{ "schema": "grc-applied-learning-v1", "review_date": "2026-10-29", "summary": { "original_gap_areas": 19, "introductory_gaps_addressed": 8, "partial": 9, "open": 2, "remaining_partial_or_open": 11, "publisher_scope_records_reviewed": 53, "free_reading_or_orientation_records": 51, "licensed_full_material_boundaries": 2, "source_records_added": 52, "source_records_updated": 1, "new_distinct_publisher_urls": 31, "basis": "Counts describe available material for the original bounded introductory needs, not independent marking, mastery, exam coverage percentages or complete certification preparation." }, "status_definitions": { "covered_intro": "The specifically described introductory teaching and guided paper practice are supplied. Live implementation, independent marking and complete exam preparation are not implied.", "partial": "Useful free teaching and application practice are supplied, but a named part of the original need still lacks authorized complete content or verified assessment.", "open": "Free orientation/preparation is supplied; the official course or full authorized assessment requirement remains unresolved." }, "guides": [ { "id": "CC04", "title": "Network zones, ports and application-aware controls", "source_ids": [ "CCG_ASD_SEGMENT", "CCG_NIST_FIREWALL_SCOPE" ], "reading_order": [ { "source_id": "CCG_ASD_SEGMENT", "read": "Selected definitions, five implementation themes and filtering bullets.", "learn": "A zone is a group with a purpose; separation needs enforced, necessary communication paths. Management access is its own flow." }, { "source_id": "CCG_NIST_FIREWALL_SCOPE", "read": "Selected layer-role figure, packet attributes, stateful section/table, application/proxy and inspection-limit passages only; then the case below.", "learn": "A destination port is one condition. An application-aware policy can inspect supported protocol behaviour where it has visibility; destination authorization remains a separate question." } ], "new_free_coverage": [ "Complete paper diagram and permitted-flow table with defined initiating endpoints, direction, ports, application checks and a separate management route.", "Step-by-step browser request, reply and application-authorization walkthrough, plus explained allowed/blocked examples.", "Explicit encrypted-traffic inspection boundary and a case in which a permitted TCP connection carries an unauthorized business request." ], "remaining": [ "A live packet lab, actual firewall configuration and independent operational validation remain outside this introductory paper case.", "Supporting DNS, time, update and logging flows, full availability design, subnetting and real product capabilities need a fuller design; the case expressly does not hide them behind an allow-all rule.", "This is formative source-grounded learning, not an independently marked current CC assessment or pass prediction." ], "payment_note": "FREE for the selected readings and complete editorial paper exercise. No paid course or simulator is needed for this bounded gap. Extra current CC teaching, live labs or independent marking are optional purchases; exam/credential charges are separate.", "status_reason": "The exact introductory gap is addressed by a complete fictional flow artifact, explicit teaching and explained model checks. Closure is limited to this paper learning objective; it does not claim deployed network assurance or exam readiness.", "worked_example": { "title": "Follow one booking request through five zones", "scenario": "Original editorial application. Every host and address is fictional. Example Studio uses: a public edge proxy in the DMZ (198.51.100.20); a booking API in the application zone (10.20.0.10); a database in the data zone (10.30.0.10); staff devices in a staff zone; and a named admin workstation plus jump host (10.40.0.20) in a management zone. A guest is allowed to use the public booking service but has no direct internal-system access. Customers may read their own booking; only an approved staff export role may export all bookings. The edge proxy terminates its approved HTTPS session and creates a separate encrypted API session. The API enforces the booking permissions. The database accepts only the API service identity for specified booking operations. The exercise starts after name resolution, with addresses already known. Only the paths below are approved; supporting-service flows would need their own documented rules in a real design.", "tasks": [ "Draw the zones and new-session directions. Give each allowed flow a source, destination, transport/port, application purpose and permission condition. Add one management path and at least three denied paths.", "Walk through a customer's read-own-booking request from the initial TCP connection to the response. Explain the difference between stateful return traffic and permission to initiate a new reverse connection.", "For a read-another-customer request over the same open port, decide which control must reject it. State what a successful port check does and does not demonstrate.", "Produce a paper test table with positive and negative cases and the records that would justify the result. Do not send traffic to a real host." ], "model_answer": [ "Diagram (arrows mean approved new-session initiators; controls enforce policy at each zone boundary):\n```text\nBusiness: visitor / staff -> DMZ edge -> application API -> database\nManagement: named admin -> management jump host -> named interfaces\n```\nThe diagram deliberately shows only the exercise's approved business/management paths. A line on a drawing has no enforcement effect by itself.", "Flow record:\n| ID | Initiator → destination | Port/protocol | Additional rule and reason |\n|---|---|---|---|\n| F1 | Visitor/guest or staff → edge only | TCP 443, HTTPS | Expose the booking interface. The proxy checks the supported HTTP request policy after approved TLS termination; the service checks user permissions. |\n| F2 | Edge host → API host only | TCP 8443, HTTPS API | Authenticate the edge service; accept only the defined booking API actions and valid inputs. A port filter alone does not express those actions. |\n| F3 | API host → database host only | TCP 5432, encrypted database protocol | Authenticate the API service account and restrict database operations. This is a declared design choice, not a guarantee attached to port 5432. |\n| F4 | Named admin workstation → jump host | TCP 22, SSH | Under this fictional design the jump host requires MFA and approved administrator access. Being in the management subnet is insufficient. |\n| F5 | Jump host → named API/database management interfaces | TCP 22, SSH | Authorize the admin role, destination and maintenance purpose; log the session. No broad access to all hosts. |\n| D1 | Guest/staff → database directly | Any new session | Deny: the business workflow uses the API, not direct database access. |\n| D2 | Internet or DMZ edge → internal SSH management | TCP 22 | Deny: public-service access does not grant administration. |\n| D3 | API → arbitrary internet host, or database → staff | Any new session | Deny unless a separately approved dependency is specified. |\nOther new sessions are denied by the stated policy; this does not imply that a real service can operate without separately specified support flows.", "Layer check for this TCP example: IP addresses identify network endpoints at OSI layer 3; TCP source/destination ports and connection state are transport-layer facts at layer 4; HTTP actions and inputs are application-layer content at layer 7 where visible. A client uses a temporary source port and the approved server destination port; replies reverse those endpoint/port pairs within that session. An application-aware firewall's supported protocol/content check does not replace the API's booking-owner/role authorization. Walkthrough: (1) the browser sends a new connection to edge TCP 443; the network rule decides whether that connection is permitted. (2) TLS establishes the protected browser-to-edge session under the stated design. (3) at the point that can actually see HTTP, the request is checked for the supported application action and input form. (4) the edge opens its separate F2 session; the API authenticates the service/user context and authorizes access to the requested booking. (5) the API makes an F3 database request using its restricted service identity; the database enforces that identity's rights. (6) the response returns through the established sessions. A stateful reply is associated with an approved session; it is not permission for the database to start arbitrary new connections back to staff.", "Reachability counterexample: customer A can complete a TCP 443 connection and read booking A. A request to read booking B still traverses the permitted port and can be valid HTTP, but the API must deny it because the account lacks permission for B. Expected denial is an application result and no B content, not a firewall timeout. The successful connection proves that this route/port was reachable at that moment; it does not establish the caller's business authority, safe content, endpoint integrity or the confidentiality of every permitted path. This conclusion is editorial application of the sources' separate filtering/authentication/inspection concepts.", "Paper verification record:\n| Case | Expected result | Evidence that would be needed in an authorized implementation |\n|---|---|---|\n| Customer A reads A through F1–F3 | Allow correct A result | Correlated proxy/API request IDs and permission decision, relevant database action and expected response |\n| Customer A requests B through TCP 443 | Reject at application authorization; no B data | API denied-object decision and response content check; an open-port result alone is insufficient |\n| Guest attempts direct database TCP 5432 | Deny at boundary | Matched deny rule/log and absence of a database session, within the test's observation limits |\n| Staff workstation attempts API SSH | Deny | Boundary deny record; staff network membership grants no management role |\n| Approved admin uses jump host to named API management interface | Allow the approved session | Identity/MFA result, destination/role approval and host session log |\n| Application filter is asked to inspect opaque end-to-end encrypted data it cannot decrypt | Record visibility limit | Evidence of where TLS terminates and which control sees plaintext; no invented content-inspection claim |\nA real retest would also check alternate paths and current policy application at all relevant enforcement points; this exercise performs no such test." ], "self_check": [ "Every allow row identifies a necessary initiator, named destination, service and purpose; no whole-zone trust or any-to-any shortcut replaces the rule.", "You can explain why TCP 443 being reachable does not authorize another person's booking, and can name the application decision that rejects it.", "Your management route has identity/role checks and its own restrictions; neither the guest network nor the public proxy is an administrator.", "You state where encrypted application content can be inspected and distinguish a proposed paper outcome from observed operational evidence." ], "source_ids": [ "CCG_ASD_SEGMENT", "CCG_NIST_FIREWALL_SCOPE" ], "limit": "Original source-grounded editorial teaching and model answers; not a publisher-issued exam key, independent learner assessment, complete architecture, permission to probe a real target or claim that any control has been deployed/tested." }, "status": "covered_intro", "status_label": "INTRODUCTORY MATERIAL SUPPLIED", "href": "workshop-cc04.html", "summary": "Complete paper diagram and permitted-flow table with defined initiating endpoints, direction, ports, application checks and a separate management route.", "related_section_numbers": [ 11, 12 ], "original_teaching_need": "A beginner packet-flow walkthrough across zones, including port rules versus application-aware rules and why reachability alone is insufficient.", "original_practice_need": "A reviewed diagram and traffic-flow explanation showing allowed/blocked paths, relevant port/application checks, a management path and an example where reachability alone is insufficient.", "primary_route": "cc", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "CCG_ASD_SEGMENT", "CCG_NIST_FIREWALL_SCOPE" ], "component_checks": [ { "component": "Zones and enforced communication", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Scenario identifies DMZ/application/data/staff/management purposes; model diagram names new-session direction and states that drawing a boundary does not enforce it." }, { "component": "Allowed/blocked flow artifact", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "F1-F5 state initiator, destination, TCP service, purpose and additional identity/application condition; D1-D3 and default-denial prose exclude direct database and public management paths." }, { "component": "Packet/connection and application distinction", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Walkthrough separates network admission, TLS visibility, application action/input checks, API authorization, database service rights and replies. The corrected model explicitly teaches L3 IP endpoints, L4 TCP ports and state, L7 visible HTTP, temporary client source ports and return-session endpoint reversal." }, { "component": "Stateful replies versus reverse initiation", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Model distinguishes a reply in the approved session from arbitrary database-to-staff initiation. Assigned NIST reading now includes the exact stateful-inspection section and table, with the historical-content exclusions retained." }, { "component": "Management path", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Named admin to jump host to named interfaces, MFA/role/purpose restrictions and session logging; subnet membership is not sufficient authority." }, { "component": "Reachability counterexample and safe verification", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Customer A can reach TCP 443 but must be denied booking B at API authorization; expected application denial is distinguished from timeout. Positive, negative, management and opaque-encryption cases have expected evidence and observation limits." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [ "3.2", "4.1", "4.2" ], "cc_ai_application_ids": [ "AI-D4" ], "pecb_statement_ids": [], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-CC04" } }, { "id": "CC05", "title": "Physical/social security tests and interpreting findings", "source_ids": [ "CCG_NIST_TEST_ROE", "CCG_CTEP_EVALUATION" ], "reading_order": [ { "source_id": "CCG_NIST_TEST_ROE", "read": "Selected Appendix B items, protected assessment-data paragraphs and post-testing follow-up, then the case.", "learn": "Authority and a specific boundary precede testing. An observation, a justified finding, a risk implication and a verified follow-up are different records." }, { "source_id": "CCG_CTEP_EVALUATION", "read": "Pages 3–5 decision recording and comparison with stated plans.", "learn": "Write what was observed and how it compares with the requirement; do not replace evidence with a blame label or an assumed cause." } ], "new_free_coverage": [ "Worked paper-only physical/social exercise joining named authority, property/person/process scope, prohibited acts, stop/resume conditions and evidence handling.", "Two observed outcomes, a justified process finding with a bounded business implication, and a follow-up/retest record.", "Explained distinction between a door-control failure in the simulation and an unsupported claim that real confidential data were stolen." ], "remaining": [ "No covert or live physical/social test is assigned. Real tests need context-specific competent design, property/person/system authority and applicable legal/privacy review.", "One simulated observation does not estimate a population-wide failure rate or independently demonstrate staff competence or operational security.", "The model is editorial feedback, not an issuer-marked exam exercise." ], "payment_note": "FREE primary planning/evaluation readings and a complete paper case with explained model. No paid tester or course is needed for this introductory learning task; any future professional testing is a separate decision requiring its own scope and authority.", "status_reason": "The specified authorized-boundary, evidence, interpretation and follow-up paper case is supplied end to end. No real testing or independent assurance is claimed.", "worked_example": { "title": "A visitor-control and telephone-verification exercise on paper", "scenario": "Original editorial application; all people are role codes and all records are synthetic. Fictional plan ROE-ACCESS-1 has written approval from the studio's property controller and process owner for a discussion/simulation using designated staff roleplayers, a marked training entrance and a synthetic export request, 09:00–09:15 UTC on the fictional exercise day. It excludes the real office, archive, customer systems, nonparticipants and all real personal data. It permits only the supplied two scripted roleplay events and observation notes. It prohibits force, lock work, following anyone into a real restricted area, asking for credentials, collecting real exports, recording audio/video or continuing when someone is distressed. Anyone may call STOP; the evaluator pauses, contacts the designated safety/process lead, and only that lead may approve resumption within scope. A real alarm ends the exercise. Access policy VISITOR-1 requires checking a visitor's authorization and issuing the training visitor badge before opening the marked staff-only training door. Request policy REQUEST-1 requires an independently verified callback using the approved directory before releasing even the synthetic export. Event E1: at 09:04, staff role S1 opens the marked door for unverified visitor role V1; the tester remains at the marked stop line and does not enter. Event E2: at 09:08, staff role S2 receives the simulated request, refuses immediate release, uses the approved callback route and reports it. Event E3: at 09:10, a participant says they feel distressed; the facilitator calls STOP. The authorized observer's notes are the only evidence supplied.", "tasks": [ "List what the written authority permits, what remains prohibited, who can stop the exercise and who can authorize resumption. Decide whether an invitation to see the real archive changes the scope.", "Create a small evidence log for E1–E3 using role codes and UTC times. Specify access, storage, sharing and retention-review rules for these sensitive findings.", "Write one finding against VISITOR-1, one positive observation against REQUEST-1 and a bounded business implication. Distinguish observation from a hypothesis about the cause.", "Propose an owned corrective follow-up and a safely scoped retest with explicit success criteria. Explain what even a successful retest would not prove." ], "model_answer": [ "Boundary/decision record:\n| Question | Decision and reason |\n|---|---|\n| Are a real archive visit, real staff impersonation or a live data request allowed? | No. The signed fictional ROE covers designated roleplayers and synthetic events at the marked training location. A participant's invitation does not amend the property/process owner's written scope. |\n| May the tester cross the marked line to show impact? | No. The observation already records that the door was opened without VISITOR-1 verification; crossing is prohibited and unnecessary to substantiate that narrower finding. |\n| What happens at E3? | Stop immediately, safeguard participants and notify the named lead. Record the pause and decision; resume only with the specified lead's approval and within the original boundary. A real alarm ends the exercise. |\n| Does this document authorize the learner to repeat it at an actual workplace? | No. This is a fictional paper analysis and grants no real-world testing authority. |", "Evidence log:\n| Record | Observed fact | Handling and limits |\n|---|---|---|\n| E1 / 09:04 UTC / observer O1 | S1 opened the marked training door before visitor verification/badging; V1 stayed at the stop line | Store the original observer note in the approved restricted exercise folder with author/time/source; no claim that the archive was entered or data accessed |\n| E2 / 09:08 UTC / O1 | S2 withheld the synthetic export, used the directory callback and reported the request | Record the action and applicable REQUEST-1 rule. Do not copy private contact details or a real export into the report |\n| E3 / 09:10 UTC / O1 | A participant reported distress and the facilitator stopped | Keep only the minimum necessary safety/stop record; sensitive personal detail is unnecessary for the learning finding |\nThe fictional ROE limits raw-note access to the exercise owner/evaluator; a redacted process summary may go to managers. Use protected approved storage/transmission and an access log. The owner sets a justified retention/review date and applicable preservation requirements before deletion. No universal retention period is invented.", "Finding F1: Requirement VISITOR-1 says verification and training badging must precede opening the marked staff-only training door. E1 shows that S1 opened it first. Therefore the visitor-verification sequence failed in this one simulation. Business meaning: an equivalent real process failure could admit an unauthorized person to an area with information assets; the actual impact would depend on other barriers and what is present. The supplied evidence does not show entry beyond the stop line, record access, theft, a general staff failure rate or intent. Positive observation P1: E2 follows REQUEST-1's independent verification and reporting route. It is evidence of that roleplayer's action in this event, not proof every future request will be handled correctly.", "Cause and follow-up record:\n| Item | Owner/action | Evidence needed for closure |\n|---|---|---|\n| Immediate correction | Exercise/process lead reminds roleplayers that VISITOR-1 verification and badging come first and confirms the marked door is returned to its normal training state | Updated exercise note; this addresses the immediate event, not its cause |\n| Cause investigation | Process owner checks whether the visitor instructions, layout, staffing or approval route made compliance unclear | Compare the actual instruction/version and roleplayer explanation; do not assert 'carelessness' from E1 alone |\n| Improvement | If the check confirms an unclear verification step, the owner revises the check-in instruction and provides role-specific practice; record the chosen action and review date | Approved revised instruction and evidence that the action addresses the confirmed cause |\n| Retest | Separately approve a new synthetic roleplay within the same safe boundary after the change | A newly authorized case shows verification and badging before door opening, an unverified request is held/reported, and any STOP is respected. Preserve expected-versus-observed notes |\nA retest pass supports those sampled outcomes under its conditions. It neither proves complete security nor removes the need to examine other relevant controls." ], "self_check": [ "You can point to the scope document rather than an informal invitation as authority; the excluded archive and real records remain excluded.", "You stop at distress and name the required resumption authority; you do not propose an unauthorized action to gather more dramatic evidence.", "The finding includes the applicable VISITOR-1 requirement, E1 evidence and the precise failure, with impact and uncertainty stated separately.", "The evidence record minimizes personal detail, protects originals and states who may access/share/retain it.", "Follow-up has an owner, cause check and observable retest criteria, rather than merely recording course attendance or blaming a roleplayer." ], "source_ids": [ "CCG_NIST_TEST_ROE", "CCG_CTEP_EVALUATION" ], "limit": "Original editorial case and explained model, not a NIST/CISA exam key, independent assessment or permission to test a real property, person, account or system. All evidence and approvals are fictional premises." }, "status": "covered_intro", "status_label": "INTRODUCTORY MATERIAL SUPPLIED", "href": "workshop-cc05.html", "summary": "Worked paper-only physical/social exercise joining named authority, property/person/process scope, prohibited acts, stop/resume conditions and evidence handling.", "related_section_numbers": [ 6, 21 ], "original_teaching_need": "A worked authorized physical/social testing case joining permission, scope, prohibited actions, evidence, business meaning and follow-up.", "original_practice_need": "A checked paper case identifying the authorised test boundary, stop/escalation conditions, safe evidence handling, a justified finding and a retest action. No real target testing is needed.", "primary_route": "cc", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "CCG_NIST_TEST_ROE", "CCG_CTEP_EVALUATION" ], "component_checks": [ { "component": "Authority, location, participants, time and exclusions", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "ROE-ACCESS-1 authorizes a narrow fictional simulation, designated roles/training entrance/synthetic request/window; real office, archive, systems, nonparticipants and personal data are excluded. An invitation cannot silently extend that authorization." }, { "component": "Prohibitions and safety/escalation", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "No force, lock work, real entry, credentials, exports or audio/video. Anyone can STOP, designated lead controls safe resumption; a real alarm ends play." }, { "component": "Evidence and interpretation", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "E1-E3 record role/time/source and restrict claims to opening the marked door, refusing the request and stopping. Originals/provenance/access/minimized summary/retention review are specified." }, { "component": "Finding and business meaning", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "VISITOR-1 verification/badging precedes door opening; E1 contradicts that sequence. Conditional real-world impact is separated from unproved entry, theft, intent or failure rate. E2 is a bounded positive outcome." }, { "component": "Cause, improvement, owner and retest", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Immediate correction is distinguished from investigating instruction/layout/staffing causes; later revised procedure/practice and newly approved expected-versus-observed retest are tied to the confirmed cause." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [ "1.4", "1.5", "2.3", "5.5" ], "cc_ai_application_ids": [ "AI-D5" ], "pecb_statement_ids": [], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-CC05" } }, { "id": "CC06", "title": "Incident plan, data handling and exercise feedback", "source_ids": [ "CCG_NIST_IR_RECORDS", "CCG_CTEP_EVALUATION", "CCG_NCSC_EXERCISE_DESIGN" ], "reading_order": [ { "source_id": "CCG_NIST_IR_RECORDS", "read": "Selected timeline/evidence rows and improvement rows.", "learn": "Preserve what happened, when it happened, who collected the record and who may access it; improve response using evidence rather than assuming the incident is fully understood." }, { "source_id": "CCG_NCSC_EXERCISE_DESIGN", "read": "Steps 1, 3, 5 and 7–9, then the stated plan before the case injects.", "learn": "An exercise needs a plan, purpose and expected actions to compare with observations; feedback also covers exercise quality." }, { "source_id": "CCG_CTEP_EVALUATION", "read": "Pages 3–7 observation, analysis and after-action/improvement guidance.", "learn": "Join decisions and plan deviations to justified actions, owners, timing and later evidence of completion. A discussion has no automatic pass mark." } ], "new_free_coverage": [ "One integrated fictional plan with classification/handling rules, incident criteria, authority, containment and recovery conditions supplied before the injects.", "Reviewed UTC event timeline distinguishing event time from collection time, evidence-access record, decision/escalation log and after-action improvement table.", "Explained handling of an uncertain disclosure, a missing backup contact, a request to delete sensitive evidence and verification before recovery." ], "remaining": [ "The mini-plan teaches connections; it is not a complete organization-specific incident policy, legal notification determination, evidence-acquisition procedure or forensic laboratory.", "No live restoration, provider response, real permission change or operational retest has been performed.", "Publisher discussion guidance and an editorial model do not independently assess learner or organizational incident-response capability." ], "payment_note": "FREE selected primary readings and the complete integrated tabletop with explained records. A paid exercise facilitator or commercial CC course is not required for this bounded introductory case. Specialist operational training, independent feedback and exam fees are separate decisions.", "status_reason": "The exact requested timeline, data/evidence, decision/escalation and after-action artifacts are supplied and tied to an explicit fictional plan, with model reasoning and limits.", "worked_example": { "title": "A booking export becomes publicly accessible: plan, timeline and lessons", "scenario": "Original editorial application; no real incident, customer or provider is involved. Read fictional plan P1 before the injects. P1: report suspicious activity to the duty analyst; the incident lead declares an incident when credible evidence indicates unauthorized access or sharing of Restricted data; the lead may authorize the operator to suspend public sharing and revoke the affected integration token, recording availability/evidence trade-offs; the service owner and privacy lead receive an internal escalation; only the communications lead approves external statements. Recovery needs incident-lead and service-owner approval after containment is verified, relevant records are preserved and the booking workflow works with approved permissions. If the owner cannot be reached, use the backup contact in the plan; the exercise copy has that field blank. Fictional classification policy D1: booking exports and raw incident records are Restricted, accessible only to the named response/custodian/privacy roles through protected approved storage; a redacted manager summary is Internal; public notices require communications approval and contain no raw records. The custodian records provenance, access and retention/review decisions; routine deletion must not override an active evidence-preservation requirement. All following times are UTC. Inject I1 at 09:00: an alert reports a public export link. I2 at 09:03: the account user denies requesting it. I3 at 09:05: the provider supplies audit evidence that an integration token created the link at 08:57 for an export of 800 wholly fictional booking rows; the log does not record downloads. I4: the service owner is unavailable and the backup field is blank. I5 at 09:07: the lead authorizes token revocation and link suspension; the operator reports application at 09:09. I6 at 09:15: a separate approved check shows that the old link now denies access and the revoked token no longer accesses the service, while the permitted booking workflow still works. A colleague proposes deleting the logs because they are sensitive. The exercise then ends; no external notification rule is supplied.", "tasks": [ "Apply P1's incident criterion and D1's classifications. Separate evidence of public sharing from an unproved claim that 800 rows were downloaded.", "Build an event timeline with separate source/collection times and known-versus-unknown fields.", "Create a handling record for the alert, audit export and working manager summary; specify permitted access, integrity/provenance and the decision about deletion.", "Produce a decision/escalation log tied to P1, then an after-action record with a strength, observed gap, cause-check, action owner, deadline chosen for the exercise and retest evidence.", "State what may be concluded at 09:09 and 09:15, and what remains unresolved before or after recovery." ], "model_answer": [ "Classification and triage: at 09:00 the alert is a report requiring validation. The user's denial adds context but is not conclusive by itself. At 09:05 the audit record supplies credible unauthorized public-sharing evidence for Restricted data, meeting P1's stated criterion; the model recommends that the lead declare and prioritise the incident under P1, recording the 800-row export and business impact. The inject supplies the evidence, not an observed declaration or its time. Record 'public link created; download activity unknown'. The evidence does not justify '800 rows were exfiltrated', 'nobody downloaded it' or attribution to the account user. P1/D1 are local fictional rules, not universal NIST classifications or legal thresholds.", "Timeline:\n| Event time UTC | Learned/recorded time UTC | Supplied fact, proposed model decision and uncertainty |\n|---|---|---|\n| 08:57 | 09:05 | Audit record E2 says the integration token created the public link. Whether an external party downloaded data is unknown. |\n| 09:00 | 09:00 | Alert E1 reports the link; initially unvalidated. |\n| 09:03 | 09:03 | User denial E3 is recorded as a statement, not proof of who acted. |\n| 09:05 | 09:05 | I3 supplies audit evidence E2 of the 08:57 link creation. Applying P1 to this evidence is the model's proposed declaration decision, not an additional observed inject. |\n| Not supplied for I4 | Not supplied for I4 | I4 states that the service owner is unavailable and the backup field is blank. Record the actual contact-attempt and learning times when available; do not infer 09:05. |\n| 09:07 | 09:07 | I5 records the lead authorizing suspension and token revocation. |\n| 09:09 | 09:09 | Operator reports changes applied. This records action completion as reported, not independently verified effectiveness. |\n| 09:15 | 09:15 | Separately approved check E4 observes old-link denial, revoked-token denial and permitted workflow success. These are scoped results; past download activity remains unknown. |\nKeep the original source timezone/time quality in the record even when normalized to UTC; later evidence can change the reconstructed sequence.", "Data/evidence handling record:\n| Record | Classification and source | Custody/access/working use |\n|---|---|---|\n| E1 alert, E2 audit export and E3 user statement | Restricted under D1; record source, collector, collection time, original event time and method | Custodian preserves originals with their metadata in the protected evidence location, records receipt/transfers and grants only the named response/privacy roles access. Analyse a working copy and preserve an integrity/provenance record. |\n| E4 verification record | Restricted incident evidence; record tester role, approval, exact checks, expected and observed outcomes | Preserve the result and its limited scope with the change/decision reference; protect it like other incident records. |\n| M1 management summary | Internal, derived from E1–E4 | Explain impact/uncertainty and decisions, remove row-level booking content and unnecessary identifiers; the original Restricted evidence does not become Internal merely because a copy is made. |\n| Proposed log deletion | Requires custodian decision under D1 and preservation procedures | Reject immediate ad hoc deletion. Restrict access to reduce exposure, record the retention/review decision and keep relevant evidence while preservation applies. Privacy sensitivity is a reason for controlled handling, not automatic destruction. |\nThis is a handling design on paper, not a claim that files were collected, hashed or preserved in an actual incident.", "Proposed decision/escalation log: recommended decisions are distinguished from supplied observations. Declaration, owner-contact, privacy-escalation and custody times must be recorded when actually known; they are not new inject facts.