or notice duties currently apply.
- Minimal or no risk: unverified in the available evidence; confirm whether only baseline or voluntary obligations apply.
Because the source extraction failed, I cannot state the specific obligations for each category without risking fabrication.
Timing and legal-status caution
I cannot verify the act's entry-into-force date, later application dates, or any phased compliance timetable from the available evidence, so these dates should be treated as unverified.
Before implementation, teams should check the latest official EU legal text and current status to confirm whether the act is in force, whether delegated or implementing acts have changed the picture, and which obligations are already applicable in their jurisdictional context.
Veiem alternatives:
- Modifica la consulta.
- Inicia un nou fil.
- Elimina les fonts (si s'han afegit manualment).
What should defenders do about Iranian-affiliated PLC targeting?. Build a multi-section brief covering the threat, affected internet-exposed PLC scope, observed access paths, ports 44818, 2222, 102, 502, and 22, ATT&CK techniques, and defender actions. Include a mitigation priority table that separates immediate exposure reduction, log review, project file validation, Rockwell AOI checks, and vendor hardening guidance.
Iranian-Affiliated Targeting of Internet-Exposed PLCs
CISA warns that Iranian-affiliated cyber actors have been exploiting internet-connected PLCs across U.S. critical infrastructure, with activity observed in Government Services and Facilities, Water and Wastewater Systems, and Energy. The advisory focuses on affected PLC scope, the access paths and ports used, the ATT&CK techniques mapped in the text, and the defender actions CISA says should be prioritized.[1][2][3]
The operational concern is not just exposure, but weak perimeter and lifecycle controls: the actors used foreign-based IP addresses, leased third-party hosted infrastructure, and manufacturers' PLC programming software to reach misconfigured, internet-facing devices. CISA also says organizations should review historical activity before taking blocking actions so they do not lose evidence of past compromise.[4][5]
Affected PLC Scope and Observed Access Paths
The advisory says the targeted environment included Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens PLCs, and potentially other PLCs, across multiple U.S. critical infrastructure sectors.[6]
- Affected scope: devices in Government Services and Facilities, Water and Wastewater Systems, and Energy were explicitly called out.[7]
- Access paths: the actors used foreign-based IP addresses, leased third-party hosted infrastructure, and manufacturers' PLC programming software to connect to misconfigured PLCs.[8]
- Ports: malicious inbound traffic targeted PLC devices on ports 44818, 2222, 102, and 502, and modems on port 22.[9]
- Indicators: CISA and the FBI provide listed IP addresses for historical log review before blocking or other response actions.[10][11]
Taken together, the access pattern suggests opportunistic exploitation of exposed OT services and vendor tooling rather than a single protocol-only campaign. The advisory's port list points defenders to industrial Ethernet, vendor-specific PLC services, and modem SSH exposure as the main places to look first.[12][13]
Mapped ATT&CK Techniques in the Advisory
CISA explicitly maps several techniques in the advisory text, including T0883 for initial access, T0885 for command and control, T1219 for remote access through Dropbear SSH on modems, T1041 for exfiltration of device project files, and T1565 for modification and deletion of project file logic and display data.[14]
- T0883 and T0885 frame the core intrusion path and post-access control observed in the advisory.[15]
- T1219 is tied to remote access through Dropbear SSH on modems, which aligns with the advisory's mention of port 22 exposure on modems.[16][17]
- T1041 and T1565 reflect post-exploitation actions against PLC project files and display data, including extraction, modification, and deletion of logic.[18][19]
Defender Actions and Mitigation Priority
CISA and the authoring agencies recommend immediate exposure reduction, historical log review, validation of PLC project files, focused Rockwell checks for reusable code modules and Add-On Instructions, and vendor support engagement for mitigation and investigation help.[20][21]
| Priority | Action | Why it matters |
|---|---|---|
| 1 | Immediate exposure reduction: restrict direct internet access and apply advisory mitigations.[22] | Reduces the chance that misconfigured PLCs remain reachable from hostile infrastructure.[23][24] |
| 2 | Log review: query logs for the listed IP addresses before blocking them.[25] | Preserves evidence of historical targeting and may reveal compromise before containment actions erase visibility.[26][27] |
| 3 | Project file validation: inspect PLC project files for malicious interactions, logic changes, and HMI/SCADA display manipulation.[28] | CISA says the actors modified and deleted logic and manipulated display data after project file extraction.[29] |
| 4 | Rockwell AOI checks: examine reusable code modules and Add-On Instructions in Rockwell Automation PLC programs.[30] | The advisory specifically expands guidance to detect malicious changes in reusable code modules.[31] |
| 5 | Vendor hardening guidance: follow prior vendor guidance for Rockwell Automation, Schneider Electric, and Siemens, and apply secure-by-design and secure-by-default principles.[32] | Hardening reduces repeat exposure across common PLC platforms and makes opportunistic attacks harder at scale.[33] |
If a site discovers an affected internet-accessible device, CISA says to take additional technical measures to evaluate compromise risk and activate incident response plans. The agency also advises contacting the authoring agencies and the relevant vendors through existing support channels for assistance.[34][35]
Bottom Line
The threat is broad but concrete: Iranian-affiliated actors were reaching internet-exposed PLCs across multiple critical infrastructure sectors, using exposed OT ports, vendor software, and third-party infrastructure. Defenders should prioritize exposure reduction, retrospective log hunting, and validation of PLC project files and Rockwell-specific logic modules, while following vendor hardening guidance to reduce repeat compromise.[36][37][38][39][40][41]
Veiem alternatives:
- Modifica la consulta.
- Inicia un nou fil.
- Elimina les fonts (si s'han afegit manualment).