\n| Time | Decision, authority and reason | Follow-up/unresolved item |\n|---|---|---|\n| On receiving I3; recommended decision | The model recommends declaration under P1 because the audit evidence supports unauthorized public sharing; the actual declaration time is not supplied | Recommend escalation to the privacy lead to assess obligations/context; no jurisdiction-specific notice deadline or observed escalation is invented |\n| When I4 is learned; time not supplied | Record the unavailable owner/blank backup and recommend elevating the contact gap to the incident lead; record actual contact attempts when known | The lead uses the containment authority already granted by P1; a missing contact does not silently grant other staff new powers |\n| 09:07 | Lead authorizes operator to suspend the link and revoke the token to limit continuing exposure | Preserve relevant audit records and record availability effects; verify enforcement separately |\n| 09:09 | Record operator's reported application; do not close the incident solely on that report | Obtain the approved 09:15 checks |\n| 09:15 | Lead and service owner, when reached, may consider P1 recovery approval using checks and preservation evidence | Historical downloads, root cause, broader scope and any reporting obligation remain open investigations; recovery of service and closure of investigation are different decisions |\n| Exercise end | Communications lead controls any outward statement under P1 | A draft may state confirmed facts and uncertainty; no notification is sent by this exercise |", "After-action/improvement record:\n| Observation compared with plan | Analysis and action | Owner/date/effectiveness evidence |\n|---|---|---|\n| Strength supported by the supplied injects: I5 records the lead's authorized containment decision, and I6 records a separate approved verification after the operator's report; the requester of that check is not specified | Retain the distinction between deployment and checked effect | Incident lead retains E4 and the decision link in the training record |\n| Gap: P1 required a backup route, but the supplied plan's backup field was blank when the owner was unreachable | Immediate correction: complete and approve the backup contact. Cause is not yet established; check who maintains the contact list and what changes trigger its review | Plan owner; illustrative deadline: five working days. Before closure, run a newly authorized fictional unreachable-owner inject and record that the correct backup is found and engaged under the plan |\n| Gap: E2 lacks download evidence, so the extent of disclosure cannot be settled | Service/privacy owners assess whether suitable access logging and protected retention would answer the needed question; document trade-offs and any accepted visibility limit | Service owner; illustrative review in ten working days. Evidence: approved decision plus a synthetic event showing the chosen logging/handling works, or a clearly documented unresolved limit |\n| Exercise-quality feedback | Ask whether the given authority, timestamps and injects let participants make the intended decisions; revise ambiguous material before the next exercise | Facilitator captures feedback separately from response performance |\nThese are proposed actions with chosen exercise dates, not evidence that improvements have happened. A later check must establish the action's result rather than closing it when an owner is merely assigned." ], "self_check": [ "You use the supplied plan and classifications; you do not treat a generic standard's words as the studio's actual approval or disclosure law.", "Your timeline distinguishes the 08:57 source event from the 09:05 collection/learning time and separates statement, action report and observed check.", "You retain the uncertainty about downloads while taking proportionate action on credible public-sharing evidence.", "Raw evidence stays Restricted with provenance and controlled access; the summary is minimized and immediate log deletion is not accepted without the proper decision.", "The after-action table has an evidence-based gap, a cause check, a named role, a review date and an observable later check; participation or a completed action list alone is not proof of capability." ], "source_ids": [ "CCG_NIST_IR_RECORDS", "CCG_CTEP_EVALUATION", "CCG_NCSC_EXERCISE_DESIGN" ], "limit": "Original editorial mini-plan, injects and explained model. No publisher-issued exam key, independent learner assessment, legal determination, actual evidence handling, notification, provider contact or operational response is represented." }, "status": "covered_intro", "status_label": "INTRODUCTORY MATERIAL SUPPLIED", "href": "workshop-cc06.html", "summary": "One integrated fictional plan with classification/handling rules, incident criteria, authority, containment and recovery conditions supplied before the injects.", "related_section_numbers": [ 16, 19 ], "original_teaching_need": "An integrated incident case linking response policy, data classification, evidence access, decision records and exercise lessons.", "original_practice_need": "A reviewed incident timeline, data/evidence handling record, decision/escalation log and after-action improvement record, each tied to the stated plan.", "primary_route": "cc", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "CCG_NIST_IR_RECORDS", "CCG_CTEP_EVALUATION", "CCG_NCSC_EXERCISE_DESIGN" ], "component_checks": [ { "component": "Plan, authority and classification supplied before exercise", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "P1 names reporting, declaration, containment, approval/escalation and recovery roles; D1 defines Restricted raw records/Internal redacted summary and preservation. These are explicit fictional policies." }, { "component": "Incident criterion and disclosure uncertainty", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Alert/denial/audit evidence are differentiated. Credible unauthorized sharing meets the fictional criterion; 800 exported rows does not prove 800 downloaded rows or no disclosure." }, { "component": "Timeline and provenance", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "The corrected timeline separates the 08:57 source event, 09:05 report receipt, reported 09:09 changes and observed 09:15 checks. I4 is undated and its contact attempt is kept at an unknown time. Declaration, custody and escalation recommendations are labeled as model decisions, not additional supplied observations." }, { "component": "Handling record", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "E1-E4 originals/metadata/working copy/restricted access/integrity/provenance/retention are specified; a minimized management summary does not automatically declassify the raw record. Immediate ad hoc deletion is rejected while preservation applies." }, { "component": "Decision/escalation and recovery", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Lead's existing containment authority is distinguished from the missing contact route; internal privacy escalation and communications approval do not invent notification law. Recovery needs the stated approvals; 09:15 checks support consideration, not automatic recovery/incident closure." }, { "component": "After-action feedback and action verification", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Strength/gap/cause-check/owner/illustrative dates/later synthetic checks/exercise-quality feedback are supplied. The corrected first strength refers only to the stated authority and separately approved verification; who requested that check is not supplied." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [ "5.1", "5.2", "5.3" ], "cc_ai_application_ids": [ "AI-D2", "AI-D5" ], "pecb_statement_ids": [], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-CC06" } }, { "id": "CC08", "title": "Threat intelligence: report → behaviour → defensive action", "source_ids": [ "CCG_CISA_MAPPING", "CCG_MITRE_MAPPING_LESSON", "CCG_MITRE_DEFENSE_LESSON", "CCG_MITRE_TICKET_473822", "CCG_ATTACK_LINK_CURRENT", "CCG_ATTACK_POWERSHELL_CURRENT", "CCG_ATTACK_DISCOVERY_CURRENT", "CCG_MITRE_HISTORICAL_COMPARISONS" ], "reading_order": [ { "source_id": "CCG_CISA_MAPPING", "read": "Selected finished-report method and common mistakes.", "learn": "Extract actions and context, justify mapping depth, state evidence gaps and avoid turning an indicator or port into a behaviour claim." }, { "source_id": "CCG_MITRE_MAPPING_LESSON", "read": "Selected process/context/mapping-depth slides.", "learn": "A tactic asks why; a technique/sub-technique describes how. More specific mapping needs more specific evidence." }, { "source_id": "CCG_ATTACK_LINK_CURRENT", "read": "Definition and selected current defensive rows.", "learn": "Compare the actual fictional email delivery with a current definition and identify the data needed to validate a defence." }, { "source_id": "CCG_ATTACK_POWERSHELL_CURRENT", "read": "Definition, selected mitigation caveat and current detection row.", "learn": "A legitimate interpreter can be abused; parent/child context and business dependencies matter." }, { "source_id": "CCG_ATTACK_DISCOVERY_CURRENT", "read": "Definition and metadata.", "learn": "Post-compromise remote-service enumeration supports T1046; its current name differs from older training." }, { "source_id": "CCG_MITRE_DEFENSE_LESSON", "read": "Selected process, capabilities/constraints and trade-off slides, then the fictional case.", "learn": "Prioritise relevant behaviours, use available evidence and propose locally testable defensive actions." }, { "source_id": "CCG_MITRE_TICKET_473822", "read": "Optional extension: simulated RTF ticket and complete one-page answer PDF, using the training's v8 context.", "learn": "Compare with the genuine historical publisher mapping sheet without rewriting it. For example, its repeated parent T1059 labels can now be compared with T1059.003 Windows Command Shell because the ticket explicitly says cmd.exe; a query of firewall profiles can also be checked against current Security Software Discovery T1518.001 when the defensive-tool purpose is supported. Record the evidence/version and justify depth rather than assuming every old label is a current exclusive answer. The sheet has limited rationales and is not a CC readiness test." }, { "source_id": "CCG_MITRE_HISTORICAL_COMPARISONS", "read": "Only the opening current definitions and ID/tactic metadata; compare evidence and version with the optional historical ticket.", "learn": "A current comparison needs evidence and justified depth; it does not silently replace an older publisher answer sheet." } ], "new_free_coverage": [ "Complete beginner workflow with a fictional source/context record, observed actions, justified current ATT&CK mappings, unsupported alternatives and explicit uncertainty.", "Prioritised defensive decision table that accounts for existing mail/process evidence, legitimate administration and encrypted-traffic visibility limits.", "Safe paper validation with suspicious, benign and missing-evidence cases, plus optional original MITRE practice whose real publisher answer and version limits were checked." ], "remaining": [ "The fictional report is not independently corroborated real threat intelligence; current real intelligence needs source reliability, environment relevance and additional evidence assessed in its own context.", "No live adversary emulation, production alert tuning or validation of a specific product was performed.", "The historical MITRE exercises use earlier ATT&CK versions and do not supply current CC mixed practice, full answer rationales or independent readiness assessment." ], "payment_note": "FREE primary mapping lessons, technique pages, optional publisher ticket/key and the explained editorial case. No paid intelligence feed, software, commercial bank or course is required for this bounded objective. Independent assessment and advanced operational training remain separate optional choices.", "status_reason": "The exact report-to-action paper workflow is supplied, including source context, supported mappings, uncertainty, relevance, priorities and proposed validation evidence. It does not claim real intelligence validation or operational detection assurance.", "worked_example": { "title": "Turn a short fictional report into a justified defensive decision", "scenario": "Original editorial application. Fictional report R1, dated 29 October 2026, comes from a simulated service-provider analyst and says: B1: an email targeted at the studio's booking staff contained a link to download a fake update installer. B2: on a compromised test workstation, the downloaded installer launched a PowerShell script; the synthetic process record explicitly identifies PowerShell and its parent. B3: after that compromise, the actor enumerated services on remote internal hosts by probing multiple service ports. B4: the workstation also made an encrypted connection to a documentation-only example address using TCP 443; the report supplies no application-protocol or purpose evidence for that connection. These are invented premises for analysis, not real observations or a real vendor report. The studio uses Windows workstations; mail, web and endpoint process records are available, but encrypted network payloads are not visible to its network sensor. Administrators legitimately use PowerShell for booking maintenance. The decision-maker asks: which two defensive improvements should we investigate first, using existing data where possible, and what evidence would show whether they work?", "tasks": [ "Create a source/context record separating what R1 reports from what the studio has actually observed. State relevance, confidence and a request for missing evidence.", "Write a mapping table for B1–B4: behaviour, purpose/tactic where supported, technique/sub-technique ID, rationale and excluded inference. Read the current definitions before selecting the IDs.", "Choose two prioritised defensive actions with owners, business trade-offs and data sources. Include a detection/response or prevention limitation rather than claiming guaranteed coverage.", "Design a paper validation table with a suspicious chain, a benign administrative event and missing telemetry. Do not execute code, scan a network or contact a listed address.", "Prepare a short management recommendation that states the decision, evidence and remaining uncertainty." ], "model_answer": [ "Source/context record: R1 is a fictional external analyst report whose stated observations are the exercise input; the studio has not independently corroborated a real compromise. Its described Windows/mail workflow is relevant to the studio's stated environment, so it is useful for a defensive hypothesis. Confidence is conditional on those supplied premises, not a numerical reliability score. Request original mail/web/process timestamps and record identifiers, the service-enumeration evidence and context for the encrypted connection. Record what is unreported; missing information is not evidence an action never happened. No actor name, country or motivation is established by the behaviours.", "Mapping decision table (current MITRE pages checked 29 October 2026):\n| Reported behaviour | Supported mapping and purpose | Justification / unsupported alternative |\n|---|---|---|\n| B1 targeted email link delivers a fake installer | Initial Access; Phishing: Spearphishing Link, T1566.002 | The report explicitly describes targeted mail with a delivery link. Do not call it Spearphishing Attachment: it says link, not attached installer. Delivery alone does not prove the user executed it. |\n| B2 installer launches an explicitly identified PowerShell script on the compromised test workstation | Execution; Command and Scripting Interpreter: PowerShell, T1059.001 | The interpreter and execution are given, so the sub-technique is supported. 'PowerShell exists on the computer' would be insufficient. The case does not infer that every PowerShell event is hostile or that credentials were dumped. |\n| B3 actor enumerates remote internal services after compromise | Discovery; Network Service Discovery, T1046 | The stated objective/action is service enumeration on remote internal hosts. The current page uses Network Service Discovery; the training's older Network Service Scanning title is historical. Do not substitute pre-compromise Active Scanning solely because both involve probes. |\n| B4 an encrypted TCP 443 connection, with no protocol/purpose evidence | Leave unmapped pending context | Port 443 does not prove HTTP/S, command and control or exfiltration. Request endpoint/process and protocol evidence; do not assign Web Protocols or claim stolen data simply from reachability. |\nThe technique labels are justified classifications of the fictional actions. They are not attribution, a complete attack timeline or proof that corresponding controls work.", "Prioritised defensive action record:\n| Priority / owner | Proposed action and relevance | Trade-off and validation evidence |\n|---|---|---|\n| 1 / monitoring lead with mail/endpoint owners | Correlate targeted link mail and web events with the suspicious installer/PowerShell process chain, using the existing records. Preserve the linked IDs/times and route an investigated alert to the response role. This joins B1 and B2 instead of treating one URL or interpreter name as proof. | Confirm that mail, browser/download and process-parent fields are actually present and time-aligned. Legitimate maintenance must be distinguishable; a missing source means a visibility gap. Current MITRE detection rows are candidates, not a tested analytic for this studio. |\n| 2 / endpoint/service owner | Investigate a tested application-control restriction for unapproved downloaded installers/scripts on booking workstations; retain explicitly approved administrative maintenance. Check necessity, dependencies and a recovery/exception route before enforcement. | Blocking every PowerShell use could interrupt booking maintenance. Evaluate the specific allowed/denied workflow in an authorized lab before any real rollout. The source supports considering execution prevention; this exercise does not assert a product, policy setting or configuration will prevent all PowerShell abuse. |\nAlso retain B3 for a service-enumeration detection/segmentation review using relevant network/host records; the two-priority request is an initial focus, not a reason to discard supported discovery evidence. Never treat opaque TCP 443 as inspected malicious content.", "Paper validation/evidence record:\n| Synthetic case | Expected decision | Evidence/limit |\n|---|---|---|\n| V1 mail-link event, matching web download and unapproved installer → PowerShell process chain on a booking workstation | The proposed correlation should identify the related chain and present its context to the response role; the proposed restriction should reject the unapproved workflow under the stated policy | On paper, check linked user/device/time/event IDs and parent-child records; in a future separately authorized lab, collect actual rule, block/allow and response records. A paper expectation is not an observed alert or block. |\n| V2 approved administrator maintenance from the approved management context | Preserve useful logging and permit the approved work; avoid declaring the event malicious solely because PowerShell ran | Compare role, approved change/window, parent chain and expected activity. Investigate mismatches rather than globally suppressing all admin events. |\n| V3 mail/web records present but process-parent telemetry missing | Report incomplete visibility and a collection/retention action; do not claim the chain was absent or prevented | Determine whether a missing field, collection failure, retention loss or actual absence explains the gap. |\n| V4 only the B4 encrypted TCP 443 connection is supplied | Keep protocol/purpose unresolved | No application-layer mapping or exfiltration claim without supporting evidence. |\nA future validation must measure relevant false positives, missed cases, operational effects and response follow-through; finding a technique in a catalogue is not such validation.", "Management note: Start by checking whether our existing mail/web/process records can expose the reported delivery-to-execution chain, and assess a narrowly scoped restriction on unapproved downloaded code with the service owner. These actions fit the fictional Windows booking workflow and its available data, while preserving approved maintenance. The report supports three behaviour mappings, but we have no verified real incident, attribution, complete protocol evidence for the port-443 connection or tested control effectiveness. Approve investigation and a separately authorized safe validation plan before operational claims or changes." ], "self_check": [ "Each mapping cites a concrete reported action and current definition, not just a malware name, port, nationality or general suspicion.", "You can explain why B1 is a link rather than attachment, why B2 supports the PowerShell sub-technique, and why B3 has post-compromise discovery context.", "You leave B4 unresolved and ask for the evidence needed to narrow it rather than rewarding a more detailed unsupported mapping.", "The defensive choices answer the stated business question, account for available sensors and legitimate administration, and have owners and validation evidence.", "Suspicious, benign and missing-evidence cases have distinct expected outcomes; neither a proposed analytic nor an ATT&CK mapping is reported as a proven detection or prevention result." ], "source_ids": [ "CCG_CISA_MAPPING", "CCG_MITRE_MAPPING_LESSON", "CCG_MITRE_DEFENSE_LESSON", "CCG_ATTACK_LINK_CURRENT", "CCG_ATTACK_POWERSHELL_CURRENT", "CCG_ATTACK_DISCOVERY_CURRENT", "CCG_MITRE_HISTORICAL_COMPARISONS" ], "limit": "Original editorial report, workflow, model and self-checks based on cited primary concepts. It is not a publisher-issued exam key, independent learner assessment, actual CTI attribution, tested detection, lab result or permission to run the described behaviours." }, "status": "covered_intro", "status_label": "INTRODUCTORY MATERIAL SUPPLIED", "href": "workshop-cc08.html", "summary": "Complete beginner workflow with a fictional source/context record, observed actions, justified current ATT&CK mappings, unsupported alternatives and explicit uncertainty.", "related_section_numbers": [ 18, 19 ], "original_teaching_need": "A complete beginner threat-intelligence workflow from a report to justified mappings, priorities and defensive actions.", "original_practice_need": "A checked short analysis showing source/context, observed behaviour, justified mapping, uncertainty, prioritised defensive action and a proposed validation/evidence source.", "primary_route": "cc", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "CCG_CISA_MAPPING", "CCG_MITRE_MAPPING_LESSON", "CCG_MITRE_DEFENSE_LESSON", "CCG_MITRE_TICKET_473822", "CCG_ATTACK_LINK_CURRENT", "CCG_ATTACK_POWERSHELL_CURRENT", "CCG_ATTACK_DISCOVERY_CURRENT", "CCG_MITRE_HISTORICAL_COMPARISONS" ], "component_checks": [ { "component": "Source/context/relevance/confidence", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Fictional service-provider report is explicitly distinguished from corroborated studio evidence; Windows/mail relevance and requests for original timestamps/process/network records are given without invented attribution or numerical reliability." }, { "component": "Behavior-to-current-mapping reasoning", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "B1 link delivery supports T1566.002 Initial Access; explicitly identified B2 PowerShell execution supports T1059.001 Execution; post-compromise B3 remote-service enumeration supports current T1046 Discovery. B4 opaque TCP 443 remains unmapped." }, { "component": "Priorities and defensive action", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Two investigated priorities use available mail/web/process data and narrowly scoped execution prevention; owners, business maintenance needs, dependencies and exceptions are considered. B3 is retained for follow-up despite two-priority limit." }, { "component": "Proposed validation and evidence", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Suspicious chain, approved administration, missing process telemetry and opaque TCP 443 have different expected results; proposed outcomes are explicitly not observed detections/blocks. False positives, misses and operational effects remain to be measured." }, { "component": "Management communication and historical extension", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Management note links decisions to limited evidence and requests investigation. The optional original MITRE ticket/key remains explicitly historical; selected current T1059.003 and T1518.001 definitions now give a concrete editorial comparison without replacing that historical publisher key." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [ "5.2" ], "cc_ai_application_ids": [ "AI-D5" ], "pecb_statement_ids": [], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-CC08" } }, { "id": "AI01", "title": "AI governance, risk appetite and control choice", "source_ids": [ "AIG_NIST_GOVERN", "AIG_NIST_MAP", "AIG_NCSC_DESIGN", "AIG_CISA_AI_TTX", "AIG_NIST_ERM_DIRECTION" ], "reading_order": [ { "source_id": "AIG_NIST_ERM_DIRECTION", "read": "NIST IR 8286r1, viewer p.16 (printed p.7), Enterprise Risk Direction: appetite and tolerance paragraphs, footnote 11 and the email-availability example only.", "learn": "Distinguish broad leadership risk direction from the narrower operational tolerance used for a specific objective; wording varies across NIST publications." }, { "source_id": "AIG_NIST_MAP", "read": "MAP 1.1 About/Suggested Actions and MAP 1.5 About/Suggested Actions only.", "learn": "Start with the purpose, people affected and a non-AI alternative. Then document what risk can be accepted and what causes a no-go decision." }, { "source_id": "AIG_NIST_GOVERN", "read": "GOVERN 1.3; GOVERN 2.1 About/Suggested Actions; GOVERN 2.3 outcome.", "learn": "Connect organizational tolerance to resources and decision authority. A developer, data owner, independent reviewer and risk acceptor have different jobs." }, { "source_id": "AIG_NCSC_DESIGN", "read": "Selected threat-modelling and security/functionality design headings.", "learn": "Compare data exposure, action permissions, usefulness and oversight when choosing controls." }, { "source_id": "AIG_CISA_AI_TTX", "read": "p.1 purpose; p.3 Day 2 questions and Desired Discussion Outcome. Attempt the discussion before looking at the editorial worked case.", "learn": "Use a publisher discussion prompt to question risk priorities and lifecycle evaluation; its desired outcome is a facilitation aid, not an answer key." } ], "new_free_coverage": [ "A complete introductory adoption decision connects the use, asset, owners, affected people, risk appetite, data/model protection, privacy/ethical harms, control trade-offs and residual-risk decision.", "Original worked decision record, model guidance and self-check are available without an account or paid tool.", "CISA supplies an additional publisher discussion and desired discussion outcome; it does not individually assess the learner." ], "remaining": [ "Independent review/marking of the learner's own fresh decision record is not provided by these public readings or the editorial model answer.", "A real adoption still needs organization-specific facts, applicable requirements, supplier evidence, affected-party input and authorized approval. Complete AI RMF/ISO 42001/legal instruction remains outside the introductory target." ], "payment_note": "No payment is needed for these selected readings or the paper case. Paid current teaching/marked support is optional, with exact coverage and actual feedback to be verified before purchase; no paid AI credential is required by this selection.", "status_reason": "The formerly missing introductory worked teaching and guided decision-record practice are supplied. This status means introductory material is available; independently marked learner performance remains unresolved.", "worked_example": { "title": "A small booking studio decides whether to pilot a drafting assistant", "scenario": "Fictional paper exercise. Cedar Studio answers 40 routine booking enquiries each week. Staff currently spend 8 minutes on each reply. The proposal is an approved SaaS assistant that drafts public-FAQ replies; staff continue to make bookings and approve every outgoing message. The team expects a reviewed draft to take 5 minutes. A separate booking system holds personal records. The untested proposal to upload its whole customer export is included as an option to reject or escalate. All times, counts, thresholds, policies and roles below are invented learning choices, not publisher mandates or measured business outcomes. Use no real customer data.", "tasks": [ "1. Write the intended use and prohibited uses. Name the AI service, inputs, outputs and people who could be affected. Include a manual alternative.", "2. Set a fictional appetite statement and measurable pilot conditions before seeing results. Decide who may approve deployment and who may stop the pilot.", "3. Compare full-record uploads, public-FAQ-only drafting and the manual workflow. Select protective controls, name their owners and explain one trade-off for each.", "4. Review the supplied fictional test results: the first prompt produced 6 materially wrong FAQ drafts out of 40; a revised FAQ-grounded prompt produced 1 out of 40. No private-record fixture was exposed in either test. Decide what this supports and what it does not.", "5. Complete a decision record with benefit, residual harms, evidence limitations, approval/escalation and a review date. Compare it with the guidance only after making your decision." ], "model_answer": [ "Step 1 - Bound the use. Asset/use: FAQ Draft Assistant, supplier tenant CEDAR-TRAINING, public FAQ v12 and system prompt v7. Input: approved public opening times, prices and synthetic examples. Output: an internal reply draft with a source pointer. It may not access customer exports, set individual prices, rank customers or send mail. Customers can be harmed by wrong terms, disclosure or unfair/inaccessible responses. The manual FAQ/template workflow remains available. This is an original application of MAP 1.1, not an official NIST case.", "Step 2 - Distinguish appetite, tolerance and a release test. Risk appetite is the broad amount and type of risk an organization is willing to take to pursue its objectives. Risk tolerance concerns the remaining risk it is prepared to bear after response, interpreted in the relevant use context; narrower operational limits can express that direction. Cedar's fictional appetite is to use AI only where routine drafting benefits can be obtained with low information-quality risk and strong confidentiality and human oversight. It authorizes no confidential-record uploads or unreviewed sends. Cedar operationalizes this direction through a fictional pilot tolerance/release gate: at most 1 materially wrong draft per 40 predefined standard FAQ cases, every message human approved, no prohibited-data fixture disclosed and no autonomous action. These gates are chosen controls on this pilot, not universal tolerances or estimates of population risk. The content lead owns the public FAQ data; the application owner operates the service. A security reviewer separate from the application owner checks test/control evidence with the privacy lead. The director accepts residual business risk after those reviews; the operations manager can suspend the pilot immediately. Some NIST documents use tolerance more broadly; the appetite/tolerance distinction here follows NIST IR8286r1, printed p.7.", "Step 3 - Use an owner/control record.\n\n| Risk or decision | Selected control and owner | Trade-off or residual issue |\n|---|---|---|\n| Confidential information sent to supplier | Privacy lead approves an explicit input allowlist; application owner disables customer-system connectors | Less personalization; users may still paste private text, so train staff and check handling |\n| Wrong or invented booking terms | Content lead maintains the approved FAQ; named staff check every draft against it | Human review takes time and can miss errors |\n| Unauthorized action | IT owner removes send/write permissions and uses a separate restricted identity | Additional integration work; capability restrictions do not establish factual accuracy |\n| Unreviewed model/prompt change | Application owner records supplier/model identifier, prompt version and change-test evidence | Provider notice/version controls must be verified; use manual fallback when an unassessed change cannot be avoided |\n| Unfair or inaccessible reply | Operations lead tests equivalent enquiries and plain-language/accessibility needs, and offers human help | Small samples cannot establish fairness for all customers |\n| Sensitive logs | Security lead keeps necessary version/event metadata with restricted access and a chosen retention period | Less raw content can make later investigation harder; collection must be proportionate |", "Step 4 - Interpret the evidence. Initial material-error frequency is 6/40 = 15%; revised frequency is 1/40 = 2.5%, a reduction of 12.5 percentage points on these supplied cases. The revised candidate meets Cedar's chosen FAQ gate. Zero observed leaks in these fixtures does not show leakage is impossible. A small reused test set can be unrepresentative, and human review remains a fallible control. The expected saving is (8 - 5) x 40 = 120 staff-minutes, or 2 hours per week before licence/admin costs; it is a planning estimate, not validated benefit.", "Step 5 - Record the decision. Decision ID AI-ADOPT-01: conditionally approve a two-week FAQ-only pilot with all controls evidenced; keep full customer-export upload outside authorization and escalate any requested data expansion to the privacy lead and director. Owner: operations manager. Approver/risk acceptor: director, after security/privacy review. Residual risks: remaining FAQ errors, staff over-trust, unequal performance and supplier changes. Review on day 14 or sooner after a prohibited disclosure, unauthorized action or failed pilot gate. If controls cannot be demonstrated, retain the manual workflow. CISA p.3 adds a useful discussion about evaluation throughout the lifecycle; it does not approve this decision." ], "self_check": [ "Could another reader identify the purpose, prohibited uses, exact data flow and manual alternative from your record?", "Did you distinguish the person operating the service, the data owner, the tester/reviewer and the person authorized to accept residual risk?", "Did each selected control address an identified harm and include an owner, trade-off and way to check it?", "Did you calculate 15%, 2.5%, 12.5 percentage points and 120 minutes correctly, without presenting the small test as a guarantee?", "Did your decision state conditions, remaining risk, escalation, stop authority and a review trigger?" ], "source_ids": [ "AIG_NIST_GOVERN", "AIG_NIST_MAP", "AIG_NCSC_DESIGN", "AIG_CISA_AI_TTX", "AIG_NIST_ERM_DIRECTION" ], "limit": "Original editorial source-informed application with fictional model guidance. It is not an official ISC2/PECB quiz, an independently marked learner submission, legal advice, a production approval or validated competence. Alignment is introductory CC AI-domain application only." }, "status": "covered_intro", "status_label": "INTRODUCTORY MATERIAL SUPPLIED", "href": "workshop-ai01.html", "summary": "A complete introductory adoption decision connects the use, asset, owners, affected people, risk appetite, data/model protection, privacy/ethical harms, control trade-offs and residual-risk decision.", "related_section_numbers": [ 2, 3, 5, 22 ], "original_teaching_need": "A worked AI adoption decision joining risk appetite, accountability, data/model protection, privacy, ethics and control trade-offs.", "original_practice_need": "A reviewed decision record identifying the AI asset/use, data, owner, plausible harms, selected controls, residual risk and an escalation/approval decision.", "primary_route": "cc", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "AIG_NIST_GOVERN", "AIG_NIST_MAP", "AIG_NCSC_DESIGN", "AIG_CISA_AI_TTX", "AIG_NIST_ERM_DIRECTION" ], "component_checks": [ { "component": "Worked adoption decision; asset/use/data/affected people/manual alternative", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://airc.nist.gov/airmf-resources/playbook/map/", "locator": "MAP 1.1 · About / Suggested Actions" } ] }, { "component": "Risk appetite, tolerance, approval/stop authority", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://nvlpubs.nist.gov/nistpubs/ir/2025/NIST.IR.8286r1.pdf", "locator": "Viewer p.16 (printed p.7) · Enterprise Risk Direction" }, { "primary_url": "https://airc.nist.gov/airmf-resources/playbook/map/", "locator": "MAP 1.5" } ] }, { "component": "Accountability and reviewed decision artifact", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://airc.nist.gov/airmf-resources/playbook/govern/", "locator": "GOVERN 2.1 / 2.3" } ] }, { "component": "Data/model protection and privacy", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-design", "locator": "Design for security; data/API and action-control bullets" } ] }, { "component": "Ethical harms and control trade-offs", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-design", "locator": "Threat modelling and security/functionality design" } ] }, { "component": "Plausible harms, selected controls, residual risk and escalation decision", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://airc.nist.gov/airmf-resources/playbook/map/", "locator": "MAP 1.5 · Suggested Actions" }, { "primary_url": "https://www.cisa.gov/sites/default/files/2024-06/June_13_TTX_Plan_508c.pdf", "locator": "Viewer p.3 · Day 2" } ] }, { "component": "Evidence calculations and checked guidance", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://airc.nist.gov/airmf-resources/playbook/map/", "locator": "MAP 1.1 · metrics / use context" } ] } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [ "1.1", "1.2", "1.3", "1.4", "1.5", "2.1" ], "cc_ai_application_ids": [ "AI-D1" ], "pecb_statement_ids": [ "D1-C06", "D1-C08", "D1-C11", "D1-K08", "D1-K10", "D1-K12" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-AI01" } }, { "id": "AI02", "title": "AI continuity, model drift, awareness and measures", "source_ids": [ "AIG_NCSC_ASSETS", "AIG_NIST_GENAI", "AIG_NIST_MEASURE", "AIG_NIST_MANAGE", "AIG_CISA_AI_TTX", "AIG_FBI_IMPERSONATION" ], "reading_order": [ { "source_id": "AIG_NCSC_ASSETS", "read": "Identify, track and protect your assets; Document your data, models and prompts; supply-chain failover sentence.", "learn": "Restoring the application requires more than a model name: inventory data, prompts, software, configurations and protected evidence." }, { "source_id": "AIG_NIST_GENAI", "read": "GV-6.2-001, viewer p.25; GV-6.2-003 and GV-6.2-006, viewer p.26.", "learn": "Name third-party dependencies, incident owners and tested fallback choices, including manual processing." }, { "source_id": "AIG_NIST_MEASURE", "read": "MEASURE 2.4 About and Suggested Actions.", "learn": "Compare deployment observations with a baseline, investigate causes, and define responsible human responses." }, { "source_id": "AIG_NIST_MANAGE", "read": "MANAGE 2.3 and 2.4 selected passages.", "learn": "Preplan how to bypass or suspend an unreliable component and what evidence is needed for return." }, { "source_id": "AIG_FBI_IMPERSONATION", "read": "Voice/video impersonation headings and independent-contact verification bullet only.", "learn": "A believable voice or video is insufficient authority for a sensitive request." }, { "source_id": "AIG_CISA_AI_TTX", "read": "p.7 Day 21 questions/Desired Discussion Outcome and the matching continuity question on p.10.", "learn": "Add a publisher-facilitated continuity decision discussion after an AI incident; do not mistake its outcome statement for marking." } ], "new_free_coverage": [ "A dependency/recovery-owner table covers application, prompt/configuration, reference data, index, hosted model, identity/network and business records, with distinct recovery goals.", "A worked KRI calculation has a baseline, denominator, direction, fictional threshold, owner and response, while distinguishing observed degradation from an attack finding.", "A synthetic voice-impersonation inject practices trusted-channel verification, payment/change authority and escalation.", "A paper fallback/restore walkthrough and CISA continuity discussion provide guided practice without an account or cloud charges." ], "remaining": [ "The learner's own fresh dependency table, recovery explanation and KRI decision still need independent review if marked practice is desired.", "No actual backup restore, provider failover, model-version availability, statistical drift diagnosis or operational recovery time has been tested by this paper case.", "A qualified organization must define real business-impact priorities, recovery targets, reporting duties and supplier arrangements." ], "payment_note": "Selected reading and the complete paper case are free. A hosted model/API/Sentinel or other cloud lab can incur service/compute charges and is not needed. Paid marked support remains optional and unverified; do not buy a course merely because its catalogue says AI or continuity.", "status_reason": "Introductory worked teaching and guided self-check now address every named teaching element and artifact. Independent marking and a real restoration exercise remain separate unresolved needs.", "worked_example": { "title": "Keep booking work running when an AI supplier fails and quality changes", "scenario": "Fictional paper exercise. Cedar now uses a customer-built drafting application calling a provider-hosted model API. Humans continue to manage the separate booking system. A model outage begins at 09:00. Fictional business goals are to resume accepting bookings within 30 minutes and restore a validated assistant within 4 hours. The booking-record recovery point objective is 15 minutes; public FAQ changes have a separate 24-hour recovery-point target. Later, a weekly quality sample worsens and a caller sounding like the director requests an urgent bank-account change. All targets, samples and times are invented choices. No live service, records or voice-generation tool is required.", "tasks": [ "1. Build an asset/dependency table naming who owns restoration, what evidence/artifact is retained, and how to work without it. Distinguish items Cedar can back up from a hosted model it cannot copy.", "2. Explain a safe fallback and ordered return to service. Use the supplied paper events: manual intake available at 09:20; approved assistant validated at 12:00. Compare elapsed times with the stated goals.", "3. Define a KRI: materially wrong answers per 100 human-reviewed replies per week. Baseline is 2 of 100; current week is 9 of 100. Fictional escalation trigger is greater than 5%; a prohibited-data disclosure triggers immediate suspension at any rate. Calculate and decide.", "4. Explain at least three plausible causes of the change and what evidence could distinguish them. Do not label it poisoning solely because the rate changed.", "5. Respond to the urgent director-voice request. State who verifies it, what channel is used, what action is held and when the security team is involved." ], "model_answer": [ "Step 1 - Separate business continuity from AI restoration. Continue accepting bookings with the existing booking system and approved manual templates; queue draft requests and prohibit automated messages. A backup is a retained copy; recovery also requires people, permissions, dependencies and a successful validation. A provider-hosted model is not assumed downloadable or reproducible by the customer.", "Step 2 - Complete the dependency record.\n\n| Dependency/asset | Restore or coordination owner | Retained evidence and recovery check | Fallback/limit |\n|---|---|---|---|\n| Booking records | Operations data owner and IT backup owner | Protected record snapshots at most 15 minutes apart; reconcile sequence numbers after restore | Protected numbered manual intake, then reconcile; snapshot frequency alone does not prove RPO |\n| Application v1.4, prompt v7, configuration | Application owner | Approved release archive, change record, integrity evidence and configuration; validate access and behaviour | Manual FAQ replies; review credentials separately and do not blindly restore revoked secrets |\n| Public FAQ v12 and retrieval index | Content lead | Approved daily FAQ copy plus index recipe/versions; check recent amendments and retrieval | Static approved FAQ; rebuild/validate index rather than assuming an old index matches new text |\n| Provider-hosted model/API version | Supplier service owner, coordinated by Cedar application owner | Availability/version notice and tested endpoint/behaviour; verify earlier version is still offered | Remain manual if the required model cannot be restored; customer's backup does not recreate provider weights |\n| Identity, network access and useful logs | IT platform owner and security lead | Approved access/network configuration and restricted event records; test permitted and denied requests | Keep AI disconnected until controls are restored; protect sensitive logs |\n| Staff and escalation contacts | Operations manager | Current approved instructions and reachable duty owners | Train another staff member to run manual intake |", "Step 3 - Walk through recovery. At 09:00 the operations manager suspends AI drafting and starts the response record; IT preserves necessary event/version evidence and checks whether the booking system is also affected. At 09:20 staff can accept bookings manually: 20 minutes, within the fictional 30-minute continuity target. The application owner restores the approved application/prompt/configuration, the content lead checks FAQ/index consistency, and IT checks identities, endpoint and logging. At 12:00 the supplied paper exercise says acceptance/security checks pass and the operations manager authorizes return: 3 hours after 09:00, within the 4-hour assistant goal. These are simulated times, not an executed restore or an SLA guarantee. Booking RPO 15 minutes and FAQ RPO 24 hours refer to different data; test and reconcile each separately.", "Step 4 - Make the KRI actionable. Name: material-answer-error rate. Formula: materially wrong replies / reviewed replies x 100. Baseline: 2/100 = 2%. Current: 9/100 = 9%; increase = 7 percentage points. Direction: higher is worse. Fictional threshold: greater than 5% in a weekly sample, with any prohibited disclosure causing immediate suspension. Owner: content lead measures; operations manager decides; security/privacy leads receive relevant escalations. At 9%, record a breach and revert to the manual/verified-template workflow until reviewed. Preserve sample-selection method and version metadata. This sample rate does not establish the population rate, representativeness, or a cause of the change.", "Step 5 - Investigate before classifying. Compare input mix with the baseline: a seasonal increase in unfamiliar questions may mean the context changed. Check whether supplier model, prompt, application, FAQ or index versions changed. Check labels and the review process for measurement error, and review access/integrity events for evidence of tampering. Data/concept/model drift is a possible explanation; poisoning needs evidence of adversarial interference. Re-test relevant cases against the approved configuration, warn users about limitations and require an authorized return decision. Document owner, cause, action and follow-up date.", "Step 6 - Handle the voice inject. A familiar-sounding caller is a claim of identity, not approval. The staff member holds the bank-detail change and ends the incoming interaction; the finance owner contacts the director through a number already verified in the internal directory, not the supplied callback number. The ordinary dual-approval process remains in force. Report the suspicious request to the security coordinator with proportionate time/channel/request evidence and preserve it under the incident process. Do not send data or make a payment merely to test the caller. Verification failure remains an incident to investigate, even if the voice sounds convincing." ], "self_check": [ "Did your table include people, data, configurations, prompts, index and provider dependency rather than only a model backup?", "Did you explain why a hosted API may require supplier coordination/manual fallback, and why provider recovery cannot be assumed?", "Did you distinguish 20-minute continuity, 3-hour assistant restoration, 15-minute booking RPO and 24-hour FAQ RPO?", "Does the KRI have the same denominator and review method, 2% baseline, 9% current, 7-percentage-point change, direction, trigger, owner and response?", "Did you retain multiple explanations for degraded quality and reserve attack claims for evidence?", "Would the impersonation response still work if voice, video, spelling and caller ID all looked convincing?" ], "source_ids": [ "AIG_NCSC_ASSETS", "AIG_NIST_GENAI", "AIG_NIST_MEASURE", "AIG_NIST_MANAGE", "AIG_CISA_AI_TTX", "AIG_FBI_IMPERSONATION" ], "limit": "Original editorial source-informed paper exercise with invented targets/results. It offers self-comparison, not independently marked learning, statistical drift validation, actual continuity/backup testing, an official exam key or proof of competence." }, "status": "covered_intro", "status_label": "INTRODUCTORY MATERIAL SUPPLIED", "href": "workshop-ai02.html", "summary": "A dependency/recovery-owner table covers application, prompt/configuration, reference data, index, hosted model, identity/network and business records, with distinct recovery goals.", "related_section_numbers": [ 6, 7, 8, 22 ], "original_teaching_need": "A recovery/dependency walkthrough for models, configurations and data; a drift/KRI decision; and responses to AI-enabled impersonation.", "original_practice_need": "A checked asset/dependency and recovery-owner table, a fallback/restore explanation and a metric example with baseline, direction, threshold, owner and response.", "primary_route": "cc", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "AIG_NCSC_ASSETS", "AIG_NIST_GENAI", "AIG_NIST_MEASURE", "AIG_NIST_MANAGE", "AIG_CISA_AI_TTX", "AIG_FBI_IMPERSONATION" ], "component_checks": [ { "component": "Recovery/dependency walkthrough for models/configuration/data", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development", "locator": "Assets/Document/Failover" }, { "primary_url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf", "locator": "GV-6.2-001/003/006 · viewer pp.25–26" } ] }, { "component": "Checked asset/dependency/recovery-owner table", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development", "locator": "Assets/Document" } ] }, { "component": "Fallback/restore explanation", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://airc.nist.gov/airmf-resources/playbook/manage/", "locator": "MANAGE 2.3 / 2.4" }, { "primary_url": "https://www.cisa.gov/sites/default/files/2024-06/June_13_TTX_Plan_508c.pdf", "locator": "Viewer p.7 · Day 21; p.10 · corresponding continuity prompt" } ] }, { "component": "Drift/KRI decision and all required metric fields", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://airc.nist.gov/airmf-resources/playbook/measure/", "locator": "MEASURE 2.4 · About / Suggested Actions" } ] }, { "component": "Response to AI-enabled impersonation", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://www.ic3.gov/PSA/2024/PSA241203", "locator": "Audio / Video; Tips · independent-contact bullet" } ] } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [ "2.2", "2.3", "2.4" ], "cc_ai_application_ids": [ "AI-D2" ], "pecb_statement_ids": [ "D1-C07", "D1-C11", "D1-K12" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-AI02" } }, { "id": "AI04", "title": "AI-assisted network detection and cloud responsibility", "source_ids": [ "AIG_NIST_IDPS", "AIG_NIST_FIREWALL", "AIG_MS_ANOMALIES", "AIG_MS_FALSE_POSITIVES", "AIG_MS_AI_RESPONSIBILITY", "AIG_MS_CLOUD_RESPONSIBILITY" ], "reading_order": [ { "source_id": "AIG_NIST_FIREWALL", "read": "Viewer p.11, section 2 first sentence only.", "learn": "A firewall enforces traffic policy; this definition does not promise that allowed content is correct or safe." }, { "source_id": "AIG_NIST_IDPS", "read": "Selected IDS/IPS definitions, false-positive paragraph, anomaly baseline/monthly-maintenance example and wireless first sentence only.", "learn": "Detection flags possible incidents; prevention attempts action. Unusual legitimate activity can look suspicious. Reuse stable concepts without following 2007 deployment advice." }, { "source_id": "AIG_MS_ANOMALIES", "read": "Opening baseline explanation and score description only; skip the rule catalogue.", "learn": "An anomaly score describes departure from a baseline. It is not proof of attack or necessarily a probability." }, { "source_id": "AIG_MS_FALSE_POSITIVES", "read": "Opening imperfection statement and normal-activity/security-scanning examples.", "learn": "Check benign explanations and corroborating evidence before changing controls." }, { "source_id": "AIG_MS_AI_RESPONSIBILITY", "read": "Governance note and AI platform/application/usage headings.", "learn": "Locate the AI component's layers and the tasks performed by customer and provider." }, { "source_id": "AIG_MS_CLOUD_RESPONSIBILITY", "read": "Service-model definitions, matrix and retained-customer/shared-responsibility headings.", "learn": "Build a service-specific ownership table; data, settings and identities remain customer concerns even when a provider operates the service." } ], "new_free_coverage": [ "Explicit firewall/IDS/IPS comparison and an AI-alert false-positive walkthrough with corroboration and a bounded tuning decision.", "Wireless embedded-sensor example at concept level, with device-owner and visibility limits stated.", "A stated PaaS AI scenario has a concrete provider/customer ownership table, plus qualified IaaS/PaaS/SaaS contrasts.", "Worked guidance and self-check require no Packet Tracer, Sentinel, cloud subscription or live network." ], "remaining": [ "Independent marking of a learner's own fresh comparison/owner table remains unavailable in this selection.", "No actual IDS/IPS/firewall configuration, wireless coverage, device support, cloud contract or alert accuracy has been validated. A real design needs service-specific current documentation and engineering review." ], "payment_note": "Assigned reading and the complete paper case are free. Azure/Sentinel/API/compute charges are separate; no service launch, account, trial or paid lab is needed. Paid guided labs/feedback are optional only after their exact requirements and coverage are checked.", "status_reason": "The requested introductory comparison, false-positive case, wireless/embedded context and cloud owner record now have worked teaching and guided self-check. This does not close independently assessed or hands-on engineering needs.", "worked_example": { "title": "Investigate a wireless sensor alert and assign PaaS AI duties", "scenario": "Fictional paper exercise. Cedar has 12 wireless room-temperature sensors with embedded firmware. In this scenario they support no host security agent. Their normal outbound telemetry is about 5 MB per device per hour. A firewall restricts sensor-network paths to an approved gateway and update service. A passive IDS and an ML anomaly service analyse available gateway/flow logs. During the one-hour observation window from 11:00 to 12:00, one sensor transfers a total of 60 MB to the approved update service within a documented maintenance window; the anomaly record has score 0.92. A customer-built analyst assistant running on a managed application platform calls a provider-managed model API to explain alerts. Treat this as the stated PaaS scenario; service agreements are not supplied. All values, architecture constraints and change records are fictional, not deployment advice.", "tasks": [ "1. Compare what the firewall, passive IDS, IPS and ML anomaly score contribute. Explain why allowing a connection or assigning a high score does not decide whether there is an incident.", "2. Write an investigation record for the 60 MB event. Include one plausible false positive, evidence needed, the owner, an action and a limit on any exception.", "3. Explain a wireless/embedded issue and assign a device owner without proposing obsolete Wi-Fi settings or installing tools.", "4. Build an ownership table for the stated PaaS assistant: data, identities, sensor/local network, application/prompt, model/API platform and incident coordination. Explain how IaaS/SaaS would shift some duties.", "5. State what would cause escalation or a controlled block, and what must be checked before changing a production firewall or suppressing alerts." ], "model_answer": [ "Step 1 - Compare the functions.\n\n| Function | Primary role in this stated case | What it does not establish |\n|---|---|---|\n| Firewall | Enforces the permitted sensor/gateway/update traffic paths | That every permitted payload is benign or every model answer is correct |\n| Passive IDS | Observes available events and alerts on possible incidents for investigation | Automatic blocking; this case deliberately describes a passive sensor |\n| IPS | Adds the ability to attempt prevention when configured/authorized | Perfect prevention or zero operational disruption |\n| ML anomaly analysis | Compares activity with an observed baseline | A confirmed compromise or a calibrated 92% probability of attack |\n\nA modern product may combine these functions. The comparison is about roles and enabled controls, not a claim that product categories never overlap.", "Step 2 - Corroborate the unusual event. For the same one-hour window, 60 MB is 12 times the usual 5 MB volume; this ratio describes volume only. The documented firmware update is a plausible benign cause. The transfer can be a true volume anomaly while being a false positive if interpreted as evidence of malicious activity; unusual and malicious are different judgments. The analyst checks the approved change ticket, correct device identity, exact destination, time window, update integrity/status and other relevant logs with the device/network owners. The stated 0.92 value means strong baseline deviation in this illustrative record; it is not a 92% attack probability. Until corroborated, label the event unexplained/suspicious rather than confirmed malicious or confirmed harmless.", "Step 3 - Record the decision. Record NET-AI-01: analyst owns triage; device owner confirms whether the expected update completed; network owner validates the actual permitted path. If the maintenance evidence matches and no conflicting evidence appears, close as expected update with the evidence reference. Any proposed tuning is narrowly scoped to the validated device/update event and reviewed after the maintenance window. Do not globally allowlist a supplier or suppress all future 60 MB events. A wrong destination, unapproved update, failed integrity check or new lateral traffic leads to incident escalation and an authorized containment decision. Blocking has a continuity cost, so the relevant owner weighs that consequence using the incident process.", "Step 4 - Include the device context. These fictional sensors communicate over wireless and cannot run a host agent. The device owner must therefore know the inventory, supported firmware/update path and expected behaviour; the network/security owners must understand which traffic their sensors and logs can actually observe. A network boundary control does not observe every radio-level event or prove a device is healthy. Conceptually restrict unnecessary sensor paths and keep administrative access controlled; a qualified engineer chooses and tests current implementation settings. No old wireless standard or automatic deauthentication action is assigned.", "Step 5 - Assign the stated PaaS duties.\n\n| Area | Cedar owner/duty | Provider duty or fact to verify |\n|---|---|---|\n| Sensor data, prompt inputs and outputs | Data owner classifies/minimizes data and approves retention/use; analyst checks explanations | Verify processing, retention and data-access options in the selected service |\n| Customer identities and permissions | IT identity owner manages users, app identity, access and revocation | Provider operates its identity/platform components as specified; customer settings remain customer-owned |\n| Sensors and local wireless/network | Device and network owners maintain inventory, permitted paths and local controls | Not transferred merely because analysis is in a cloud service |\n| Customer application, connectors and prompt | Application owner protects code/configuration, tests untrusted input and constrains actions | Managed runtime/base services are provider-operated within the selected service boundary |\n| Hosted model/API and underlying cloud | Application owner selects approved version/settings and monitors service notices; cannot assume a copy of provider weights | Provider operates its hosted platform/model and underlying infrastructure; exact safety controls, limits and availability must be checked |\n| Investigation and continuity | Security coordinator gathers customer evidence, handles relevant impacts and invokes manual triage | Agree evidence availability, escalation contacts and provider incident coordination; a model explanation is not an incident decision |", "Step 6 - Compare service choices carefully. In IaaS Cedar also manages guest OS/runtime and the deployed application/model components it controls; the provider still operates underlying infrastructure. In PaaS the provider manages the platform/base OS while Cedar still secures its application, configuration, identities and data, with some controls shared. In SaaS the provider supplies more of the application stack, but Cedar still governs its data, settings, access, endpoints and use. Products can combine models, and application/network responsibilities may be shared. Verify the actual agreement and exposed controls instead of treating this learning table as a legal allocation." ], "self_check": [ "Did you distinguish traffic enforcement, detection, attempted prevention and baseline deviation while allowing product overlap?", "Did you calculate 60/5 = 12 and avoid treating score 0.92 as a 92% attack probability?", "Did you keep expected maintenance as a hypothesis until the identity, destination, timing and integrity evidence were checked?", "Is any tuning/exception narrowly scoped, owned, reviewable and separate from a broad allowlist?", "Did your wireless/embedded explanation address the stated lack of a host agent and limits of network visibility?", "Does the owner table retain customer data/identity/configuration duties and distinguish customer application from provider platform responsibilities?" ], "source_ids": [ "AIG_NIST_IDPS", "AIG_NIST_FIREWALL", "AIG_MS_ANOMALIES", "AIG_MS_FALSE_POSITIVES", "AIG_MS_AI_RESPONSIBILITY", "AIG_MS_CLOUD_RESPONSIBILITY" ], "limit": "Original editorial source-informed case and model guidance. No actual alert, service, wireless design, control configuration, contract allocation or learner competence has been validated. Older NIST material supplies stable definitions only; no obsolete implementation instructions are revived. Not an official exam or publisher key." }, "status": "covered_intro", "status_label": "INTRODUCTORY MATERIAL SUPPLIED", "href": "workshop-ai04.html", "summary": "Explicit firewall/IDS/IPS comparison and an AI-alert false-positive walkthrough with corroboration and a bounded tuning decision.", "related_section_numbers": [ 11, 12, 13, 14, 22 ], "original_teaching_need": "A clear IDS/firewall distinction, anomaly limits, wireless/embedded implications and an AI hosting responsibility case.", "original_practice_need": "A reviewed comparison of detection versus prevention, one plausible false positive, and an owner table for a stated SaaS/PaaS/IaaS AI scenario. Include a wireless or embedded-device example at concept level.", "primary_route": "cc", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "AIG_NIST_IDPS", "AIG_NIST_FIREWALL", "AIG_MS_ANOMALIES", "AIG_MS_FALSE_POSITIVES", "AIG_MS_AI_RESPONSIBILITY", "AIG_MS_CLOUD_RESPONSIBILITY" ], "component_checks": [ { "component": "Clear IDS/firewall and detection/prevention distinction", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf", "locator": "Viewer p.11 · section 2, first sentence" }, { "primary_url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-94.pdf", "locator": "Viewer p.15 · section 2, first two paragraphs" } ] }, { "component": "Anomaly limits and one plausible false positive", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-94.pdf", "locator": "Viewer pp.17–19 · section 2.3.2" }, { "primary_url": "https://learn.microsoft.com/en-us/azure/sentinel/anomalies-reference", "locator": "opening/score" }, { "primary_url": "https://learn.microsoft.com/en-us/azure/sentinel/false-positives", "locator": "Normal activity examples" } ] }, { "component": "Wireless/embedded implications at concept level", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-94.pdf", "locator": "Viewer p.20 · section 2.4, Wireless, first sentence" } ] }, { "component": "AI hosting stated model and reviewed owner table", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility-ai", "locator": "Governance note / AI platform / application / usage" }, { "primary_url": "https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility", "locator": "Definitions / matrix / retained and shared responsibilities" } ] }, { "component": "Owner/action/bounded tuning/escalation", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://learn.microsoft.com/en-us/azure/sentinel/false-positives", "locator": "Limited-time maintenance exception paragraph" } ] } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [ "4.1", "4.3", "5.2" ], "cc_ai_application_ids": [ "AI-D4" ], "pecb_statement_ids": [ "D1-C11", "D1-K12" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-AI04" } }, { "id": "AI05", "title": "AI workspace inputs, version changes and testing", "source_ids": [ "AIG_NIST_GENAI", "AIG_NCSC_ASSETS", "AIG_NCSC_DEPLOY", "AIG_NCSC_OPERATE", "AIG_MS_MEASURE_HARMS", "AIG_MS_OPERATE", "AIG_CISA_AI_TTX" ], "reading_order": [ { "source_id": "AIG_NIST_GENAI", "read": "Section 2.4 viewer p.11; GV-1.4-002 viewer p.19; GV-1.6-003 viewer p.20; GV-3.2-003 viewer p.22.", "learn": "Tie acceptable queries, sensitive-data handling and a version-aware inventory to the use context. Removing names alone does not demonstrate anonymity." }, { "source_id": "AIG_NCSC_ASSETS", "read": "Identify, track and protect your assets; Document your data, models and prompts.", "learn": "Record and protect the complete application/data/prompt/model configuration, not just the model name." }, { "source_id": "AIG_NCSC_OPERATE", "read": "Selected monitoring, update and lessons headings.", "learn": "Treat changes to data, prompts and models as possible behaviour changes that need appropriate evaluation and escalation." }, { "source_id": "AIG_MS_MEASURE_HARMS", "read": "Baseline, evaluation criteria and manual/automatic testing text only.", "learn": "Define cases and pass/fail rules before comparing versions; a single average can hide a serious security failure." }, { "source_id": "AIG_MS_OPERATE", "read": "Prerelease review and release/operate headings.", "learn": "Prepare a restricted rollout, named incident route and rollback plan before release." }, { "source_id": "AIG_NCSC_DEPLOY", "read": "Incident management, evaluated release and appropriate-use headings.", "learn": "Connect test evidence to release authority, limitations and user responsibilities." }, { "source_id": "AIG_CISA_AI_TTX", "read": "p.3 Day 4 and p.5 Day 6 10:12 AM discussion/Desired Discussion Outcomes; matching supply-chain questions p.9.", "learn": "Use a publisher scenario to question an unexpected model update and untrusted replacement; discuss rather than downloading or executing anything." } ], "new_free_coverage": [ "A worked permitted/conditional/prohibited-input policy connects data classification, protective handling, provider review and escalation.", "A version/change record joins application, model, prompt, data and index, with test groups, explicit fictional release gates, failure escalation and rollback evidence.", "The paper case includes calculations, a blocked-release decision, a simulated restoration timeline and self-check guidance; no cloud account or charges are required.", "CISA adds a publisher supply-chain/update discussion with facilitator outcomes, distinct from a scored learner assessment." ], "remaining": [ "Independent feedback on a learner's own fresh policy, test and release/rollback record is not provided by this editorial example or the selected public guidance.", "No real system tests, tenant data-use terms, privacy review, provider rollback/version retention, release or restoration have been performed.", "A complete secure-development, legal/privacy or model-evaluation curriculum exceeds the bounded introductory target." ], "payment_note": "The selected text and paper case are free. The separate Microsoft Foundry guardrails lab explicitly requires an Azure subscription and deploys a model; it is outside the free route and may incur service/compute charges. No purchase/sign-up is needed here. Paid marked practice remains optional with feedback/coverage to verify.", "status_reason": "The missing introductory acceptable-input and change-testing walkthroughs now include artifacts, explained model guidance and self-check. Independently marked learner work and actual operational testing remain unresolved.", "worked_example": { "title": "Reject an unsafe model change despite a high average test score", "scenario": "Fictional paper exercise. Cedar's approved FAQ assistant is application 1.4, prompt 7, public FAQ 12, index build 12 and provider model A. Proposed application 1.5/prompt 8/model B keeps the same FAQ/index but changes how source text is included. The approved service must only draft for staff and never expose restricted records or send messages. All datasets, outputs, identifiers, policies, thresholds and times below are invented. Use synthetic fixtures only; no real records, model/API calls or cloud deployment are needed.", "tasks": [ "1. Write an input policy for public FAQ text, synthetic records, redacted customer enquiries, an entire customer CSV export, passwords/API keys and sensitive special-request information. Include protective handling and an escalation route.", "2. Write a change record containing the full approved/candidate configuration, reason, owner, reviewers, test-set version and release/rollback authority.", "3. Define fictional release gates before reviewing the table. Then interpret candidate results: FAQ correctness 19/20; restricted-record requests safely refused 10/10; malicious-instruction fixtures safely handled 9/10; API-outage cases safely handled 10/10. One malicious-instruction fixture caused the candidate to reveal a planted synthetic secret from an unauthorized reference. Calculate group/overall rates and make a release decision.", "4. Explain who receives the failure, what evidence is retained and how to protect it. State what is required before retest/release.", "5. Rehearse a rollback on paper: a production symptom is detected 09:00; AI use paused 09:05; approved prior configuration reinstated 09:15; checks complete 09:25. Compare with a fictional 30-minute restoration goal and explain the fallback if model A is unavailable." ], "model_answer": [ "Step 1 - Specify acceptable input and handling.\n\n| Input | Fictional policy decision | Protective handling / owner |\n|---|---|---|\n| Approved public FAQ | Permitted for the stated FAQ task | Content lead approves source/version; preserve source attribution |\n| Synthetic test record | Permitted in an isolated test set if it does not reproduce a real person/secret | Test lead records fixture origin and limits access where useful |\n| Redacted customer enquiry | Conditional; stop until data owner approves purpose, remaining identifiability and the chosen tenant/provider settings | Privacy lead checks minimum necessary data and handling; removing a name alone may leave identifying dates/context |\n| Entire customer CSV export | Prohibited in this FAQ service | No upload; data owner/privacy lead must review any proposed scope expansion before authorization |\n| Password, token or API key | Prohibited prompt content | Use an approved secret mechanism for applications; if a real secret was exposed, invoke the incident/rotation process |\n| Sensitive special-request/health detail or confidential supplier terms | Prohibited for this public-FAQ workflow | Refer to an authorized human channel; separately approved private processing would require its own evidence and controls |\n\nTreat outputs and logs according to their sensitivity as well. Keep necessary event/version evidence with restricted access and an approved retention period; do not collect unlimited raw conversations. If classification or provider handling is unknown, stop that input and ask the named data/privacy owner.", "Step 2 - Make the change reproducible. Record CHG-AI-02: approved tuple app 1.4 / prompt 7 / FAQ 12 / index 12 / provider model A; candidate tuple app 1.5 / prompt 8 / FAQ 12 / index 12 / provider model B. Reason: proposed improvement to FAQ drafting. Owner: application owner. Reviewers: content lead for correctness, security test lead for authorization/instruction-handling, privacy lead for data handling, operations manager for continuity. Evidence: test set T-FAQ-03, configuration references, supplier change notice, controlled test outputs and result table. Director/authorized change owner approves release only after required reviews; operations manager may pause use. Record model availability/retirement constraints rather than assuming the old API version remains callable.", "Step 3 - Set gates before results. Cedar's invented rules: FAQ correctness at least 19/20; every restricted-record, malicious-instruction and outage case passes; zero prohibited disclosures or unreviewed sends; approved prior configuration or manual fallback can be reinstated within the chosen 30-minute goal. Passing these small checks is necessary for this learning decision, not sufficient evidence for all real deployment conditions. A text policy and model instruction do not replace access controls.", "Step 4 - Calculate and decide.\n\n| Group | Candidate passed / total | Observed rate | Gate met? |\n|---|---|---|---|\n| FAQ correctness | 19/20 | 95% | Yes, the fictional correctness gate is 19/20 |\n| Restricted-record requests | 10/10 | 100% | Yes on these fixtures |\n| Malicious instructions | 9/10 | 90% | No; one synthetic secret was disclosed |\n| API outage / safe fallback | 10/10 | 100% | Yes on these fixtures |\n| Overall | 48/50 | 96% | Overall average does not override a security gate |\n\nDecision: block candidate release. The serious disclosure condition fails even though the overall result is 96%. Retain approved 1.4 or manual service, correct the source/authorization boundary and test the affected path plus relevant regression cases. Repeat a fresh review after the change; do not merely remove the failing case or change the gate to pass it. This is original editorial test guidance, not a publisher score or actual execution result.", "Step 5 - Escalate with useful protected evidence. The test lead notifies the application owner and security lead immediately under the fictional change procedure; involve privacy/data owners if real information may have been exposed. Record the failing fixture ID, full version tuple, expected versus observed behaviour, severity and reproduction conditions in a restricted record. The fixture contains a synthetic secret, but the evidence route should be suitable for real sensitive material. If discovered after release, pause the AI path, preserve necessary evidence, assess scope/impact and follow the authorized incident route. Actual notification/reporting duties need a separate competent review.", "Step 6 - Rehearse rollback and prove the limits. In this paper timeline, the operations manager pauses AI at 09:05 and starts manual replies. The application owner restores the complete approved tuple at 09:15, including consistent data/index/configuration references; IT reviews identities/credentials and connectivity. At 09:25 the supplied rehearsal says acceptance and security checks finish: 25 minutes from detection, inside the fictional 30-minute goal. Log approver, times, restored tuple, check IDs/results and unresolved issues before reopening. These are simulated facts; no actual rollback is claimed. If provider model A is no longer available or the restored tuple cannot pass checks, keep the approved manual workflow and escalate rather than silently substituting another model." ], "self_check": [ "Does your policy distinguish permitted, conditional and prohibited input for this specific workflow, with a named decision owner?", "Did you avoid equating removal of a name, a provider brand or encryption with authorization to upload sensitive records?", "Could a reviewer reconstruct both approved and candidate app/model/prompt/data/index configurations and the test criteria?", "Did you calculate 95%, 100%, 90%, 100% and 48/50 = 96%, and still block release because the security gate failed?", "Does the failure record explain evidence, severity, owners, escalation and retest rather than only recording an average score?", "Did the rollback account for the entire configuration, supplier version availability, permission checks, 25-minute simulated time and a manual fallback?" ], "source_ids": [ "AIG_NIST_GENAI", "AIG_NCSC_ASSETS", "AIG_NCSC_DEPLOY", "AIG_NCSC_OPERATE", "AIG_MS_MEASURE_HARMS", "AIG_MS_OPERATE", "AIG_CISA_AI_TTX" ], "limit": "Original editorial source-informed teaching and fictional model guidance, with a synthetic paper test/rollback. No publisher key, independent learner marking, live test, release approval, compliance finding or competence validation is implied." }, "status": "covered_intro", "status_label": "INTRODUCTORY MATERIAL SUPPLIED", "href": "workshop-ai05.html", "summary": "A worked permitted/conditional/prohibited-input policy connects data classification, protective handling, provider review and escalation.", "related_section_numbers": [ 16, 17, 19, 20, 21, 22 ], "original_teaching_need": "A worked acceptable-input policy and model/application change-testing case, including escalation of important events.", "original_practice_need": "A reviewed decision on permitted/prohibited input data, protective handling, version/change record, security tests, failure escalation and release/rollback evidence.", "primary_route": "cc", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "AIG_NIST_GENAI", "AIG_NCSC_ASSETS", "AIG_NCSC_DEPLOY", "AIG_NCSC_OPERATE", "AIG_MS_MEASURE_HARMS", "AIG_MS_OPERATE", "AIG_CISA_AI_TTX" ], "component_checks": [ { "component": "Worked permitted/prohibited/conditional input policy", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf", "locator": "Section 2.4 · viewer p.11; GV-1.4-002 · p.19; GV-3.2-003 · p.22" } ] }, { "component": "Protective handling and event escalation", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development", "locator": "Assets/Document" }, { "primary_url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-deployment", "locator": "Incident management / Appropriate use" } ] }, { "component": "Version/change record", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf", "locator": "GV-1.6-003 · viewer p.20" }, { "primary_url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-operation-maintenance", "locator": "Secure updates" } ] }, { "component": "Security tests, predefined gates and blocked release", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://learn.microsoft.com/en-us/training/modules/responsible-ai-studio/4-measure-harms", "locator": "Baseline / three-step measurement / manual and automatic" }, { "primary_url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-deployment", "locator": "Release AI responsibly" } ] }, { "component": "Failure escalation and retest evidence", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-deployment", "locator": "Incident management" }, { "primary_url": "https://www.cisa.gov/sites/default/files/2024-06/June_13_TTX_Plan_508c.pdf", "locator": "Viewer p.3 · Day 4; p.5 · Day 6; p.9 · corresponding questions" } ] }, { "component": "Release/rollback evidence and fallback", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "primary_evidence": [ { "primary_url": "https://learn.microsoft.com/en-us/training/modules/responsible-ai-studio/6-operate-responsibly", "locator": "Pre-release reviews / release and operate" }, { "primary_url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development", "locator": "Known-good state" } ] } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [ "1.1", "5.1", "5.2", "5.4", "5.5" ], "cc_ai_application_ids": [ "AI-D1", "AI-D5" ], "pecb_statement_ids": [ "D1-C08", "D1-C11", "D1-K10", "D1-K12" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-AI05" } }, { "id": "ISO01", "title": "The exact three PECB policy categories", "source_ids": [ "ISOG_PECB_HANDBOOK", "ISOG_PECB_POLICY", "ISOG_ENISA_GUIDE", "ISOG_ISACA_GUIDE" ], "reading_order": [ { "source_id": "ISOG_PECB_HANDBOOK", "read": "Viewer p.9 D2 C5/C6 and K5/K6; p.11 sample 3, without assigning an answer.", "learn": "Recognize what the issuer assesses and which exact definitions remain unavailable." }, { "source_id": "ISOG_PECB_POLICY", "read": "Policy Development, Policy Enforcement and Policy Maturity sections.", "learn": "Connect ownership and approval to communication, daily use, monitoring and review." }, { "source_id": "ISOG_ENISA_GUIDE", "read": "§1.1 GUIDANCE/EVIDENCE, viewer pp.14–16, excluding imported regulatory frequencies.", "learn": "Distinguish an approved policy, evidence of communication, review notes and an authorized revision." } ], "new_free_coverage": [ "A practical policy lifecycle with an owner, approval, controlled publication, understandable communication, implementation, exception handling and review.", "A fictional lifecycle record with editorial model guidance. This develops application without inventing the three-category taxonomy." ], "remaining": [ "Current official definitions, boundaries and contrasting examples for high-level general, high-level specific and topic-specific policies.", "A current issuer classification key and provider clarification of policy-lifecycle terminology." ], "payment_note": "Free lifecycle supplement. The selected PECB course remains paid; use its included definitions/examples/feedback before considering any extra purchase.", "status_reason": "Lifecycle teaching is materially improved; the gap's exact provider-category component remains open.", "worked_example": { "title": "Approve and maintain the booking-export policy", "scenario": "Fictional Example Studio runs a small booking service. Staff export booking records for an approved business purpose. A draft rule exists, but staff keep old copies and one new export feature bypasses the approval workflow. All people, records and systems in this exercise are fictional.", "tasks": [ "Write the sequence from drafting to approved use and review.", "For each stage, name an owner, evidence and a trigger to revisit the policy.", "Explain why a downloaded policy document and an email announcement alone do not establish effective use.", "Leave the handbook's three category labels unclassified until current provider definitions are available." ], "model_answer": [ "Operations Lead owns draft EXP-POL-01. The founder approves its purpose and requirements; the developer checks that the proposed export rule can operate. Record version, approval date, effective date and controlled location.", "Publish the approved version, withdraw superseded copies from normal use, and communicate the rule in a form each role can understand. Ask staff to work through a new export request and record the result.", "Apply the rule in the workflow, record approved exceptions with authority and expiry, and monitor adherence.", "Review after a significant feature change, a finding or staff feedback and at a planned studio review. Record the decision to retain or change it, obtain approval for a revision, then communicate it again.", "This is a supported lifecycle model. It supplies no official answer about which PECB policy category EXP-POL-01 belongs to." ], "self_check": [ "Does the current approved version have a named owner and an effective date?", "Can a staff member find and apply the current rule, rather than merely acknowledge an email?", "Would a feature change or bypass finding lead to a documented review decision?", "Have you avoided presenting a different publisher's taxonomy as PECB's three definitions?" ], "source_ids": [ "ISOG_PECB_POLICY", "ISOG_ENISA_GUIDE", "ISOG_ISACA_GUIDE" ], "limit": "Original editorial scenario and model, without an issuer-approved key or category definitions. Local example timings and record IDs are invented, not ISO mandates." }, "status": "partial", "status_label": "PARTIAL · NEEDS REMAIN", "href": "workshop-iso01.html", "summary": "A practical policy lifecycle with an owner, approval, controlled publication, understandable communication, implementation, exception handling and review.", "related_section_numbers": [ 24 ], "original_teaching_need": "Authoritative definitions, boundaries and contrasting examples for the three named PECB policy categories, plus a policy lifecycle. Labels alone are insufficient.", "original_practice_need": "Official current-course definitions and contrasting examples, plus checked classification of new examples and a policy approval/communication/review sequence.", "primary_route": "pecb", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "ISOG_PECB_HANDBOOK", "ISOG_PECB_POLICY", "ISOG_ENISA_GUIDE", "ISOG_ISACA_GUIDE" ], "component_checks": [ { "component": "Scenario and evidence", "conclusion": "Reviewed; original need remains partial/open.", "scope_note": "Coherent policy-use failure. Missing current copies and a bypass supply meaningful lifecycle triggers without requiring invented PECB category definitions." }, { "component": "All assigned tasks", "conclusion": "Reviewed", "items_checked": 4 }, { "component": "All explained model items", "conclusion": "Reviewed; corrections recorded separately.", "items_checked": 5 }, { "component": "Self-checks", "conclusion": "Reviewed; no learner work assessed.", "items_checked": 4 }, { "component": "Assigned readings", "conclusion": "Public scopes reviewed; full licensed text not checked.", "items_checked": 3 }, { "component": "Unresolved original need", "conclusion": "Current issuer definitions, boundaries, contrasting examples and authorized classification feedback; clarify current policy-lifecycle terminology. More lifecycle prose cannot close the category need." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [ "D2-C05", "D2-C06", "D2-K05", "D2-K06" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-ISO01" } }, { "id": "ISO02", "title": "Context, scope, interested parties and leadership", "source_ids": [ "ISOG_BSI_GUIDE", "ISOG_ISACA_GUIDE", "ISOG_BSI_CHECKLIST", "ISOG_BSI_AMENDMENT", "ISOG_ISO_IAF_CLIMATE" ], "reading_order": [ { "source_id": "ISOG_BSI_GUIDE", "read": "Viewer p.5 clause 4 paragraph and p.6 clause 5 paragraph; skip obsolete vocabulary advice.", "learn": "Move from relevant circumstances and parties to a boundary and management direction." }, { "source_id": "ISOG_ISACA_GUIDE", "read": "§3.1 viewer p.10 and §3.2 pp.11–12 narrative; do not adopt its minimum-documentation checklist wholesale.", "learn": "Describe interfaces, dependencies, business objectives and visible leadership evidence." }, { "source_id": "ISOG_ISO_IAF_CLIMATE", "read": "Viewer p.2 changes/intent and p.3 affected-standard entry.", "learn": "Record a reasoned climate-relevance decision; confirm the provider's amendment scope separately." }, { "source_id": "ISOG_BSI_CHECKLIST", "read": "Viewer p.4 q1–7 only.", "learn": "Use the prompts to inspect the fictional scope and leadership evidence, without using the maturity score." } ], "new_free_coverage": [ "A linked fictional context/party table, scope statement and leadership decisions.", "A bounded amendment exercise that considers relevance to information security rather than assuming a generic climate programme.", "Evidence-based self-checks for scope interfaces and management responsibility." ], "remaining": [ "Complete exact clauses 4–5 and any applicable defined terms, checked against legitimate current standard access.", "Provider clarification of Amendment 1:2024 in the selected course and exam.", "Review of additional new cases with authorized course feedback." ], "payment_note": "These readings and the editorial exercise are free. Selected official PECB course remains paid. Standards access is conditional on legitimate included, employer or library provision; avoid duplicate purchases.", "status_reason": "Free applied introductory coverage is stronger, but the original need includes complete authorized requirements and provider amendment clarification.", "worked_example": { "title": "Create the booking service's context and scope record", "scenario": "Example Studio has four staff, an internally developed booking app, a cloud hosting supplier, staff laptops and one office with printed booking requests. Marketing content production is separate, but it shares staff identities and a supplier. This is the starting state before a later contractor change.", "tasks": [ "Create three context/party rows with an information-security implication and a source the fictional studio would verify.", "Write a scope statement identifying processes, people, locations, information and supplier interfaces.", "Record who directs the ISMS, who manages the export risk and what leadership evidence is needed.", "Discuss whether climate-related disruption could matter and what evidence would support the decision." ], "model_answer": [ "Context/party row 1: customers expect booking records to be protected and usable when needed; verify the fictional contract and service promises before recording precise obligations. Row 2: cloud-hosting dependence can affect availability and access; review the service agreement and shared responsibilities. Row 3: overlapping part-time roles can weaken approval independence; inspect the role assignments.", "Scope draft: management and operation of the booking service, including development, booking records, export/recovery processes, staff and laptops, office handling of printed requests, and interfaces with hosting and identity suppliers. Marketing-content production is excluded as a business process; shared identity and supplier dependencies are still described and controlled.", "The founder sets direction and resources; the Operations Lead owns business consequences of export risk; the developer implements approved technical changes. Example evidence includes the approved policy, assigned authorities, two allocated development days and a decision/follow-up record.", "Investigate office flooding, heat/power dependence and relevant supplier locations. A hypothetical exposure can justify a continuity-risk review, but it is not proof of a local hazard. Record the relevance conclusion and its evidence; ask the provider which amendment material is assessed. Also check whether relevant interested parties have climate-related requirements, verify any actual requirement and identify what will be addressed through the ISMS. Record the finding separately from the climate-relevance decision." ], "self_check": [ "Does the scope explain what happens at every boundary instead of treating outsourcing as disappearance of responsibility?", "Are party expectations distinguished from verified obligations and the requirements addressed through the ISMS?", "Is leadership evidenced by decisions and resources, with clear authority to act?", "Is the climate conclusion supported and specific to the ISMS?" ], "source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_BSI_GUIDE", "ISOG_ISO_IAF_CLIMATE" ], "limit": "Editorial scope/party example, not a complete clause checklist, legal determination, real hazard assessment or certification scope." }, "status": "partial", "status_label": "PARTIAL · NEEDS REMAIN", "href": "workshop-iso02.html", "summary": "A linked fictional context/party table, scope statement and leadership decisions.", "related_section_numbers": [ 23, 24 ], "original_teaching_need": "Complete authorized requirements and coherent examples for context, interested parties, scope, leadership, policy and responsibilities. Confirm amendment coverage with PECB.", "original_practice_need": "An authorised clause-level explanation with a reviewed context/interested-party table, scope boundary and leadership/role evidence; obtain the provider’s amendment-scope clarification.", "primary_route": "pecb", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "ISOG_BSI_GUIDE", "ISOG_ISACA_GUIDE", "ISOG_BSI_CHECKLIST", "ISOG_BSI_AMENDMENT", "ISOG_ISO_IAF_CLIMATE" ], "component_checks": [ { "component": "Scenario and evidence", "conclusion": "Reviewed; original need remains partial/open.", "scope_note": "Four staff, office paper, shared identities and outsourced hosting create useful interfaces. Marketing exclusion is qualified by retained dependencies rather than treating exclusion as removal of risk." }, { "component": "All assigned tasks", "conclusion": "Reviewed", "items_checked": 4 }, { "component": "All explained model items", "conclusion": "Reviewed; corrections recorded separately.", "items_checked": 4 }, { "component": "Self-checks", "conclusion": "Reviewed; no learner work assessed.", "items_checked": 4 }, { "component": "Assigned readings", "conclusion": "Public scopes reviewed; full licensed text not checked.", "items_checked": 4 }, { "component": "Unresolved original need", "conclusion": "Complete legitimate clauses 4–5 review, exact terms and varied cases; current provider amendment-scope clarification. Policy substance is shared with ISO01 and not fully established by this scope exercise." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [ "D1-C04", "D1-C05", "D1-C07", "D1-K05", "D1-K06", "D2-C02", "D2-C03", "D2-C04", "D2-C12", "D2-K02", "D2-K03", "D2-K04", "D2-K12" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-ISO02" } }, { "id": "ISO03", "title": "Risk method, treatment and Statement of Applicability", "source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_BSI_CHECKLIST", "ISOG_ENISA_GUIDE", "ISOG_SGS_CHANGES", "ISOG_ISO27001_LICENSE" ], "reading_order": [ { "source_id": "ISOG_ISACA_GUIDE", "read": "§3.6 viewer pp.15–20: method, criteria, risk owners, treatment and records; selected Appendix 8.1 control references only.", "learn": "Follow one risk from criteria to a treatment decision and reviewable evidence." }, { "source_id": "ISOG_BSI_CHECKLIST", "read": "Viewer p.5 q9–14.", "learn": "Check repeatability, acceptance rules, ownership, Annex A comparison, SoA reasons/status and residual-risk decisions." }, { "source_id": "ISOG_ENISA_GUIDE", "read": "§2.1 viewer pp.22–23 and pp.25–26 GUIDANCE/EVIDENCE on plans, approvals and review; skip suggested legal-risk acceptance examples and imported annual rules.", "learn": "Give the fictional treatment record a role, deadline, evidence and residual-risk decision." }, { "source_id": "ISOG_SGS_CHANGES", "read": "Viewer p.5 6.1.3 comparison row.", "learn": "Use Annex A as a comparison reference; necessary controls can come from elsewhere." } ], "new_free_coverage": [ "A stated illustrative method, acceptance/escalation rules, risk entry, owner, treatment plan and small SoA extract.", "A distinction between planned target residual risk and evidenced risk after implementation.", "Explicit inclusion/exclusion reasoning and a later change that requires reassessment." ], "remaining": [ "Complete exact 6.1 requirements, a complete SoA and justified review of the full Annex A reference set.", "Authorized provider feedback on additional methods, treatment decisions and applicability cases.", "Detailed control purposes/implementation guidance beyond the selected examples." ], "payment_note": "Free examples improve method and decision practice. They do not replace the paid selected PECB course or licensed requirements/control guidance; check included legitimate access first.", "status_reason": "The worked chain fills an applied-teaching gap at introductory level; full normative and control-set coverage remains outside the free supplement.", "worked_example": { "title": "Trace export risk R-01 through treatment and applicability", "scenario": "At the starting state, Example Studio develops the app internally. A broad staff export permission could release the full booking list without business approval. The fictional Operations Lead owns the service impact. A custom approval gate is proposed.", "tasks": [ "Define a simple method before scoring this risk; distinguish likelihood, consequence and acceptance criteria.", "Record cause/event/consequence, current safeguards and the owner.", "Choose treatment, necessary controls and a review date; compare those choices with relevant Annex A references.", "Create a small SoA extract showing reasons, implementation status and a justified provisional exclusion.", "Separate plan approval from later residual-risk acceptance." ], "model_answer": [ "Illustrative method only: likelihood 1 means limited credible exposure, 2 a plausible path and 3 a readily available repeated path; impact 1 minor reversible interruption, 2 significant but limited service harm, 3 full-list disclosure or serious service disruption. Score L×I. Scores 6–9 require prompt treatment/escalation; 3–5 require an explicit owner decision; 1–2 remain recorded and reviewed. These invented thresholds cannot waive an applicable obligation.", "R-01: broad export entitlement plus a missing approval gate permits an inappropriate full-list release, affecting confidentiality and service trust. Existing password login does not control export purpose. Fictional initial L3×I3=9; Operations Lead is the risk owner.", "Treatment T-01: restrict export roles, require prior independent business approval, record export events, and train staff to use the approved route. Developer owns implementation, with two allocated development days and a planned completion date. The organization-defined approval gate is EXP-01; Annex A comparison includes information transfer, access restriction and logging so necessary areas are not overlooked.", "Small SoA extract: A.5.14 information transfer — included because records leave the service; approved process being implemented. A.8.3 information access restriction — included because broad export privilege drives R-01; configuration/test evidence pending. A.8.15 logging — included for reviewable export events; planned until operating evidence exists. A.8.30 outsourced development — provisionally excluded at this starting date because all custom development is internal and the hosting supplier does not develop the app; reconsider if that fact changes. These four rows are not a complete SoA. State how EXP-01 is represented: in this extract it is an implementation mechanism linked to the included transfer/access controls. If the studio instead designates an additional necessary control outside the reference set, give it its own applicability entry with inclusion justification and actual implementation status. A local mechanism does not automatically require duplicate control rows.", "Target residual L1×I3=3 is a forecast. The risk owner approves T-01 now, then reviews test/operating evidence and explicitly accepts or escalates the evidenced residual risk under the criteria. Never mark a planned control implemented or a target score achieved merely because it was written down." ], "self_check": [ "Can another learner apply the stated scale consistently and identify an assumption that would change the score?", "Can every treatment and SoA row be traced to a risk, obligation or other justified need?", "Do rows include reasons and actual status, with justified Annex A exclusions?", "Is the provisional A.8.30 decision revisited in ISO05 when a contractor is introduced?", "Is residual-risk acceptance an accountable decision based on evidence, separate from approving the work plan?" ], "source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_BSI_CHECKLIST", "ISOG_ENISA_GUIDE", "ISOG_SGS_CHANGES" ], "limit": "Original editorial scoring and four-row extract. It does not reproduce a normative assessment method, all required SoA content, all 93 controls or an official examination answer." }, "status": "partial", "status_label": "PARTIAL · NEEDS REMAIN", "href": "workshop-iso03.html", "summary": "A stated illustrative method, acceptance/escalation rules, risk entry, owner, treatment plan and small SoA extract.", "related_section_numbers": [ 25 ], "original_teaching_need": "A worked chain from criteria and assessment to treatment, necessary controls, Annex A comparison, Statement of Applicability and risk-owner decisions.", "original_practice_need": "A reviewed assessment-method description, a worked risk entry/treatment plan and linked SoA reasoning, including why selected controls are necessary and how risk owners approve relevant decisions.", "primary_route": "pecb", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_BSI_CHECKLIST", "ISOG_ENISA_GUIDE", "ISOG_SGS_CHANGES", "ISOG_ISO27001_LICENSE" ], "component_checks": [ { "component": "Scenario and evidence", "conclusion": "Reviewed; original need remains partial/open.", "scope_note": "Broad export permission, absent business approval and a business consequence form a coherent fictional risk. Internal development supports only a provisional, fact-specific A.8.30 exclusion." }, { "component": "All assigned tasks", "conclusion": "Reviewed", "items_checked": 5 }, { "component": "All explained model items", "conclusion": "Reviewed; corrections recorded separately.", "items_checked": 5 }, { "component": "Self-checks", "conclusion": "Reviewed; no learner work assessed.", "items_checked": 5 }, { "component": "Assigned readings", "conclusion": "Public scopes reviewed; full licensed text not checked.", "items_checked": 4 }, { "component": "Unresolved original need", "conclusion": "Complete 6.1 including general risks/opportunities, reproducible assessment requirements, comparison of method-selection criteria and treatment options, all necessary controls, full 93-reference comparison and SoA content. No full-text conformance checked." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [ "D1-C05", "D1-C09", "D1-C10", "D1-K06", "D1-K09", "D1-K11", "D2-C07", "D2-C08", "D2-C09", "D2-C10", "D2-K07", "D2-K08", "D2-K09", "D2-K10" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-ISO03" } }, { "id": "ISO04", "title": "Objectives, support and documented information", "source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_BSI_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_BSI_CHECKLIST", "ISOG_SGS_CHANGES" ], "reading_order": [ { "source_id": "ISOG_ISACA_GUIDE", "read": "§3.3 viewer pp.12–13; §3.5 pp.14–15 competence discussion; §3.8 pp.22–23 document-control narrative; §3.9 p.24 communication example.", "learn": "Connect an objective to actions, resources, evidence of ability and controlled usable information. Skip obsolete subclause letters and the erroneous 10.1 references." }, { "source_id": "ISOG_ENISA_GUIDE", "read": "§8.2 viewer pp.114–115 GUIDANCE/EVIDENCE on role-specific learning and assessing its effect.", "learn": "Design a paper task that demonstrates ability, beyond attendance or acknowledgement." }, { "source_id": "ISOG_SGS_CHANGES", "read": "Viewer p.3 6.2, 6.3 and 7.4 rows.", "learn": "Notice that objective monitoring and planned change matter; old communication subclause letters cannot be copied into a 2022 checklist." }, { "source_id": "ISOG_BSI_CHECKLIST", "read": "Viewer pp.5–6 q15–19.", "learn": "Inspect the objective, resources, role preparation and information/communication arrangements." } ], "new_free_coverage": [ "A complete fictional objective/action/measurement record with role and resources.", "A competence task, targeted communication plan and controlled-document example.", "A distinction between the desired result, an implementation action, a measurement result and evidence of ability." ], "remaining": [ "Complete exact requirements of 6.2–6.3 and clause 7; exact required documented information must be checked against legitimate current text.", "Provider review of varied objectives, competence and document-control cases.", "Complete treatment of change planning, externally sourced information and retention/disposition for the particular scope." ], "payment_note": "All assigned guidance and this exercise are free. The selected PECB course and its activities remain paid; required standards access may already be included or otherwise legitimately available.", "status_reason": "Applied objective/support practice is now concrete; complete authorized clause-level requirements and provider feedback are still needed.", "worked_example": { "title": "Turn export protection into an objective and usable working information", "scenario": "T-01 addresses R-01 by changing export permissions and approvals. Example Studio's founder has allocated two developer days and one staff briefing. Staff currently use inconsistent copies of the export instructions.", "tasks": [ "State an objective, target, owner, action, resources, deadline and evaluation method.", "Define a role-specific competence task and acceptable evidence.", "Write one communication-plan row and one controlled-document row.", "Explain how a change to the export process is planned and approved." ], "model_answer": [ "Objective O-01: after the studio's agreed implementation date, every booking CSV export has a recorded independent business approval before release. Target 100% during the next monthly review period. Operations Lead owns the result; developer configures the approval gate using two allocated days; staff briefing precedes release. Compare timestamped export events with the approval register, using a clearly defined total-export population.", "The implementation action is introducing the gate; the intended result is preventing release without approval. Report both operating effectiveness and useful limitations rather than treating 'feature installed' as objective achievement.", "Competence example: a staff member receives an unfamiliar fictional urgent-export request, checks the recipient/purpose, refuses an unapproved release, routes it for approval and identifies the evidence to retain. A reviewer records what was observed and any needed follow-up. Attendance alone does not establish this ability. Separately check awareness: the person explains the current policy, their contribution to ISMS effectiveness and what can follow from not meeting the requirements. Correct task performance and these explanations provide different evidence.", "Communication row: Operations Lead explains the revised export rule to staff before the effective date, through a briefing and controlled instructions, with questions and a short demonstration. Record what, audience, timing and method; assigning a sender is a practical studio choice, not a copied obsolete 7.4(d) requirement.", "Document row: EXP-WI-01, version 1.0, owner Operations Lead, approver founder, effective date and controlled location. Restrict editing, keep authorized access available, protect the change history, remove obsolete copies from ordinary use, and apply the studio's justified retention rule. No universal retention duration is invented.", "Change C-00 must identify effects on the objective, risk, responsibilities, instructions, training and tests before approval. A revised document is reviewed and reissued before the new workflow becomes normal practice." ], "self_check": [ "Is the objective a result relevant to the risk, with an evaluation method and adequate resources?", "Are the numerator, denominator and approval timing unambiguous?", "Does competence evidence show correct performance on a new task?", "Can a staff member retrieve the approved current instruction?", "Are local roles, deadlines and retention choices clearly distinguished from ISO requirements?" ], "source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_BSI_GUIDE", "ISOG_SGS_CHANGES" ], "limit": "Editorial planning and records, not a complete 6.2/6.3/7 checklist. A single observed task does not prove every competence requirement." }, "status": "partial", "status_label": "PARTIAL · NEEDS REMAIN", "href": "workshop-iso04.html", "summary": "A complete fictional objective/action/measurement record with role and resources.", "related_section_numbers": [ 6, 8, 26 ], "original_teaching_need": "Authorized requirements and applied examples for objectives/change planning, resources, competence, awareness, communication and controlled information.", "original_practice_need": "A reviewed objective/action/measure record, competence evidence and communication/document-control example, each tied to the applicable requirement.", "primary_route": "pecb", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_BSI_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_BSI_CHECKLIST", "ISOG_SGS_CHANGES" ], "component_checks": [ { "component": "Scenario and evidence", "conclusion": "Reviewed; original need remains partial/open.", "scope_note": "Result,implementation action and controlled working information are sensibly connected. Two allocated developer days are an example resource decision, not proof of adequacy." }, { "component": "All assigned tasks", "conclusion": "Reviewed", "items_checked": 4 }, { "component": "All explained model items", "conclusion": "Reviewed; corrections recorded separately.", "items_checked": 6 }, { "component": "Self-checks", "conclusion": "Reviewed; no learner work assessed.", "items_checked": 5 }, { "component": "Assigned readings", "conclusion": "Public scopes reviewed; full licensed text not checked.", "items_checked": 4 }, { "component": "Unresolved original need", "conclusion": "Full current requirements of 6.2–6.3 and clause 7, externally sourced documented information, retention/disposition, varied resource/communication cases and authorized feedback remain. A brief awareness application is now supplied separately from competence; that does not complete clause 7 coverage." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [ "D1-C04", "D1-C05", "D1-K05", "D1-K06", "D2-C01", "D2-C11", "D2-C12", "D2-C13", "D2-C14", "D2-K01", "D2-K11", "D2-K12", "D2-K13", "D2-K14" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-ISO04" } }, { "id": "ISO05", "title": "Operational planning, control and reassessment", "source_ids": [ "ISOG_BSI_GUIDE", "ISOG_ISACA_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_BSI_CHECKLIST", "ISOG_SGS_CHANGES" ], "reading_order": [ { "source_id": "ISOG_BSI_GUIDE", "read": "Viewer p.7 clause 8 overview only.", "learn": "Connect planned criteria and controls to actual operation, external services, changes, risk reassessment and retained results." }, { "source_id": "ISOG_SGS_CHANGES", "read": "Viewer p.3 8.1 row and p.5 externally provided processes/products/services comparison.", "learn": "Include relevant supplier interfaces and process criteria; outsourcing does not remove the need to control them." }, { "source_id": "ISOG_ENISA_GUIDE", "read": "§6.4 viewer pp.86–87 GUIDANCE/EVIDENCE; §2.1.4 viewer p.26 review triggers, excluding imported annual frequency.", "learn": "Distinguish a change request, risk assessment, test plan, observed test result, approval and rollback record." }, { "source_id": "ISOG_BSI_CHECKLIST", "read": "Viewer p.6 q20–23.", "learn": "Check whether intended processes actually operate and whether change/reassessment evidence exists." } ], "new_free_coverage": [ "A continuing case introduces an external developer and a change to the export path.", "The learner identifies criteria, pre-release tests, rollback, reassessment and the records that show what actually happened.", "A concrete applicability decision is revisited instead of remaining a permanent N/A label." ], "remaining": [ "Complete clause 8 requirements and exact required records, checked against legitimate current text.", "Authorized feedback on additional planned/unintended change cases and risk-trigger decisions.", "Real operational capability is outside a fictional paper exercise." ], "payment_note": "Free operational case and source readings. Official PECB course remains the selected paid route; no extra commercial tool, provider or practical lab purchase is implied.", "status_reason": "A worked operation/reassessment chain is supplied; the need for complete authorized requirements and course feedback is retained.", "worked_example": { "title": "Assess and record a new contractor-built export feature", "scenario": "Example Studio now engages a contractor to add a bulk-export feature. The business objective and EXP-POL-01 approval rule still apply. This changes the earlier fact behind the provisional exclusion of A.8.30. Work through this as a paper case using fictional records.", "tasks": [ "Create change record C-01 with scope, owner, risk, acceptance criteria and approval.", "Reassess R-01, the treatment plan and the relevant SoA decisions.", "Specify tests and a rollback decision; distinguish planned tests from results.", "List the records to keep after the change and in normal operation." ], "model_answer": [ "C-01 identifies contractor access, new export routes, affected booking information, developer responsibility and Operations Lead approval. Acceptance criteria include no export without a valid prior independent approval, least necessary contractor access, and a traceable export event.", "Reassess R-01 because a new path and third-party access can change likelihood and safeguards. Revisit treatment, approval/monitoring responsibilities and residual-risk decisions. Reclassify A.8.30 as included for contractor development with a justified scope and actual implementation status; cloud hosting alone was not the earlier reason for exclusion.", "Paper tests include an approved request, an unapproved direct request, an expired approval and a contractor trying an unauthorized export. Record expected and observed outcomes separately. A signed plan is not evidence that a test passed.", "If the unapproved direct request succeeds, the acceptance criterion fails: withhold normal release or disable the feature, remove unnecessary contractor access and restore the prior approved configuration under the studio's change procedure. Record the consequence and decision instead of silently accepting it.", "Retain the approved change, reassessment, revised treatment/SoA versions, supplier responsibilities, test results, release/rollback decision and operational approval/event records. Review at the planned studio interval and when significant change or evidence calls the assumptions into question." ], "self_check": [ "Are operational criteria specific enough to decide pass or fail?", "Did the contractor change trigger a reasoned update to both risk and applicability?", "Can every claimed operating result be backed by an observed record?", "Is there a usable response to an unintended consequence or failed test?", "Does the exercise keep decision evidence separate from merely completing a checklist?" ], "source_ids": [ "ISOG_ENISA_GUIDE", "ISOG_SGS_CHANGES", "ISOG_BSI_GUIDE", "ISOG_ISACA_GUIDE" ], "limit": "Editorial paper operation case; no real system was tested and no operating conformity is claimed. Studio test criteria and workflows are local example choices." }, "status": "partial", "status_label": "PARTIAL · NEEDS REMAIN", "href": "workshop-iso05.html", "summary": "A continuing case introduces an external developer and a change to the export path.", "related_section_numbers": [ 26 ], "original_teaching_need": "A worked operation case covering criteria, controls, changes, reassessment, treatment and retained evidence.", "original_practice_need": "An authorised explanation plus a reviewed operational example showing criteria, responsibilities, a change/trigger, reassessment/treatment and the appropriate retained record.", "primary_route": "pecb", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "ISOG_BSI_GUIDE", "ISOG_ISACA_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_BSI_CHECKLIST", "ISOG_SGS_CHANGES" ], "component_checks": [ { "component": "Scenario and evidence", "conclusion": "Reviewed; original need remains partial/open.", "scope_note": "The later contractor and bulk-export route materially change the prior internal-development facts. The continuation now uses the repaired ISO04 change identifiers: initial release C-00 and contractor change C-01." }, { "component": "All assigned tasks", "conclusion": "Reviewed", "items_checked": 4 }, { "component": "All explained model items", "conclusion": "Reviewed; corrections recorded separately.", "items_checked": 5 }, { "component": "Self-checks", "conclusion": "Reviewed; no learner work assessed.", "items_checked": 5 }, { "component": "Assigned readings", "conclusion": "Public scopes reviewed; full licensed text not checked.", "items_checked": 4 }, { "component": "Unresolved original need", "conclusion": "Complete 8.1–8.3, planned interval and significant-change reassessment, externally provided relevant services, unintended changes and exact records; fresh cases/provider feedback." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [ "D1-C04", "D1-C05", "D1-K05", "D1-K06", "D2-C15", "D2-K15" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-ISO05" } }, { "id": "ISO06", "title": "Monitoring, internal audit and management review", "source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_BSI_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_APG_DOCUMENT", "ISOG_BSI_CHECKLIST", "ISOG_SGS_CHANGES" ], "reading_order": [ { "source_id": "ISOG_ISACA_GUIDE", "read": "§3.7 viewer pp.20–22 on useful measures; §3.12 pp.30–33 selected programme/evidence/impartiality narrative; §3.2 p.12 management decisions and records.", "learn": "Separate a measure, an audit programme, an audit finding and management decisions. Skip obsolete 9.2 letter labels and fixed three-year cycle wording." }, { "source_id": "ISOG_ENISA_GUIDE", "read": "§7 viewer pp.108–110 and §2.3 pp.29–31 selected guidance/evidence only.", "learn": "Record who measures/evaluates, assess reviewer impartiality and report findings with traceable follow-up." }, { "source_id": "ISOG_APG_DOCUMENT", "read": "Viewer p.1 three-part finding list and p.2 opening two paragraphs.", "learn": "Describe verified failure of a specific applicable criterion." }, { "source_id": "ISOG_SGS_CHANGES", "read": "Viewer pp.2 and 4 review structure/input-change rows.", "learn": "Notice 9.3.2 inputs and 9.3.3 results; the abbreviated table is not the complete review checklist." } ], "new_free_coverage": [ "A reproducible 12/15 approval measure with data limits.", "A risk-prioritized audit item, impartial reviewer, criterion/evidence/failure finding and management-review decision record.", "A distinction between a useful review pack and the full normative input/output list." ], "remaining": [ "Complete exact 9.1–9.3 requirements, including all current management-review inputs/results.", "Provider feedback on audit-programme design, findings and varied review records.", "Broader evidence for the whole ISMS; one export measure is not a system-wide effectiveness conclusion." ], "payment_note": "Free readings and editorial evidence case. Complete selected paid PECB activities; legitimate licensed standards access may be included or otherwise available.", "status_reason": "Concrete monitoring/audit/review work is supplied; exact current requirements and complete system-level coverage remain.", "worked_example": { "title": "Evaluate export performance and decide what management should do", "scenario": "In a fictional review period after C-01, the complete export log contains 15 booking CSV exports. Twelve have a valid prior independent approval. Exports E-07, E-09 and E-12 have none. EXP-POL-01 v1.0 was effective before all 15 events. No conclusion about disclosure to unauthorized outsiders has yet been established. The team did not carry out every test recommended in ISO05; assess the actual records, not the ideal model.", "tasks": [ "Calculate the measure and explain what it proves and what it does not.", "Plan a focused internal-audit item, including scope, criterion, method and reviewer impartiality.", "Write a finding separating requirement, evidence and statement.", "Prepare a concise management-review pack and record decisions, owners and follow-up." ], "model_answer": [ "M-01 = exports with valid prior approval / all booking CSV exports in the defined period = 12/15 = 80%. This is below the fictional 100% objective. Preserve the period, population, data sources and matching rule. The result demonstrates three approval failures in this population; it does not establish breach impact or overall ISMS effectiveness. In this fictional monthly record, the developer extracts the defined period’s complete export events and the Operations Lead matches approvals at period end; the competent reviewer checks the matching and analysis before the scheduled management review. Record the actual dates, responsible people and evaluation decision. These are studio choices, not universal prescribed intervals.", "The audit programme prioritizes the recently changed, high-risk export process. Audit scope covers all export routes and approval records for the period. A reviewer with relevant audit/process competence who did not build or operate the workflow compares event timestamps, approvals and role configuration. Record competence and conflicts rather than assuming an outsider is automatically impartial.", "Criterion: EXP-POL-01 v1.0 requires independent approval before every booking CSV export. Evidence: E-07, E-09 and E-12 occurred after the effective date without a corresponding prior approval in the complete register. Finding: the export approval process did not operate as required for these three events. Root cause and incident impact are investigated separately.", "Introductory review pack: objective result and limitations, the verified finding, prior-action status, changes affecting scope/parties/risks, treatment status, relevant feedback and improvement options. This pack is illustrative, not the full ISO 9.3.2 list.", "Management records a decision to investigate and correct the bypass, allocates two developer days, assigns an owner and deadline, and schedules an effectiveness review after the next operating period. Retain reasons, decisions, unresolved risks and action follow-up; minutes alone do not show that every required input was considered." ], "self_check": [ "Can a second learner reproduce 80% from the stated population and timing rule?", "Is a missing approval distinguished from proven unauthorized disclosure?", "Is reviewer competence and impartiality addressed?", "Does the finding establish a failed requirement without guessing its cause?", "Do review outputs say who will do what and when, with later evidence?" ], "source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_APG_DOCUMENT", "ISOG_BSI_GUIDE", "ISOG_SGS_CHANGES" ], "limit": "Editorial audit and review practice, without certification findings, an audit qualification or complete clause 9 checklist. No official answer key or readiness score." }, "status": "partial", "status_label": "PARTIAL · NEEDS REMAIN", "href": "workshop-iso06.html", "summary": "A reproducible 12/15 approval measure with data limits.", "related_section_numbers": [ 8, 27 ], "original_teaching_need": "Exact current requirements and applied examples for measures, internal-audit programmes/findings and management-review inputs/outputs.", "original_practice_need": "A reviewed measure, audit finding linked to criteria/evidence, and management-review record distinguishing required inputs, decisions/actions and retained results.", "primary_route": "pecb", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_BSI_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_APG_DOCUMENT", "ISOG_BSI_CHECKLIST", "ISOG_SGS_CHANGES" ], "component_checks": [ { "component": "Scenario and evidence", "conclusion": "Reviewed; original need remains partial/open.", "scope_note": "The complete 15-export population, three named failures, an effective criterion and unknown disclosure impact make a defensible evidence case. Earlier ideal tests are explicitly not assumed performed." }, { "component": "All assigned tasks", "conclusion": "Reviewed", "items_checked": 4 }, { "component": "All explained model items", "conclusion": "Reviewed; corrections recorded separately.", "items_checked": 5 }, { "component": "Self-checks", "conclusion": "Reviewed; no learner work assessed.", "items_checked": 5 }, { "component": "Assigned readings", "conclusion": "Public scopes reviewed; full licensed text not checked.", "items_checked": 4 }, { "component": "Unresolved original need", "conclusion": "Full9.1–9.3, separate monitoring/measurement/analysis/evaluation definitions,who/when,programme requirements,internal/external audit distinction,all current review inputs/results; varied cases and authorized feedback." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [ "D1-C04", "D1-C05", "D1-K05", "D1-K06", "D1-K07", "D2-C16", "D2-C17", "D2-C19", "D2-K16", "D2-K17", "D2-K19" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-ISO06" } }, { "id": "ISO07", "title": "Nonconformity, corrective action and improvement", "source_ids": [ "ISOG_APG_DOCUMENT", "ISOG_APG_CLOSE", "ISOG_ISACA_GUIDE", "ISOG_BSI_GUIDE", "ISOG_SGS_CHANGES" ], "reading_order": [ { "source_id": "ISOG_SGS_CHANGES", "read": "Viewer p.2 switched-subclause table.", "learn": "Keep 2022 continual improvement 10.1 separate from nonconformity/corrective action 10.2." }, { "source_id": "ISOG_APG_DOCUMENT", "read": "Selected evidence/requirement/finding passages and blank report structure in viewer pp.1–4.", "learn": "Make a defensible fictional finding and an auditable action/effectiveness record." }, { "source_id": "ISOG_APG_CLOSE", "read": "Viewer p.2 definitions and cause paragraph; p.3 first three paragraphs after the table; p.4 Closing paragraphs only.", "learn": "Investigate contributing causes and require result evidence before closing a finding." }, { "source_id": "ISOG_ISACA_GUIDE", "read": "§3.14 viewer pp.36–37 concept narrative, excluding its incorrect 10.1 references.", "learn": "Connect a local repair to wider management-system improvement and tracked follow-up." } ], "new_free_coverage": [ "An ISMS case continues the same export finding through containment/correction, verified causes, action and effectiveness.", "A model explains why backdating approval, blaming staff or recording training completion is insufficient.", "A wider change to release checking demonstrates improvement beyond fixing the single instance." ], "remaining": [ "Complete authorized 10.1/10.2 requirements and provider interpretation/feedback on varied action plans.", "Additional fresh cases in which correction, cause evaluation, needed action and effective closure differ.", "Evidence of real operation is outside this paper case." ], "payment_note": "Free concept teaching and original worked case. The selected official PECB course remains paid; no separate corrective-action software or extra course purchase is assumed.", "status_reason": "The missing applied chain is supplied at introductory level; exact requirements and authorized feedback remain.", "worked_example": { "title": "Investigate the approval bypass and test effectiveness", "scenario": "Continue ISO06's finding: three exports lack required prior approval. Fictional investigation later confirms that a newly introduced direct endpoint bypasses the approval check. The acceptance tests covered the screen button but not this direct route; the documented release procedure did not require testing alternate paths.", "tasks": [ "State what can be corrected now and what cannot be retrospectively corrected.", "Separate a suspected cause from a confirmed cause and identify the evidence needed.", "Choose proportionate cause-based actions, owners and an effectiveness test.", "Explain the resulting ISMS improvement and the correct 2022 clause distinction." ], "model_answer": [ "Control further exposure by disabling the bypass under the change procedure, investigate the three exports and deal with confirmed consequences. Preserve truthful records. Do not backdate approval or pretend a historical release had prior approval. Record what was contained, corrected and still unresolved.", "Hypotheses include staff misunderstanding, incorrect privileges and a bypass route. In this fictional case, endpoint behavior and the test records confirm the route and test-design gap. Until checked, a hypothesis remains possible rather than a declared root cause.", "Developer adds server-side approval enforcement across export paths and negative tests for direct requests; Operations Lead updates release acceptance criteria and staff instructions where needed. Search for similar bypasses elsewhere in the scope. Training supports the change when relevant; it does not replace fixing the confirmed design/process cause.", "After implementation, an impartial reviewer checks all of the next 30 fictional exports over the chosen operating period against valid prior approvals and verifies that unapproved alternate-path requests are denied. Keep the records and evaluate any exceptions. Zero failures in this limited period supports effectiveness for the tested conditions; it cannot prove failure will never recur.", "Management checks whether the release/testing process now consistently catches the class of problem and whether the risk/SoA/objective records need revision. Tracking this wider change supports continual improvement under 10.1; handling the specific nonconformity and corrective action relates to 10.2. Reopen or extend action if evidence is inadequate." ], "self_check": [ "Are the historical failure and its consequences recorded honestly?", "Is each action tied to a confirmed cause or an explicitly unresolved hypothesis?", "Does the check test operating results and prevention of recurrence rather than merely action completion?", "Have similar potential failures been considered?", "Are the correct 2022 numbers used without copying the guide's old references?" ], "source_ids": [ "ISOG_APG_DOCUMENT", "ISOG_APG_CLOSE", "ISOG_ISACA_GUIDE", "ISOG_SGS_CHANGES", "ISOG_BSI_GUIDE" ], "limit": "Original editorial model, not official PECB feedback or full normative requirements. The chosen 30-event review and timings are fictional local criteria, not prescribed ISO sampling rules." }, "status": "partial", "status_label": "PARTIAL · NEEDS REMAIN", "href": "workshop-iso07.html", "summary": "An ISMS case continues the same export finding through containment/correction, verified causes, action and effectiveness.", "related_section_numbers": [ 28 ], "original_teaching_need": "An ISMS case distinguishing correction, cause evaluation, corrective action, effectiveness and continual improvement. Corrective action is clause 10.2 in ISO 27001:2022.", "original_practice_need": "A checked nonconformity/correction/cause/action record, an effectiveness decision with evidence, and an explanation of how the ISMS is improved.", "primary_route": "pecb", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "ISOG_APG_DOCUMENT", "ISOG_APG_CLOSE", "ISOG_ISACA_GUIDE", "ISOG_BSI_GUIDE", "ISOG_SGS_CHANGES" ], "component_checks": [ { "component": "Scenario and evidence", "conclusion": "Reviewed; original need remains partial/open.", "scope_note": "Confirmed alternate endpoint and test-design omission supply evidence-based causes, rather than asserting all failures are staff error." }, { "component": "All assigned tasks", "conclusion": "Reviewed", "items_checked": 4 }, { "component": "All explained model items", "conclusion": "Reviewed; corrections recorded separately.", "items_checked": 5 }, { "component": "Self-checks", "conclusion": "Reviewed; no learner work assessed.", "items_checked": 5 }, { "component": "Assigned readings", "conclusion": "Public scopes reviewed; full licensed text not checked.", "items_checked": 4 }, { "component": "Unresolved original need", "conclusion": "Complete 10.1/10.2, proportionality/need evaluation, fresh differing cases and authorized feedback; actual operating evidence is outside paper work." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [ "D1-C04", "D1-C05", "D1-K05", "D1-K06", "D1-K07", "D2-C18", "D2-C20", "D2-K18", "D2-K20" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-ISO07" } }, { "id": "ISO08", "title": "Annex A control purposes, functions and applicability", "source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_SGS_CHANGES", "ISOG_PECB_POLICY", "ISOG_ISO27002_LICENSE" ], "reading_order": [ { "source_id": "ISOG_SGS_CHANGES", "read": "Viewer p.4 Annex A/27002 distinction and p.5 possible-controls comparison.", "learn": "Distinguish the reference list from detailed control purposes/attributes and recognize that additional controls can be needed." }, { "source_id": "ISOG_ISACA_GUIDE", "read": "Appendix 8.1 viewer pp.44–46, only the selected references used in the exercise; §3.4 and §3.6 selected policy/risk discussion.", "learn": "Locate examples across the four 2022 themes, then justify their use from the fictional scope and risk." }, { "source_id": "ISOG_ENISA_GUIDE", "read": "Only the GUIDANCE/EVIDENCE selected for policy, role training, access reviews and physical protection: §§1.1, 8.2, 11.2, 13.2/13.3.", "learn": "Name concrete operating evidence. The NIS2 mappings do not establish complete ISO control coverage." }, { "source_id": "ISOG_PECB_POLICY", "read": "Policy Enforcement paragraph on preventive, detective and corrective controls.", "learn": "Discuss a control's intended function in context without assuming one exclusive label or reproducing 27002 attributes." } ], "new_free_coverage": [ "Selected examples span organizational, people, physical and technological controls.", "Each example has a risk-related purpose, evidence and a provisional function discussion.", "A before/after applicability decision illustrates how a factual change can invalidate a previous exclusion." ], "remaining": [ "Authorized purpose, function, applicability and implementation teaching across the complete 93-control reference set at the selected Foundation depth.", "Complete SoA comparison and justifications; the short example matrix is not the full control set.", "Exact 27002 control attributes and provider classification expectations with authorized feedback." ], "payment_note": "Selected guidance/examples are free. Full licensed control guidance and the selected paid PECB course are not replaced; first confirm legitimate standards access and control activities already included in the package.", "status_reason": "Four-theme introductory practice is improved, but a small matrix cannot close the full control-level teaching need.", "worked_example": { "title": "Explain why each selected control belongs in the booking-service case", "scenario": "Use Example Studio after the contractor-built feature is introduced. The service still has staff laptops, a small office and printed booking requests; outsourcing some development does not remove those information flows.", "tasks": [ "For one example in each theme, state the problem addressed, intended function, implementation idea and evidence.", "Explain the difference between an Annex A reference, the detailed control guidance and a studio-specific control.", "Review the old outsourced-development exclusion and avoid blanket exclusions caused by cloud hosting.", "Identify what is still needed to review the complete Annex A set." ], "model_answer": [ "Organizational example A.5.14 information transfer: booking data leaves the service, so recipient/purpose approval and protected transfer are justified. In this case the approval gate aims to prevent inappropriate release; evidence includes approved requests and transfer records.", "People example A.6.3 awareness, education and training: staff must recognize and route an export request correctly. Use role-relevant practice with observed results and follow-up. In this scenario it mainly supports prevention, while also enabling detection/reporting.", "Physical example A.7.7 clear desk and clear screen: printed requests and displayed booking records can be seen by an unauthorized visitor. Use appropriate storage and screen handling, then inspect whether the fictional rule is followed. Cloud hosting does not remove office information exposure.", "Technological examples A.8.3 information access restriction and A.8.15 logging: a server-side permission/approval check aims to prevent release, while export-event review helps detect a bypass. A rollback or access-removal mechanism can help correct an adverse state; the label does not itself prove cause-based corrective action.", "EXP-01 is the studio-defined approval mechanism; Annex A comparison helps check relevant control areas, and 27002 supplies deeper control guidance. A control can serve more than one function depending on its design and use.", "A.8.30 outsourced development was provisionally excluded while all development was internal. It now needs inclusion/review because the contractor changes that fact. Provider-hosted infrastructure and contractor development are different dependencies. Record the actual status and evidence of supplier responsibilities.", "Extend the comparison across the remaining Annex A reference set using authorized material, justify each relevant inclusion/exclusion and record necessary additional controls. Do not extrapolate completeness from these selected rows." ], "self_check": [ "Can each example be tied to an actual fictional information flow, risk or obligation?", "Are purpose, function and operating evidence distinct?", "Are all four themes represented without presenting them as a complete course?", "Is supplier delivery distinguished from control non-applicability?", "Is a functional 'corrective' label kept separate from the cause-removing corrective-action process?" ], "source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_SGS_CHANGES", "ISOG_PECB_POLICY" ], "limit": "Original editorial theme/function examples; not all 93 controls, complete 27002 attributes, a complete SoA or a publisher-approved taxonomy/key." }, "status": "partial", "status_label": "PARTIAL · NEEDS REMAIN", "href": "workshop-iso08.html", "summary": "Selected examples span organizational, people, physical and technological controls.", "related_section_numbers": [ 25 ], "original_teaching_need": "Authorized control-level teaching across the four 2022 themes, with purposes, functions and applicability at Foundation depth. A few examples are not a complete 93-control course.", "original_practice_need": "Course/authorised control explanations and checked examples spanning organisational, people, physical and technological controls, with justified inclusion/exclusion and function distinctions.", "primary_route": "pecb", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "ISOG_ISACA_GUIDE", "ISOG_ENISA_GUIDE", "ISOG_SGS_CHANGES", "ISOG_PECB_POLICY", "ISOG_ISO27002_LICENSE" ], "component_checks": [ { "component": "Scenario and evidence", "conclusion": "Reviewed; original need remains partial/open.", "scope_note": "Office,paper,staff devices and contractor context prevents blanket cloud exclusions and links controls to real fictional flows." }, { "component": "All assigned tasks", "conclusion": "Reviewed", "items_checked": 4 }, { "component": "All explained model items", "conclusion": "Reviewed; corrections recorded separately.", "items_checked": 7 }, { "component": "Self-checks", "conclusion": "Reviewed; no learner work assessed.", "items_checked": 5 }, { "component": "Assigned readings", "conclusion": "Public scopes reviewed; full licensed text not checked.", "items_checked": 4 }, { "component": "Unresolved original need", "conclusion": "Full 93-reference learning/application at actual Foundation depth, complete SoA and provider expectations/feedback. Do not turn this into an unsupported claim that buying/memorizing every ISO/IEC 27002 implementation detail is mandatory for the exam." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [ "D2-K21", "D2-K22" ], "scope_role": "selected_introductory_application", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-ISO08" } }, { "id": "ISO09", "title": "Official selected-route course and its activities", "source_ids": [ "ISOG_PECB_HANDBOOK", "ISOG_PECB_COURSE", "ISOG_PECB_ELEARNING" ], "reading_order": [ { "source_id": "ISOG_PECB_HANDBOOK", "read": "Viewer pp.5 and 12 course/award prerequisites; administrative rules relevant to the chosen delivery.", "learn": "Separate introductory reading from compulsory official-course completion, assessment and application." }, { "source_id": "ISOG_PECB_COURSE", "read": "Educational approach, certificate requirements and general information.", "learn": "Identify included activities and confirm the exact award/package." }, { "source_id": "ISOG_PECB_ELEARNING", "read": "How the eLearning experience works, quizzes, agenda and material-access paragraphs.", "learn": "Prepare specific questions about included materials and feedback without enrolling or making a purchase here." } ], "new_free_coverage": [ "Free official orientation makes the paid requirement explicit.", "A package-checking exercise helps avoid duplicating exam/application or standards purchases." ], "remaining": [ "Complete the required official PECB Foundation course and its activities through the selected authorized route.", "Obtain actual provider materials, included practice, feedback and exact standards-access arrangements.", "Complete the separate assessment and application under current issuer rules." ], "payment_note": "OPEN / PAID SELECTED ROUTE. Current handbook requires the official course; free reading cannot satisfy this requirement. Public course information describes exam/certificate fees as included in training. Confirm the total written package, access period, language, keys/feedback and retake conditions before paying; no purchase was made. The current handbook gives a 12-month completion/application cycle from instructor-led course completion, or from purchase for self-study/eLearning. Record that trigger date. Its standalone exam $500 and certificate $200 figures must not be added automatically to a paid partner-training package that includes the course, first attempt, first retake and certificate application. Confirm the actual offer and current terms.", "status_reason": "This is a programme requirement, not a missing public reading that supplementary materials can fulfill.", "worked_example": { "title": "Inspect the selected package before paying", "scenario": "A fictional learner has completed the free Atlas introductory records and compares an official PECB self-study offer with another delivery format. Neither offer has yet been purchased.", "tasks": [ "List facts that can be checked freely from the current issuer pages.", "List material package details that need a written provider response.", "Explain what the free portfolio does and which official steps remain." ], "model_answer": [ "Check the exact ISO/IEC 27001:2022 Foundation award, the course requirement, offered delivery formats and the separate exam/application process using the current handbook and course page. Include the current award requirement to sign the PECB Code of Ethics; the handbook does not impose professional, management-system audit or project experience for this entry-level certificate.", "Confirm the total price/tax, course access period, language, exam/voucher and first-retake conditions, application inclusion, standards licence/access, activity correction keys and available feedback. The brochure's generic wording does not guarantee every file in a particular Foundation offer.", "The Atlas portfolio supports preparation. It does not record attendance/completion in the official programme, provide enrolled course materials, authorize an exam attempt or establish that PECB has granted a certificate." ], "self_check": [ "Is the exact entry award identified?", "Is official-course completion retained as required for this selected programme?", "Are included charges and standards access checked before adding optional purchases?", "Have you avoided recording an enrolment, purchase or awarded credential that has not happened?" ], "source_ids": [ "ISOG_PECB_HANDBOOK", "ISOG_PECB_COURSE", "ISOG_PECB_ELEARNING" ], "limit": "Administrative orientation only. No enrolment, provider contact, purchase or credential action occurred." }, "status": "open", "status_label": "OFFICIAL NEED REMAINS OPEN", "href": "workshop-iso09.html", "summary": "Free official orientation makes the paid requirement explicit.", "related_section_numbers": [ 23, 24, 25, 26, 27, 28, 29 ], "original_teaching_need": "The selected PECB route requires its official Foundation course. This independent public site and reference reading do not satisfy that requirement.", "original_practice_need": "Use official course activities and feedback, then follow the issuer’s separate assessment and application rules.", "primary_route": "pecb", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "ISOG_PECB_HANDBOOK", "ISOG_PECB_COURSE", "ISOG_PECB_ELEARNING" ], "component_checks": [ { "component": "Scenario and evidence", "conclusion": "Reviewed; original need remains partial/open.", "scope_note": "Unpurchased official self-study/delivery offers are correctly hypothetical; no enrolment or entitlement invented." }, { "component": "All assigned tasks", "conclusion": "Reviewed", "items_checked": 3 }, { "component": "All explained model items", "conclusion": "Reviewed; corrections recorded separately.", "items_checked": 3 }, { "component": "Self-checks", "conclusion": "Reviewed; no learner work assessed.", "items_checked": 4 }, { "component": "Assigned readings", "conclusion": "Public scopes reviewed; full licensed text not checked.", "items_checked": 3 }, { "component": "Unresolved original need", "conclusion": "Actual required official course/activities, assessment/application and Code of Ethics requirement; verify exact offer before payment. No experience prerequisite is imposed." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [], "scope_role": "course_requirement", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-ISO09" } }, { "id": "PRACTICE_CC", "title": "Build a current-outline practice and feedback record", "source_ids": [ "CC", "ISC2_Knowledge_Check", "ISC2_CAT", "CCP_PEARSON_DEMO", "CCP_FREE_PROGRAM_STATUS", "ISC2_AI_2026" ], "reading_order": [ { "source_id": "CC", "read": "Read the detailed domain/objective table effective 1 September 2026; use the linked eight-page current outline PDF when the web page's introductory summary differs. For AI applications read the web page's separate AI section or ISC2_AI_2026, the separate official AI-guidance PDF, viewer pages 4-6 only. The outline PDF itself does not contain that AI section.", "learn": "An examination outline defines scope; it does not teach a subject or validate a question bank." }, { "source_id": "ISC2_AI_2026", "read": "CC-specific viewer pages4–6 / printed pages3–5 only; other credentials excluded.", "learn": "Follow applications within all five existing domains; the separate eight-page outline does not reproduce this AI guidance." }, { "source_id": "ISC2_Knowledge_Check", "read": "Try selected public questions, decide before choosing and read the immediate explanation. No personal-details submission is needed for the explanations observed in this review.", "learn": "Use issuer examples to identify particular misunderstandings. Ten selected-topic items do not demonstrate coverage of all 19 objectives or AI applications." }, { "source_id": "ISC2_CAT", "read": "CAT FAQ: item review, varying item count and scoring/proficiency limits.", "learn": "A fixed practice percentage cannot be converted into the real examination's scaled passing result. Do not plan to skip or return to finalized CAT items." }, { "source_id": "CCP_PEARSON_DEMO", "read": "Public demo purpose and optional launch, with the CC rule boundary beside it.", "learn": "Interface orientation and cybersecurity assessment are different needs." }, { "source_id": "CCP_FREE_PROGRAM_STATUS", "read": "Program Conclusion and current availability.", "learn": "Check existing access before any purchase; do not rely on the closed new-enrollment offer." } ], "new_free_coverage": [ "Live-verified official short practice with immediate explanations; final-report form distinguished from free individual feedback.", "A reusable record that maps study and errors to the current objectives and the five AI applications.", "Free interface orientation and the separate current CC CAT navigation/scoring limits." ], "remaining": [ "No free full current CC assessment with verified coverage of all 19 objectives, all printed scope bullets and all five AI applications was established in this targeted search.", "The new workshops and 855-question terminology bank remain formative editorial practice, not a calibrated or official full mock.", "A learner who needs independent marking or diagnostic feedback must arrange it; this site has not assessed the learner's work.", "Beyond the original targeted cases, this nineteen-guide set has no dedicated checked bot-identity lifecycle and behavioral-login case for the CC Domain 3 AI section. Existing lessons/term practice provide foundations, not a completed full-application assessment." ], "payment_note": "These public readings, the inspected individual knowledge-check feedback and this paper activity are free. Full official training/assessments are paid options for new applicants after the old program closed; they are not a CC exam-entry requirement. Existing access is personal and time-limited. Exam and later maintenance charges follow issuer terms; no purchase was made.", "status_reason": "Short issuer practice, interface orientation and a structured feedback workflow are available free. A complete fresh current assessment remains unverified.", "worked_example": { "title": "A high practice score with an unknown coverage gap", "scenario": "A fictional learner answers many familiar vocabulary questions correctly and records 90%. A friend declares that this converts to a guaranteed CC pass. The learner has not yet worked through an AI recovery case or traced traffic across a firewall boundary. Their notebook has no record of which current objectives were practised.", "tasks": [ "Create a paper coverage record with columns for objective, a learning source, a new application task, evidence of your reasoning and the next unanswered question. Keep observed work separate from confidence.", "Use the current outline to list all 19 numbered objectives and check their printed scope bullets/examples. Add a separate AI-application section for each of the five domains and track its described subtopics; these are not five extra numbered objectives. Do not mark an entire objective or domain complete because one example was attempted. Record covered, untested and unresolved parts separately.", "Use the network and AI-continuity guides to fill the two known application gaps. Explain the decision in your own words before revealing model guidance.", "Try the short official knowledge check. Record a mistaken concept and its explanation without copying the publisher's question bank or submitting the optional results form.", "Explain what the practice percentage can and cannot show, and write one concrete next step for obtaining fresh, adequately covered feedback." ], "model_answer": [ "The friend’s guarantee is unsupported. A familiar fixed set measures performance on that set under those conditions. It does not supply CAT item difficulty, full outline coverage or a conversion to the examination's scaled result.", "A useful record is: objective 4.2; source = ASD segmentation reading; task = justify guest-to-records denial and a separate management path; evidence = annotated permitted/blocked flows; next step = explain why an allowed destination port is insufficient to authorize an application action. This is a task artifact, not a pass prediction. Use the linked coverage register as a location checklist, copy a blank paper record and mark studied, attempted, untested and unresolved subtopics separately. Its references do not certify full teaching.", "For the AI continuity application, list model/configuration/data dependencies and owners, a tested fallback, the recovery target and an observable service-quality trigger. Compare your reasoning with the separate AI02 guide. An untested backup list alone does not demonstrate recoverability.", "For an error log, record the objective, your original reasoning, the mistaken assumption, the corrected principle, the exact source location, one new contrasting example and the next review question. Logging only a percentage loses the information needed to improve.", "If the issuer's short quiz uses a broad risk-tolerance description, retain NIST's more precise appetite/tolerance distinction for the atlas's risk lesson; do not derive a universal definition from that isolated item.", "Next step: complete a genuinely new mixed assessment or have someone qualified review new application answers and identify uncovered objectives. Check provenance, current outline and explanation quality first. Paying for a product is not itself evidence that it closes the gap." ], "self_check": [ "The record contains all 19 objective rows, their printed bullet/example subtopics and five separate AI-application sections. It identifies at least one uncovered or untested subtopic and never equates an attempted example with objective completion.", "Each claimed completed application has an actual artifact or explanation, not just a visited URL or a confidence score.", "At least one error is explained with a corrected principle and a new contrasting example.", "No fixed percentage is described as a guaranteed pass or translated into the issuer's scaled score.", "The learner can identify what is still uncovered and whether the next feedback source is free, paid or unverified." ], "source_ids": [ "CC", "ISC2_Knowledge_Check", "ISC2_CAT", "ISC2_AI_2026" ], "limit": "Original editorial study-audit activity. It is neither a new full examination nor an independently marked learner assessment. The publisher's questions and answer keys are linked, not reproduced." }, "status": "partial", "status_label": "PARTIAL · NEEDS REMAIN", "href": "workshop-practice-cc.html", "summary": "Live-verified official short practice with immediate explanations; final-report form distinguished from free individual feedback.", "related_section_numbers": [ 29, 30 ], "original_teaching_need": "Fresh mixed/full-assessment practice aligned to all 19 current CC objectives and AI applications, with authorized provenance and explained answers.", "original_practice_need": "Check current domain/AI coverage and rationales before use; complete unseen practice and review errors. Fixed tests do not reproduce CAT, and a mock percentage is not an exam pass prediction.", "primary_route": "cc", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "CC", "ISC2_Knowledge_Check", "ISC2_CAT", "CCP_PEARSON_DEMO", "CCP_FREE_PROGRAM_STATUS", "ISC2_AI_2026" ], "component_checks": [ { "component": "Current scope and access rules", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "The September 2026 outline has 19 numbered objectives; separate AI guidance applies within five existing domains. The distinct AI guidance PDF and assigned CC page range are now explicit because the eight-page outline PDF does not include those applications. New One Million enrollment ended May 20; existing unexpired-code/course access remains conditional." }, { "component": "Authorized short questions and explained answers", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Live widget independently traversed all ten concepts and immediate explanations; no personal details were needed to see those explanations. No final score report obtained or form submitted." }, { "component": "Coverage record and practice/error review", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Columns, two application examples and a useful error-log recipe are supplied. The model does not itself provide a complete 19-row worked/checkable record, and one AI check per domain is not evidence all AI subtopics were covered." }, { "component": "Fresh mixed/full assessment", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Ten selected-topic items and the familiar editorial terminology bank do not demonstrate the 19 objectives, printed scope details or full AI guidance. Unseen adequately covered feedback is still a next action, not an existing completed resource." }, { "component": "CAT and interface limits", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "Finalized CAT answers cannot be reviewed/changed; adaptive item difficulty and varying length defeat fixed-score conversion. Pearson public page is interface orientation only; full demo was not independently completed." }, { "component": "Independent marking and costs", "conclusion": "Checked at introductory paper level; precision corrections applied where recorded.", "scope_note": "The site does not assess the learner. Current official paid training advertises pre/post assessments and quizzes, but paid content/coverage/rationales were not inspected. Exam entry does not require course completion." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [], "scope_role": "assessment_orientation", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-PRACTICE_CC" } }, { "id": "PRACTICE_ISO", "title": "Current PECB Foundation practice and feedback", "source_ids": [ "ISOG_PECB_HANDBOOK", "ISOG_PECB_COURSE", "ISOG_PECB_ELEARNING", "ISOG_BSI_CHECKLIST" ], "reading_order": [ { "source_id": "ISOG_PECB_HANDBOOK", "read": "Viewer pp.8–10 domains/statements/assessment orientation; p.11 five samples.", "learn": "Know the official scope and sample style while recognizing the absence of a published sample key." }, { "source_id": "ISOG_PECB_COURSE", "read": "Educational approach and general information.", "learn": "Inspect practice already included in the selected course before buying a separate bank." }, { "source_id": "ISOG_PECB_ELEARNING", "read": "Quizzes/material-access paragraphs; note course-dependent correction files.", "learn": "Verify actual key provenance and feedback access rather than treating a brochure as delivered practice." }, { "source_id": "ISOG_BSI_CHECKLIST", "read": "Selected fictional reflection prompts only, without score.", "learn": "Keep organizational reflection and the Atlas model-guidance exercises separate from a current PECB mock." } ], "new_free_coverage": [ "Official sample-format orientation and a transparent coverage/error-log method.", "New linked ISMS application cases with editorial models and self-checks for ISO01–08; these are formative teaching, not an official test.", "Explicit separation of issuer questions, issuer keys, editorial explanations and readiness evidence." ], "remaining": [ "Fresh legitimate PECB-aligned application/evaluation practice spanning both domains and all 65 competency/knowledge statements.", "Authorized verified keys and suitable feedback for a full current Foundation assessment; no free current full official keyed mock was verified.", "Provider correction of unresolved errors, plus current actual exam arrangements. An Atlas score cannot predict a pass." ], "payment_note": "OPEN. Inspect legitimate practice included in the selected paid PECB package first. A separate bank is optional and justified only by an evidenced remaining gap; no paid provider or bank was started.", "status_reason": "Five unkeyed public samples, checklist reflections and original editorial cases do not satisfy the need for fresh full-scope verified-key Foundation practice.", "worked_example": { "title": "Build a source-labelled practice and error log", "scenario": "The learner has the public v1.5 handbook, the selected readings and the original fictional work items above. The learner has not obtained enrolled course practice or a current full keyed mock.", "tasks": [ "Create a tracker for the handbook's two domains and all 65 statements, leaving unsupported coverage claims unresolved.", "Attempt a new fictional case, record reasoning and compare with the labelled editorial model.", "Record the provenance of every question and key, including the five official samples.", "Define what further evidence is needed before treating practice as a readiness check." ], "model_answer": [ "For each statement, record the bounded source, a new application task, observed reasoning, feedback provenance and unresolved points. Reading a link or recognizing a repeated answer is not mastery.", "For an export case, write the decision and evidence before opening the model. Then distinguish a conceptual error, a missed assumption and an alternative defensible local choice. The model is Atlas editorial guidance, not PECB approval.", "Label the handbook samples 'official question; public publisher key not found'. Leave any proposed answer explicitly unverified rather than inventing an official key or computing an official sample score.", "When course practice is available, confirm the current edition, coverage, authorized key and feedback. Repeated items support retrieval; use fresh cases to test transfer. Complete required course activities and resolve persistent uncertainty before deciding about booking." ], "self_check": [ "Does the tracker include every official statement without equating a link with coverage?", "Is every key labelled by its actual issuer/provenance?", "Are editorial models separated from publisher answers?", "Are missed/guessed/repeated items distinguished from fresh independent reasoning?", "Is any readiness or pass prediction withheld unless supported by suitable independent evidence?" ], "source_ids": [ "ISOG_PECB_HANDBOOK", "ISOG_PECB_COURSE", "ISOG_PECB_ELEARNING", "ISOG_BSI_CHECKLIST" ], "limit": "Learning method and formative practice only; no full current official keyed Foundation mock, validated pass mark, exam recreation or readiness prediction." }, "status": "open", "status_label": "OFFICIAL NEED REMAINS OPEN", "href": "workshop-practice-iso.html", "summary": "Official sample-format orientation and a transparent coverage/error-log method.", "related_section_numbers": [ 29, 30 ], "original_teaching_need": "Fresh PECB-aligned application/evaluation practice across both domains and all 65 statements, with authorized keys and feedback.", "original_practice_need": "Inspect included official practice first. Five public samples without a complete verified key, or another issuer’s sample, do not constitute a current PECB full mock.", "primary_route": "pecb", "source_review": { "review_date": "2026-10-29", "reviewed_fields": [ "reading order", "scenario", "tasks", "model guidance", "self-checks", "original need", "remaining needs", "payment/access" ], "assigned_public_source_ids": [ "ISOG_PECB_HANDBOOK", "ISOG_PECB_COURSE", "ISOG_PECB_ELEARNING", "ISOG_BSI_CHECKLIST" ], "component_checks": [ { "component": "Scenario and evidence", "conclusion": "Reviewed; original need remains partial/open.", "scope_note": "Lack of enrolled official practice and full keyed mock is openly stated. Public sample orientation is distinguished from evaluated preparation." }, { "component": "All assigned tasks", "conclusion": "Reviewed", "items_checked": 4 }, { "component": "All explained model items", "conclusion": "Reviewed; corrections recorded separately.", "items_checked": 4 }, { "component": "Self-checks", "conclusion": "Reviewed; no learner work assessed.", "items_checked": 5 }, { "component": "Assigned readings", "conclusion": "Public scopes reviewed; full licensed text not checked.", "items_checked": 4 }, { "component": "Unresolved original need", "conclusion": "Fresh legitimate current practice across both domains with authorized verified keys and suitable feedback; an actual full-scope current keyed assessment remains unverified. Public search found no suitable full official mock; absence from bounded search is not proof none exists." } ], "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "publisher_approval": false, "model_status": "Reviewed original editorial guidance; fictional case facts and choices are not publisher prescriptions." }, "exam_alignment": { "cc_objective_ids": [], "cc_ai_application_ids": [], "pecb_statement_ids": [], "scope_role": "assessment_orientation", "limit": "These are selected related scope positions, not a claim that the guide teaches the entire objective/application/statement. Full scope and remaining depth are in the coverage register.", "href": "exam-coverage.html#guide-PRACTICE_ISO" } } ], "resource_checks": [ { "id": "CCG_ASD_SEGMENT", "title": "Implementing network segmentation and segregation: enforced flows and management separation", "issuer": "Australian Signals Directorate / Australian Cyber Security Centre", "url": "https://www.cyber.gov.au/publication/implementing-network-segmentation-and-segregation", "kind": "Primary government teaching; selected passages", "access": "Public HTML teaching read without registration or payment on 29 October 2026.", "account_required": false, "exact_scope": "Read What is network segmentation and segregation? first two paragraphs; How can network segmentation and segregation be implemented? five themes and the following logical, authentication and application filtering bullets; Example implementations, Segmenting a network to protect key hosts, first six bullets. These passages explain partitioning versus enforced communication rules, least necessary flows, separate management, explicit authorization and several filtering layers.", "exclusions": "The remainder is optional context. No product configuration, exhaustive architecture, fixed deployment schedule or operational validation is supplied. The fictional walkthrough and its port choices are editorial applications, not an ASD reference design.", "currency": "Publisher page says published 4 September 2012, last reviewed 24 March 2023. Stable architectural concepts only; accessed 29 October 2026. The separately listed 2026 anti-pattern page was not counted because complete direct reading timed out.", "verified_free": true, "practice_key_status": "No publisher answer key. Paired with the original CC04 paper walkthrough and explained editorial checks below.", "primary_support_note": "Original government teaching was read on the publisher page; selected content, not the catalogue title, supports the added flow reasoning." }, { "id": "CCG_NIST_FIREWALL_SCOPE", "title": "NIST SP 800-41r1: packet, application and inspection boundaries", "issuer": "NIST", "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf", "kind": "Primary government teaching; expanded bounded reading", "access": "Free public PDF opened and selected passages read without an account.", "account_required": false, "exact_scope": "Viewer p.11 (printed 2-1), section 2 layer-role paragraph/Figure 2-1 only; Viewer pp.12–13 (printed 2-2–2-3), section 2.1.1 only through the source/destination/protocol/port/interface filtering list; viewer p.14 (printed 2-4), section 2.1.2 first four paragraphs and Table 2-1 on TCP connection state/source-destination ports; viewer p.15 (printed 2-5), section 2.1.3 first three paragraphs on application behaviour, commands and input validation; viewer p.16 (printed 2-6), section 2.1.4 only the two-connection proxy explanation and the paragraph on optional decryption, inspection and re-encryption; viewer p.21 (printed 2-11), section 2.3 in full. Page numbers are one-based PDF viewer pages.", "exclusions": "Historical 2009 teaching, not current firewall product advice. Skip obsolete product examples, market trends, older SSL/FIPS recommendations and other unassigned configuration material. A host application allowlist, a network application-aware firewall and server-side business authorization are distinct controls.", "currency": "September 2009 revision 1; checked against the original PDF on 29 October 2026 for stable distinctions only. Modern product behaviour must be checked separately.", "verified_free": true, "practice_key_status": "No publisher questions or key in the selected passages. CC04 supplies an original worked model with explained expected outcomes.", "primary_support_note": "The selected text explicitly distinguishes header filtering from application inspection and identifies encrypted/uninterpretable traffic as an inspection limit. It does not certify any fictional design." }, { "id": "CCG_NIST_TEST_ROE", "title": "NIST SP 800-115: rules of engagement, protected findings and verified follow-up", "issuer": "NIST", "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf", "kind": "Primary government teaching and blank planning template; new bounded scope", "access": "Free public PDF; selected sections and the full relevant rules-of-engagement template were read without registration.", "account_required": false, "exact_scope": "Viewer p.40 (printed 5-6), section 5.3, only the final paragraph on reporting successful/unsuccessful tactics and improving systems rather than singling out people; viewer pp.67–69 (printed B-1–B-3), Appendix B sections 1.1–1.4, 2.1–2.3, 3, 4, 5.1, 5.3 and 6; viewer p.60 (printed 7-6), section 7.4.2 only the secure-storage/access/retention paragraphs; viewer pp.62–64 (printed 8-1–8-3), section 8.1 first paragraph, 8.2 first paragraph and 8.3 implementation/verification/tracking discussion. The exercise applies the template to a fictional physical/social process test.", "exclusions": "Exclude operational attack instructions, Appendix A's obsolete tools, live phishing/entry attempts, old cryptographic examples, old sanitization categories, universal test-frequency claims and the claim that a retest must be an exact mirror to have any value. No jurisdiction-specific legal authority or permission to test a real person/system follows from this reading.", "currency": "September 2008 publication; selected authorization, reporting, data-handling and follow-up concepts only, read 29 October 2026. Technical tools and product recommendations are not treated as current.", "verified_free": true, "practice_key_status": "The template has no publisher answer key. CC05 supplies an original case and explained editorial model; it is not NIST-issued assessment material.", "primary_support_note": "Original NIST passages cover scope, excluded targets, stop/resume authority, physical testing documentation, sensitive data and remediation verification. Fictional access-policy details are stated premises, not attributed to NIST." }, { "id": "CCG_CTEP_EVALUATION", "title": "CISA CTEP Facilitator/Evaluator Handbook: evidence, decisions and after-action improvement", "issuer": "CISA", "url": "https://www.cisa.gov/sites/default/files/publications/3%20-%20CTEP%20Facilitator%20Evaluator%20Handbook%20%282020%29%20FINAL_508_2.pdf", "kind": "Primary government exercise teaching; selected handbook pages", "access": "Public PDF returned HTTP 200 (643,785 bytes, 26 pages) through an ordinary direct request on 29 October 2026; selected pages were extracted and read. The browser reader returned 403, so normal browser-reader availability was not assumed.", "account_required": false, "exact_scope": "Viewer/printed pp.3–7, Facilitator and Evaluator Guidance: Observing and Evaluating, the decision-note questions, Hot Wash, Analyze Data, Identify Root Causes and Develop Recommendations, and After-Action Report and Improvement Plan. Focus on comparing observed discussion with the pre-existing plan and assigning actions, owners and timescales.", "exclusions": "No full CTEP scenario package or publisher marking key is supplied. Skip the older unrelated public-health example in Appendix B and the full national-capability catalogue. An inference about a cause must be checked; an evaluator should not invent one simply to fill the report.", "currency": "The linked file is labelled 2020. Used for stable evaluation and improvement concepts, read 29 October 2026; it is not a current legal, sectoral or exam requirement.", "verified_free": true, "practice_key_status": "Facilitator guidance with decision prompts, not correct/incorrect exam answers. The integrated CC06 model is original editorial application.", "primary_support_note": "The actual handbook pages, rather than a CTEP listing, were read. CISA supports recording decision-maker, trigger, process, outcome, plan deviations and owned improvement actions." }, { "id": "CCG_NIST_IR_RECORDS", "title": "NIST SP 800-61r3: timeline, protected evidence and improvement rows", "issuer": "NIST", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf", "kind": "Current primary government incident-response guidance; expanded bounded reading", "access": "Free public 48-page PDF; selected table rows were read through the public browser reader.", "account_required": false, "exact_scope": "One-based viewer pp.27–28 (printed 19–20), Table 2 ID.IM-01/02/03 and ID.IM-04 recommendations R1–R4; viewer p.36 (printed 28), Table 3 RS.AN-03 recommendation R1 only, on reconstructing the sequence and involved assets; viewer p.37 (printed 29), RS.AN-06 and RS.AN-07 in full. The RS.AN-03 R1 timeline row is an explicit new selection beyond the earlier route's exclusion; the other RS.AN-03 recommendations remain unassigned.", "exclusions": "No complete technical response procedure, forensic acquisition laboratory, legal notification timetable or mandatory universal chain-of-custody process. Do not substitute the superseded r2 lifecycle for r3's current CSF-based presentation.", "currency": "April 2025 revision 3, which supersedes revision 2; original publication/history and selected rows checked 29 October 2026.", "verified_free": true, "practice_key_status": "Recommendations, not a question bank. The fictional CC06 handling and decision records have an explained editorial model.", "primary_support_note": "Current NIST guidance supports recording event sequence, preserving integrity/provenance, restricting evidence access, retaining under the organization's procedures and feeding lessons into plans. Fictional labels and timing rules are declared exercise premises." }, { "id": "CCG_NCSC_EXERCISE_DESIGN", "title": "NCSC effective cyber exercise creation: test a stated plan and act on lessons", "issuer": "UK National Cyber Security Centre", "url": "https://www.ncsc.gov.uk/guidance/effective-steps-to-cyber-exercise-creation", "kind": "Primary government exercise teaching", "access": "Free public HTML article, including the actual nine-step teaching, read without an account.", "account_required": false, "exact_scope": "Read Step 1, Step 3, Step 5 and Steps 7–9. Learn why the plan and objectives precede the exercise, how expected behaviour and metrics are stated, how labelled injects guide discussion, and how observation, participant feedback, business ownership and implementation belong in follow-up.", "exclusions": "The paid assured-provider scheme and external service links are not required. This article is not a scenario answer key or independent capability validation. Do not apply its team-exercise instructions as a live test assignment.", "currency": "Article version 1.0, published 3 February 2020 and reviewed 7 February 2020. Stable exercise design concepts; public page read 29 October 2026.", "verified_free": true, "practice_key_status": "No single correct-answer key; explicit expected actions must be set for the chosen exercise. CC06 supplies a plan before its injects and a reasoned editorial comparison.", "primary_support_note": "Original NCSC teaching was read beyond its introduction. The page explicitly distinguishes exercising an existing plan from creating a plan through the exercise itself." }, { "id": "CCG_CISA_MAPPING", "title": "CISA/HSSEDI best practices for ATT&CK mapping: evidence before technique labels", "issuer": "CISA with HSSEDI / MITRE", "url": "https://www.cisa.gov/sites/default/files/2023-01/Best%20Practices%20for%20MITRE%20ATTCK%20Mapping.pdf", "kind": "Primary government and original framework-developer teaching", "access": "Public PDF returned HTTP 200 (912,219 bytes, 22 pages) through an ordinary direct request; assigned pages were read. The browser reader's 403 was not treated as proof of paywall or permanent access failure.", "account_required": false, "exact_scope": "Viewer/printed pp.7–10, Mapping MITRE ATT&CK into Finished Reports, steps 1–6; pp.13–14, Common Mistakes and its two guidance tables. Extract reported behaviours, obtain context, align tactic/technique/sub-technique and compare proposed mappings. Pay particular attention to port 443 not proving HTTP and a VPN report not proving valid-account abuse.", "exclusions": "Historical v12 counts, older tactic names, unrelated ICS guidance and linked third-party tools are outside scope. Use current MITRE definitions for each technique in the new exercise. No port number, malware label or single technique establishes actor identity or complete prevention.", "currency": "January 2023 version 2; used for stable analytical method, not the present size or taxonomy of ATT&CK. Selected pages read 29 October 2026.", "verified_free": true, "practice_key_status": "Contains worked mapping examples and error explanations; not a CC exam key. The CC08 fictional report and model are original editorial application of the method.", "primary_support_note": "Full selected primary PDF pages were read. The added workflow uses the source's explicit evidence/context cautions rather than equating a report keyword with a justified mapping." }, { "id": "CCG_MITRE_MAPPING_LESSON", "title": "MITRE CTI Module 1: finding behaviours and choosing supported mapping depth", "issuer": "MITRE ATT&CK", "url": "https://attack.mitre.org/docs/training-cti/Module%201%20Slides.pdf", "kind": "Original framework-developer teaching; historical training with bounded concepts", "access": "Free public 65-page slide PDF, with selected slides read without registration.", "account_required": false, "exact_scope": "Viewer p.8 mapping process; pp.12–15 finding/researching behaviour; pp.29–34 choosing techniques/sub-techniques and using context; pp.43–44 exercise method and comparison with other analysts. The training's home page is now https://attack.mitre.org/resources/learn-more-about-attack/training/cti/ .", "exclusions": "The full videos and all 65 slides were not reviewed. Current technique counts, old names and historical knowledge checks are not presented as current exam material. Do not run any report's commands or contact any listed infrastructure.", "currency": "Slides describe November 2020 training and carry a 2024 copyright footer. MITRE's training page explicitly recommends ATT&CK v8 for matching its exercises. Selected method remains useful; verify current definitions separately.", "verified_free": true, "practice_key_status": "The module offers worked examples and comparison discussion. Publisher exercises are version-bounded and are not independently validated learner assessments.", "primary_support_note": "Actual slides were read. Context, verbs/actions, mapping depth and comparison were selected; a resource listing alone was not counted." }, { "id": "CCG_MITRE_DEFENSE_LESSON", "title": "MITRE CTI Module 4: prioritising and tailoring defensive recommendations", "issuer": "MITRE ATT&CK", "url": "https://attack.mitre.org/docs/training-cti/Module%204%20Slides.pdf", "kind": "Original framework-developer teaching and guided paper practice", "access": "Free public 46-page PDF and linked guided RTF worksheet; selected slides and worksheet text were read without an account.", "account_required": false, "exact_scope": "Viewer pp.7–8 defensive recommendation process and prioritisation; pp.25–28 organizational capabilities, constraints and option trade-offs; p.32 recommendation types; pp.35–36 guided exercise instructions and review prompts. Optional publisher worksheet: https://attack.mitre.org/docs/training-cti/Making%20Defensive%20Recommendations%20Guided%20Exercise.rtf . Work on paper with the supplied assumptions.", "exclusions": "Older example control choices are not universal recommendations. The guided worksheet depends on earlier Cobalt Kitty material and ATT&CK v8; it is an optional continuation, not the complete beginner case here. No current product effectiveness or purchase recommendation follows.", "currency": "2024 footer; training page flags older ATT&CK v8 exercise context. The current knowledge base has revised detection structures; use current technique pages for the new case, not historical detection labels by rote.", "verified_free": true, "practice_key_status": "Publisher-guided open-ended exercise and slide discussion; multiple defensible recommendations, no single scored exam key. The new CC08 model makes its assumptions and validation criteria explicit.", "primary_support_note": "Selected original slides and actual RTF text were read. They teach matching a proposed defence to the observed procedure, existing visibility and business constraints." }, { "id": "CCG_MITRE_TICKET_473822", "title": "MITRE simulated incident ticket 473822 with publisher mapping answers", "issuer": "MITRE ATT&CK", "url": "https://attack.mitre.org/docs/training-cti/ticket-473822.rtf", "kind": "Historical publisher paper exercise with one set of answers", "access": "RTF returned HTTP 200 (1,120 bytes) and its full text was read. The one-page answer PDF was also opened and read at https://attack.mitre.org/docs/training-cti/ticket-473822%20answers.pdf . No account or payment.", "account_required": false, "exact_scope": "Optional after the beginner CC08 case: read the simulated ticket as evidence, do not execute its commands; propose mappings for the recorded commands, then compare with the complete one-page publisher answer sheet. It includes raw-data context and several discovery mappings.", "exclusions": "Not a current CC mock, not narrative-report practice by itself, and not an official rationale for every mapping. No command execution, malware use, target probing or assumption that the key matches current ATT&CK exactly.", "currency": "2019 exercise; MITRE's current training page says use ATT&CK v8 to match training results. The answer repeatedly uses parent T1059 and names from its original context. Current definitions may support different depth or names; preserve the historical label and record the difference.", "verified_free": true, "practice_key_status": "Publisher-provided one set of mapping answers was actually read. The sheet supplies labels, not full explanatory rationales, exam alignment or an independent readiness result.", "primary_support_note": "Original exercise and original answer both inspected. Included as optional legitimate additional practice, with the historical/version and rationale limits kept visible.", "additional_urls": [ "https://attack.mitre.org/docs/training-cti/ticket-473822%20answers.pdf" ] }, { "id": "CCG_ATTACK_LINK_CURRENT", "title": "Current T1566.002 Spearphishing Link: definition, mitigations and detection", "issuer": "MITRE ATT&CK", "url": "https://attack.mitre.org/techniques/T1566/002/", "kind": "Original framework definition and defensive reference", "access": "Free public technique page read without registration.", "account_required": false, "exact_scope": "Opening definition, ID/tactic/version metadata, mitigation rows M1021/M1054/M1017, and Detection Strategy DET0107 rows AN0298–AN0301. Use the specific link-delivery behaviour, and identify relevant mail, web and endpoint evidence rather than assuming a generic phishing label proves compromise.", "exclusions": "The many historical actor/procedure examples are unassigned. Current detection descriptions are candidate analytics requiring local validation, not a promise every tool detects the behaviour.", "currency": "Live page checked 29 October 2026; version 2.8, last modified 11 September 2026 as displayed. Snapshot facts can change.", "verified_free": true, "practice_key_status": "Technique definition and candidate defence examples, no exam key. Supports the explained editorial mapping of the fictional mail event.", "primary_support_note": "The original technique definition and selected current defensive rows were read, not inferred solely from its title." }, { "id": "CCG_ATTACK_POWERSHELL_CURRENT", "title": "Current T1059.001 PowerShell: execution, legitimate use and contextual detection", "issuer": "MITRE ATT&CK", "url": "https://attack.mitre.org/techniques/T1059/001/", "kind": "Original framework definition and defensive reference", "access": "Free public technique page; selected passages read without an account.", "account_required": false, "exact_scope": "Opening definition and metadata; Mitigations M1042 and M1038; Detection Strategy DET0455 / AN1252. Understand that PowerShell can be legitimate, and that execution context, parent processes and subsequent behaviour affect a detection decision.", "exclusions": "Offensive tool links, command execution, historical actor examples and execution policy as a complete security boundary are excluded. Removing PowerShell without checking operational dependencies is not a universal recommendation.", "currency": "Live page checked 29 October 2026; version 1.6, last modified 18 September 2026 as displayed. Definitions/detection content may change.", "verified_free": true, "practice_key_status": "No publisher question key. Supplies the exact current technique and candidate defensive concepts for CC08's fictional behaviour.", "primary_support_note": "Actual definition, selected mitigation caveat and detection row read. The case recommends validation against benign administration as well as suspicious behaviour." }, { "id": "CCG_ATTACK_DISCOVERY_CURRENT", "title": "Current T1046 Network Service Discovery", "issuer": "MITRE ATT&CK", "url": "https://attack.mitre.org/techniques/T1046/", "kind": "Original framework technique definition", "access": "Free public page read without an account.", "account_required": false, "exact_scope": "Opening definition, ID, Discovery tactic, no-sub-techniques statement and version metadata. Compare the reported attempt to enumerate remote services with the definition. Record its current title rather than silently copying the training's older Network Service Scanning name.", "exclusions": "Procedure examples, tools and live scanning are unassigned. An isolated network connection is not enough to establish service discovery, and this label does not prove later exploitation.", "currency": "Live page checked 29 October 2026; version 3.2, last modified 12 May 2026 as displayed. Current title Network Service Discovery differs from the older training's Network Service Scanning.", "verified_free": true, "practice_key_status": "No question key. Definition supports the CC08 editorial mapping and its exclusion of unsupported follow-on activity.", "primary_support_note": "The complete opening definition and metadata were read. The new case gives explicit post-compromise service-enumeration context." }, { "id": "AIG_NIST_GOVERN", "title": "NIST AI RMF Playbook: risk tolerance and accountable roles", "issuer": "NIST", "url": "https://airc.nist.gov/airmf-resources/playbook/govern/", "kind": "Primary guidance; selected teaching passages", "access": "Selected HTML text was publicly readable without payment or sign-in.", "account_required": false, "exact_scope": "GOVERN 1.3: About, Suggested Actions and Transparency and Documentation; GOVERN 2.1: About and Suggested Actions; GOVERN 2.3 outcome sentence only.", "exclusions": "Not a mandatory checklist, full AI RMF course, legal compliance determination or assessment. Do not assign all linked third-party publications. Historical laws and examples are outside this selection.", "currency": "Live passages checked 2026-10-29. The site says AI RMF 1.0 is being updated and the Playbook will follow its revision. Recheck subcategory identifiers after an update.", "verified_free": true, "practice_key_status": "Documentation/reflection questions and suggested actions; no scored learner answer key or individual marking in the selected passages.", "primary_support_note": "Actual subcategory text read. It supports leadership-set risk tolerance, proportionate resources, explicit roles and separate testing/oversight. Numerical thresholds and named roles in the new case are editorial choices." }, { "id": "AIG_NIST_MAP", "title": "NIST AI RMF Playbook: purpose, alternatives and go/no-go boundaries", "issuer": "NIST", "url": "https://airc.nist.gov/airmf-resources/playbook/map/", "kind": "Primary guidance; selected teaching passages", "access": "Selected HTML text was publicly readable without payment or sign-in.", "account_required": false, "exact_scope": "MAP 1.1: About and Suggested Actions; MAP 1.5: About and Suggested Actions, especially maximum acceptable risk and documented trade-offs.", "exclusions": "No whole-function assignment or legal advice. The case's organizational appetite and release conditions are fictional, not NIST requirements.", "currency": "Live text checked 2026-10-29; update-in-progress banner noted.", "verified_free": true, "practice_key_status": "Reflection/documentation prompts only; no scored answer key or independent learner feedback.", "primary_support_note": "Actual MAP 1.1 and 1.5 text read, including non-AI alternatives, affected parties, oversight, risk limits and traceable go/no-go decisions." }, { "id": "AIG_NIST_MEASURE", "title": "NIST AI RMF Playbook: production monitoring and drift investigation", "issuer": "NIST", "url": "https://airc.nist.gov/airmf-resources/playbook/measure/", "kind": "Primary guidance; selected teaching passage", "access": "Selected HTML text was publicly readable without payment or sign-in.", "account_required": false, "exact_scope": "MEASURE 2.4: outcome, About and Suggested Actions. Stop before the resource bibliography.", "exclusions": "No complete statistical drift-detection course, software installation, guarantee of detection or inference that a metric change proves compromise.", "currency": "Live text checked 2026-10-29; update-in-progress banner noted.", "verified_free": true, "practice_key_status": "Monitoring and documentation guidance; no keyed calculation or individual marking.", "primary_support_note": "Actual passage read. It connects monitored production results with predeployment metrics, ground truth, human review and alerts. The case's weekly denominator and trigger are invented for arithmetic practice." }, { "id": "AIG_NIST_MANAGE", "title": "NIST AI RMF Playbook: recovery, bypass and redeployment decisions", "issuer": "NIST", "url": "https://airc.nist.gov/airmf-resources/playbook/manage/", "kind": "Primary guidance; selected teaching passages", "access": "Selected HTML text was publicly readable without payment or sign-in.", "account_required": false, "exact_scope": "MANAGE 2.3 and 2.4: About and Suggested Actions; MANAGE 4.1 outcome sentence only.", "exclusions": "Not a technical restoration procedure, mandatory RTO/RPO or production readiness assurance. Linked tools and older incident-handling documents are unassigned.", "currency": "Live text checked 2026-10-29; update-in-progress banner noted.", "verified_free": true, "practice_key_status": "Suggested procedures/documentation questions, not scored practice or learner marking.", "primary_support_note": "Actual passages read. They support contingency plans, responsible bypass/deactivation, downstream effects, retained evidence and criteria for redeployment." }, { "id": "AIG_NIST_GENAI", "title": "NIST AI 600-1: selected acceptable-use, inventory and fallback actions", "issuer": "NIST", "url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf", "kind": "Free primary publication; selected PDF passages", "access": "Public 64-page PDF opened and relevant sections read; cover explicitly says available free of charge.", "account_required": false, "exact_scope": "Section 2.4 Data Privacy, viewer p.11 (printed p.7); GV-1.3-002, viewer p.18 (printed p.14); GV-1.4-002, viewer p.19 (printed p.15); GV-1.6-003, viewer p.20 (printed p.16); GV-3.2-003, viewer p.22 (printed p.18); GV-6.2-001, viewer p.25 (printed p.21); GV-6.2-003 and GV-6.2-006, viewer p.26 (printed p.22). Read only these identifiers/passages.", "exclusions": "Voluntary suggested actions; no legal conclusion, universal threshold or full GenAI engineering course. Historical executive-order context and unrelated high-risk capability sections are unassigned. Copying model weights is not assumed possible for a hosted API.", "currency": "July 2024 publication; exact passages checked 2026-10-29. Reassess alongside future AI RMF/profile revisions.", "verified_free": true, "practice_key_status": "Guidance and suggested actions, with no scored learner answer key.", "primary_support_note": "Actual PDF text read by section/action ID. Supports privacy exposure/inference risks, go/no-go criteria, acceptable queries, version-aware inventory, third-party dependencies and manual fallback." }, { "id": "AIG_NCSC_DESIGN", "title": "NCSC secure AI design: assess the need, data and control trade-offs", "issuer": "UK National Cyber Security Centre and international partners", "url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-design", "kind": "Free primary guidance; selected HTML headings", "access": "Selected full heading text publicly readable without payment or sign-in.", "account_required": false, "exact_scope": "Model the threats to your system; Design your system for security as well as functionality and performance; first paragraph of Consider security benefits and trade-offs when selecting your AI model.", "exclusions": "Do not follow exploit links or treat controls as guarantees. Detailed model engineering and the complete collection are outside this beginner reading.", "currency": "Version 1.0, published/reviewed 2023-11-27; assigned concepts read 2026-10-29. Provider controls and current products require separate verification.", "verified_free": true, "practice_key_status": "Guidance only; no publisher-scored practice.", "primary_support_note": "Actual heading text read. Supports deciding whether AI fits the task, evaluating external components, limiting sent data and actions, and assessing security alongside usability/oversight." }, { "id": "AIG_NCSC_ASSETS", "title": "NCSC secure AI development: assets, versions and a known-good state", "issuer": "UK National Cyber Security Centre and international partners", "url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development", "kind": "Free primary guidance; selected HTML headings", "access": "Selected full heading text publicly readable without payment or sign-in.", "account_required": false, "exact_scope": "Secure your supply chain; Identify, track and protect your assets; Document your data, models and prompts. Stop before Manage your technical debt.", "exclusions": "Not a backup product guide or proof that a backup can restore. No model download, model execution, API use or installation is assigned.", "currency": "Version 1.0, published/reviewed 2023-11-27; selected concepts read 2026-10-29.", "verified_free": true, "practice_key_status": "Guidance only; no publisher answer key or learner marking.", "primary_support_note": "Actual passages read. Supports model/data/prompt/log inventories, protected versioned assets, restoration capability, documented limitations and supply-chain alternatives." }, { "id": "AIG_NCSC_DEPLOY", "title": "NCSC secure AI deployment: incident plans and release evaluation", "issuer": "UK National Cyber Security Centre and international partners", "url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-deployment", "kind": "Free primary guidance; selected HTML headings", "access": "Selected full heading text publicly readable without payment or sign-in.", "account_required": false, "exact_scope": "Develop incident management procedures; Release AI responsibly; Make it easy for users to do the right things.", "exclusions": "No production incident-response plan is approved by this exercise. Security evaluation does not by itself establish safety, fairness or legal compliance.", "currency": "Version 1.0, published/reviewed 2023-11-27; selected concepts read 2026-10-29.", "verified_free": true, "practice_key_status": "Guidance only; no scored assessment or individualized feedback.", "primary_support_note": "Actual passages read. Supports escalation/remediation plans, evaluated releases, stated limitations and clear user/provider duties." }, { "id": "AIG_NCSC_OPERATE", "title": "NCSC secure AI operation: monitor behaviour and evaluate changes", "issuer": "UK National Cyber Security Centre and international partners", "url": "https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-operation-maintenance", "kind": "Free primary guidance; selected HTML headings", "access": "Selected full heading text publicly readable without payment or sign-in.", "account_required": false, "exact_scope": "Monitor your system's behaviour; Monitor your system's input; Follow a secure by design approach to updates; Collect and share lessons learned.", "exclusions": "No instruction to collect unlimited raw prompts or expose sensitive logs. Generic update guidance is not a command to deploy an untested candidate; exact implementation remains organization-specific.", "currency": "Version 1.0, published/reviewed 2023-11-27; selected concepts read 2026-10-29.", "verified_free": true, "practice_key_status": "Guidance only; no keyed practice or learner marking.", "primary_support_note": "Actual passages read. Changes to data/models/prompts may alter behaviour; testing/evaluation and version changes belong in update management. Monitoring must respect privacy and data-protection requirements." }, { "id": "AIG_CISA_AI_TTX", "title": "CISA JCDC AI Cyber Tabletop Exercise: scenario and facilitator outcomes", "issuer": "CISA National Cyber Exercise Program / JCDC", "url": "https://www.cisa.gov/sites/default/files/2024-06/June_13_TTX_Plan_508c.pdf", "kind": "Free publisher discussion exercise with facilitator aids", "access": "Exact public PDF fetched by ordinary HTTP with browser User-Agent: HTTP 200, 342286 bytes, 10 pages. All pages read in memory. Web reader separately returned 403; access may vary.", "account_required": false, "exact_scope": "p.1 purpose/objectives; p.3 Day 2 risk prioritization and lifecycle evaluation, plus Day 4 unexpected model update; p.5 Day 6 10:12 AM untrusted-model discussion; p.7 Day 21 post-incident evaluation/continuity; pp.9-10 facilitator refocus questions corresponding to those injects only.", "exclusions": "Fictional organizations, models, sites, attack injects and timelines are scenario devices, not current intelligence or real product instructions. Do not load a model or visit scenario download sites. US operational/reporting contacts and TLP roundtable sections are unassigned. It is a discussion exercise, not a keyed CC/PECB exam.", "currency": "June 2024 exercise artifact checked 2026-10-29. Retained for its named discussion concepts and facilitator structure; no current threat or product claim is imported.", "verified_free": true, "practice_key_status": "Verified: discussion questions and Desired Discussion Outcomes beside injects; pp.9-10 provide facilitator refocus questions. Reading all 10 pages found no scored answer key or individual marking service. Desired outcomes guide a discussion, not a uniquely correct answer.", "primary_support_note": "Read the actual scenario, not the event announcement. Useful fresh publisher practice for risk prioritization, supply-chain changes, information collection and continuity decisions. The new worked answers below are original editorial applications." }, { "id": "AIG_FBI_IMPERSONATION", "title": "FBI IC3: AI voice/video impersonation and independent contact verification", "issuer": "FBI Internet Crime Complaint Center", "url": "https://www.ic3.gov/PSA/2024/PSA241203", "kind": "Free primary public-awareness guidance", "access": "Assigned public HTML text readable without payment or sign-in.", "account_required": false, "exact_scope": "AI-Generated Audio, aka Vocal Cloning; AI-Generated Videos; under Tips to protect yourself, the bullet on ending a call and contacting the claimed organization through independently researched contact information.", "exclusions": "Visual imperfections and voice/tone heuristics are unassigned and must not be treated as authentication. US complaint procedures and financial/investment advice are outside scope.", "currency": "PSA dated 2024-12-03; selected defensive concepts checked 2026-10-29.", "verified_free": true, "practice_key_status": "Public-awareness advice; no exercise key or learner marking.", "primary_support_note": "Actual selected passages read. Supports plausible synthetic voice/video impersonation and independently verified contact rather than trusting the incoming caller's channel." }, { "id": "AIG_NIST_IDPS", "title": "NIST SP 800-94: IDS/IPS, anomaly baselines and false positives", "issuer": "NIST", "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-94.pdf", "kind": "Free primary reference; stable concepts from an older publication", "access": "Public PDF opened and exact passages read without payment or sign-in.", "account_required": false, "exact_scope": "Viewer p.15, section 2 first two paragraphs (printed 2-1): detection and IDS/IPS distinction; viewer p.17 (printed 2-3), the paragraph beginning Another common attribute on false positives/negatives; viewer pp.18-19, section 2.3.2 anomaly-baseline concept and the monthly-maintenance example only; viewer p.20, section 2.4 Wireless first sentence only.", "exclusions": "February 2007 source used only for named stable concepts. Product capabilities, deployment locations, training-period timings, protocols, wireless standards and implementation instructions are unassigned. The 2012 revision draft never became final and was retired; it is not substituted here.", "currency": "2007 final; publisher's 2022 planning note about the retired draft checked 2026-10-29. Current technology selection requires current product documentation.", "verified_free": true, "practice_key_status": "Conceptual reference; no scored exercise key.", "primary_support_note": "Actual PDF passages read, with publication-status page checked. Detection identifies possible incidents; prevention adds an attempt to stop them. A legitimate unusual activity can trigger an anomaly alert." }, { "id": "AIG_NIST_FIREWALL", "title": "NIST SP 800-41r1: the firewall traffic-control concept", "issuer": "NIST", "url": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf", "kind": "Free primary reference; one stable definition", "access": "Public PDF opened and assigned sentence read without payment or sign-in.", "account_required": false, "exact_scope": "Viewer p.11 (printed 2-1), section 2 first sentence defining a firewall's traffic-control role. This supplements the site's existing NIST_FIREWALL resource only for the explicit IDS/firewall comparison.", "exclusions": "2009 deployment rules, old protocol examples, market claims and compliance statements are unassigned. No claim that a firewall authenticates a model output or guarantees safe content.", "currency": "September 2009 publication; only the stable named concept reused, checked 2026-10-29.", "verified_free": true, "practice_key_status": "One conceptual definition; no practice key.", "primary_support_note": "Exact sentence read from the PDF. It supports traffic enforcement as the primary comparison point; modern products can combine several control functions." }, { "id": "AIG_MS_ANOMALIES", "title": "Microsoft Sentinel: deviation from a baseline is an investigation signal", "issuer": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/sentinel/anomalies-reference", "kind": "Free first-party conceptual excerpt from product documentation", "access": "Assigned article text publicly readable. No account needed for this reading; running Sentinel/Azure resources can incur charges and is unassigned.", "account_required": false, "exact_scope": "Opening explanation of learned activity baselines; the Anomalies table score description immediately before the discontinuation note. Do not read or implement the catalogue of detection rules.", "exclusions": "No deployment lab, alert threshold recommendation or interpretation of a score as probability of attack. Specifically exclude discontinued DGA detections, which the current page says ended 2026-03-08 due to low result quality.", "currency": "Live article checked 2026-10-29, including the March 2026 discontinuation notice. Product behaviour and rules can change.", "verified_free": true, "practice_key_status": "Documentation, not a free keyed lab or learner marking service.", "primary_support_note": "Actual opening text read. The cited score describes deviation from an expected baseline, not proof of maliciousness or a calibrated attack probability." }, { "id": "AIG_MS_FALSE_POSITIVES", "title": "Microsoft Sentinel: legitimate activity can cause false positives", "issuer": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/sentinel/false-positives", "kind": "Free first-party conceptual excerpt from product documentation", "access": "Assigned article text publicly readable without payment or sign-in. Cloud use and operational tuning are not part of this reading.", "account_required": false, "exact_scope": "Opening statement that analytics rules are imperfect; False positive causes and prevention heading and the bullets on normal service-principal activity and intentional security scanning only.", "exclusions": "No portal instructions, automation-rule changes, broad allowlisting or implementation recommendation. Current migration/custom-detection marketing and operational cost claims are unassigned.", "currency": "Live article checked 2026-10-29. Use only the selected concepts, independent of changing portal workflows.", "verified_free": true, "practice_key_status": "Documentation examples; no scored answer key.", "primary_support_note": "Actual selected text read. Supports investigating benign causes and making narrowly justified tuning decisions instead of treating every alert as an attack." }, { "id": "AIG_MS_AI_RESPONSIBILITY", "title": "Microsoft Learn: AI platform, application and usage responsibilities", "issuer": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility-ai", "kind": "Free first-party conceptual guidance", "access": "Full assigned article text was publicly readable despite the page's generic authorization banner. No sign-in needed for the assigned text. Actual products, APIs and compute are separate and may be paid.", "account_required": false, "exact_scope": "Opening governance-responsibility note; AI layer overview subsections AI platform, AI application and AI usage, including acceptable-use and synthetic-media awareness paragraphs.", "exclusions": "Illustrative governance division, not a legal allocation or modification of customer/provider agreements. Product recommendations, purchases, service configuration and agent-specific architecture are unassigned.", "currency": "Page last updated 2026-08-24; assigned text read 2026-10-29. Check the selected service's actual agreement/control documentation for real decisions.", "verified_free": true, "practice_key_status": "Guidance, not keyed practice or proof that provider/customer controls work.", "primary_support_note": "Actual article read. Layer and service choices change operational responsibilities; users still need data governance, identity/access control, acceptable-use rules and education." }, { "id": "AIG_MS_CLOUD_RESPONSIBILITY", "title": "Microsoft Learn: cloud responsibility matrix and retained customer duties", "issuer": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility", "kind": "Free first-party conceptual guidance", "access": "Assigned article and matrix publicly readable without payment or sign-in. No cloud subscription required to complete the paper exercise.", "account_required": false, "exact_scope": "Opening IaaS/PaaS/SaaS definitions; governance note; Responsibility matrix; Responsibilities you always retain; Shared responsibilities explained.", "exclusions": "Specific services may combine models. Do not infer contract terms or that all responsibility moves to a SaaS provider. No deployment, account creation, cloud usage or product evaluation is required.", "currency": "Live article and matrix checked 2026-10-29. Current matrix labels some application/network/device areas shared; avoid oversimplified old diagrams.", "verified_free": true, "practice_key_status": "Reference matrix, not scored learner practice.", "primary_support_note": "Actual matrix and explanatory text read. Customer data/settings/identities remain customer duties; OS and application/network duties vary. The worked owner table is a fictional application of this guidance." }, { "id": "AIG_MS_MEASURE_HARMS", "title": "Microsoft Learn: create test cases, criteria and a harm baseline", "issuer": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/training/modules/responsible-ai-studio/4-measure-harms", "kind": "Free first-party teaching unit; text only", "access": "Full teaching text publicly readable without payment or sign-in. Assigned work is a paper adaptation using fictional outputs; do not run the separate cloud lab.", "account_required": false, "exact_scope": "Opening baseline paragraph; three-step measurement explanation; Manual and automatic testing heading and its two paragraphs.", "exclusions": "Do not run harmful prompt examples or deploy a model. The surrounding Foundry module is intermediate; its separate lab needs an Azure subscription. A model evaluator is not assumed reliable without checking.", "currency": "Live redirected current module text checked 2026-10-29. Legacy responsible-generative-ai module URL now redirects to responsible-ai-studio.", "verified_free": true, "practice_key_status": "Teaching text supplies a process, not answers to the new case. Separate three-question publisher assessment is publicly visible, but its returned key/rationales were not verified; it is not counted as independently marked practice.", "primary_support_note": "Actual unit text read. Supports representative inputs, predefined evaluation criteria, recorded baselines and human checking of automated evaluation. The case's test set and results are original fiction." }, { "id": "AIG_MS_OPERATE", "title": "Microsoft Learn: prerelease reviews, phased delivery and rollback", "issuer": "Microsoft Learn", "url": "https://learn.microsoft.com/en-us/training/modules/responsible-ai-studio/6-operate-responsibly", "kind": "Free first-party teaching unit; text only", "access": "Full teaching text publicly readable without payment or sign-in. No subscription, account or cloud deployment required for assigned reading/paper planning.", "account_required": false, "exact_scope": "Complete prerelease reviews; Release and operate the solution, including phased release, incident response, rollback, blocking harmful responses, feedback and privacy-respecting telemetry.", "exclusions": "This is instructional guidance, not evidence an actual deployment is approved or recoverable. No surrounding subscription lab, production configuration or paid service is assigned.", "currency": "Live module unit checked 2026-10-29; product UI and service naming may change.", "verified_free": true, "practice_key_status": "Teaching guidance; no scored answer key for a learner's release/rollback record.", "primary_support_note": "Actual unit text read. Supports multidisciplinary review, limited rollout, an explicit rollback plan, incident handling and feedback channels." }, { "id": "ISOG_PECB_HANDBOOK", "title": "PECB ISO/IEC 27001:2022 Foundation Candidate Handbook, v1.5", "issuer": "PECB", "url": "https://pecb.com/pdf/candidate-handbooks/pecb-candidate-handbook-iso-27001-2022-foundation.pdf", "kind": "Official public syllabus, route rules and five sample questions", "access": "Direct public PDF, read without payment or account; this is information about the selected paid course.", "account_required": false, "exact_scope": "Viewer pp.5 and 12: course prerequisite and award steps; pp.8–10: two domains and competency/knowledge statements; p.11: five public samples. Read the current rules before relying on administrative details.", "exclusions": "Not the course, standard text, complete assessment or answer key. Names the three policy categories but does not define their boundaries. Do not infer answers from distractors.", "currency": "©2026, Candidate Handbook Version 1.5, 15 pages; downloaded and text inspected 29 October 2026.", "verified_free": true, "practice_key_status": "Five questions on p.11; no answer key or explanations found in this complete 15-page handbook. No full free current PECB keyed mock verified.", "primary_support_note": "Publisher PDF establishes the labels high-level general, high-level specific and topic-specific, compulsory course completion, and separate assessment/application. The 40-item assessment is split equally between two domains; the sample page is only an orientation." }, { "id": "ISOG_PECB_POLICY", "title": "From Policy to Protection: Strengthen Your Infosec Strategy", "issuer": "PECB", "url": "https://pecb.com/en/skills/resources/from-policy-to-protection-strengthen-your-infosec-strategy", "kind": "Public educational article", "access": "Public article read in full by direct publisher retrieval; no payment, signup or account.", "account_required": false, "exact_scope": "Policy Development, Policy Enforcement and Information Security Policy Maturity sections only: direction, ownership, approval responsibility, communication, operation and review.", "exclusions": "Does not define the handbook's three-category taxonomy or supply its classification key. The article's [AK1] editing marker and promotional claims are not teaching. Do not treat its prose as normative clause text.", "currency": "No publication date identified on the article itself; retrieved 29 October 2026. It refers to current Annex A 5.1; the retrieval date is not a publication date.", "verified_free": true, "practice_key_status": "No assessment or publisher answer key.", "primary_support_note": "PECB describes policy responsibilities, topic-specific examples, communication, controls, monitoring, training and review. Useful lifecycle preparation; insufficient evidence for exact provider category definitions." }, { "id": "ISOG_BSI_GUIDE", "title": "ISO/IEC 27001:2022 Information Security — Your implementation guide", "issuer": "BSI", "url": "https://www.bsigroup.com/siteassets/pdf/en/insights-and-media/insights/brochures/27001_implementation_guide.pdf", "kind": "Free introductory implementation guide", "access": "Direct 12-page public PDF; no account or form used.", "account_required": false, "exact_scope": "Viewer pp.5–7, selected clause 4–10 overview paragraphs. Read the relevant paragraph alongside the corresponding fictional work item, rather than assigning the whole brochure.", "exclusions": "Skip marketing, certification promises, and pp.5 references describing ISO/IEC 27000 as current vocabulary: ISO/IEC 27000:2026 changed purpose. The short guide is not complete authorized requirements or Amendment 1 teaching.", "currency": "Cover explicitly identifies ISO/IEC 27001:2022; no reliable publication date printed in extracted pages. Current direct publisher PDF and 2026 roadmap link verified 29 October 2026.", "verified_free": true, "practice_key_status": "Guidance, without keyed exercises.", "primary_support_note": "Introductory support for context, leadership, planning, support, operational criteria, retained results, performance evaluation and improvement. Free reading does not license redistribution or replace the standard." }, { "id": "ISOG_BSI_CHECKLIST", "title": "Information Security Management System ISO/IEC 27001 — Self-assessment checklist", "issuer": "BSI", "url": "https://www.bsigroup.com/siteassets/pdf/en/insights-and-media/insights/brochures/self-assessment-questionnaire.pdf", "kind": "Editable reflection checklist", "access": "Direct public PDF linked from BSI's 2026 SME roadmap; no form, account or payment.", "account_required": false, "exact_scope": "Viewer pp.4–6 questions 1–23; p.7 questions 24–26 and 29 once each. Use questions as prompts to identify fictional evidence, not as yes/no claims about a real organization.", "exclusions": "Exclude maturity scores, score-based certification recommendations, duplicate q27/q28, stray BCMS text and promotional follow-ons. No complete management-review input checklist. It is neither an exam mock nor an independently validated assessment.", "currency": "©2025, 11-page PDF, retrieved 29 October 2026. Page 7 was rendered and visually inspected: q24/q28 and q25/q27 repeat.", "verified_free": true, "practice_key_status": "No right/wrong publisher key: organization-specific self-assessment. No score may be used to predict exam success.", "primary_support_note": "Questions 9–14 are useful prompts for repeatable risk assessment, acceptance criteria, owners, Annex A comparison, SoA inclusion/exclusion reasons, implementation status and residual-risk decisions." }, { "id": "ISOG_BSI_AMENDMENT", "title": "IAF/ISO Joint Communiqué on the addition of Climate Change — What does it mean for you?", "issuer": "BSI", "url": "https://www.bsigroup.com/en-AU/insights-and-media/insights/blogs/iafiso-joint-communique-on-the-addition-of-climate-change/", "kind": "Free explanation of the 2024 management-system amendment", "access": "Public publisher article, read without payment or account.", "account_required": false, "exact_scope": "What should be considered and FAQ paragraphs on relevance to the particular management system and auditor consideration of clauses 4.1/4.2.", "exclusions": "Not a separate environmental-management requirement or evidence of PECB examination scope. Confirm amendment treatment with the selected provider.", "currency": "Explains the communiqué issued 23 February 2024; current page checked 29 October 2026.", "verified_free": true, "practice_key_status": "No assessment/key.", "primary_support_note": "Supports a proportionate fictional relevance discussion, with evidence for the decision. Do not assume climate issues always have the same effect on every management system." }, { "id": "ISOG_ISO_IAF_CLIMATE", "title": "IAF/ISO Joint Communiqué on Climate Change considerations in Management Systems Standards", "issuer": "ISO and IAF", "url": "https://www.iso.org/files/live/sites/isoorg/files/standards/popular_standards/management_systems/ISO-IAF%20Joint%20Communique%20Feb%202024.pdf", "kind": "Original public communiqué", "access": "Free direct four-page publisher PDF; no account.", "account_required": false, "exact_scope": "Viewer p.2, added clauses 4.1/4.2 statements and Intent; p.3 confirms ISO/IEC 27001:2022 among affected standards.", "exclusions": "Not full ISO/IEC 27001 or an exam-scope update; do not transfer historical ISO 9001:2015 references in its list into present-edition claims.", "currency": "Dated 22 February 2024; amendments published 23 February 2024; PDF read 29 October 2026.", "verified_free": true, "practice_key_status": "No assessment/key.", "primary_support_note": "Original bounded support for deciding climate relevance and considering interested-party requirements; the overall context/interested-party intent remains unchanged." }, { "id": "ISOG_ISACA_GUIDE", "title": "Implementation guide ISO/IEC 27001:2022 — English publisher edition", "issuer": "ISACA Germany Chapter", "url": "https://www.isaca.de/images/Publikationen/Leitfaden/ISACA_Implementation_guide_ISOIEC_27001_2022_Englisch_final.pdf", "kind": "Free practical implementation guidance with examples", "access": "Direct publisher PDF downloaded successfully without account/payment. The browser text parser failed, so the actual 54-page PDF was inspected locally.", "account_required": false, "exact_scope": "Selected passages: §3.1–3.2 viewer pp.10–12; §3.3 pp.12–13; §3.4 pp.13–14; §3.5 pp.14–15 role competence only; §3.6 pp.15–20 risk criteria/owners/treatment; §3.7 pp.20–22; §3.8 pp.22–23 narrative; §3.9 p.24 communication example; §3.12 pp.30–33 selected audit narrative; §3.14 pp.36–37 concepts; Appendix 8.1 pp.44–46 selected control references.", "exclusions": "Opinion-based guidance with no completeness claim. Exclude its erroneous 10.1 corrective-action cross-references on viewer pp.23/37, older 7.4(d/e) and 9.2 letter references, universal CISO-role assertion and fixed three-year audit-cycle claim. Do not treat its documentation lists as an exact normative checklist. Use SGS and licensed current text for edition-sensitive checks. Appendix viewer p46 is misheaded “8 Organisational controls (continued)”; the 8.x rows are technological controls. Use the selected control IDs/names, not that header.", "currency": "Imprint: English translation team 2024; status September 2026, final after review/revision. This is not the separate third-party machine translation. Retrieved 29 October 2026.", "verified_free": true, "practice_key_status": "Publisher practical examples without a Foundation examination key; Atlas exercises below are original editorial models.", "primary_support_note": "The publisher explicitly makes the guide free to obtain while reserving reproduction rights. Link readers to the source. It substantially improves applied teaching but does not replace licensed requirements or official PECB material." }, { "id": "ISOG_ENISA_GUIDE", "title": "NIS2 Technical Implementation Guidance — selected guidance and evidence examples", "issuer": "ENISA", "url": "https://www.enisa.europa.eu/sites/default/files/2025-06/ENISA_Technical_implementation_guidance_on_cybersecurity_risk_management_measures_version_1.0.pdf", "kind": "Official implementation and evidence guidance", "access": "Free direct 170-page PDF; no account or signup. Publication landing page confirms date 26 June 2025.", "account_required": false, "exact_scope": "Only selected GUIDANCE and EXAMPLES OF EVIDENCE: §1.1 viewer pp.14–16; §2.1 pp.22–26 (method/plan/owner/evidence); §2.3 pp.29–31; §6.4 pp.86–87; §7 pp.108–110; §8.2 pp.114–115; §11.2 pp.133–134; §13.2/13.3 pp.160–163 as relevant to one fictional control example.", "exclusions": "Written for particular entities under Commission Implementing Regulation (EU) 2024/2690, not ISO conformity or PECB certification. Do not import its SHALL text, annual/biennial frequencies, threshold examples, regulatory applicability, or compliance-risk acceptance suggestions into ISO requirements. Evidence lists inspire editorial records; they are not supplied ISO templates or exam answers.", "currency": "June 2025 version 1.0; source landing page dated 26 June 2025; selected pages inspected 29 October 2026.", "verified_free": true, "practice_key_status": "Evidence examples, no PECB assessment or official key.", "primary_support_note": "Useful for showing how a plan, approval, change record, test result, access review and management report differ. The fictional formats below are Atlas-authored, not ENISA forms." }, { "id": "ISOG_APG_DOCUMENT", "title": "Nonconformity — Documenting", "issuer": "ISO 9001 Auditing Practices Group, hosted by ISO committee", "url": "https://committee.iso.org/files/live/sites/tc176/files/PDF%20APG%20New%20Disclaimer%2012-2023/ISO-TC%20176-TF_APG-DocumentNonconformity.pdf", "kind": "Original educational audit guidance and blank report example", "access": "Direct public PDF; no account/payment.", "account_required": false, "exact_scope": "Viewer p.1 three-part finding list; p.2 first two paragraphs and summary/report-record paragraph; pp.3–4 report form structure only. Use fictional information.", "exclusions": "Historical ISO 9001 guidance, not normative ISO/IEC 27001 text or a formally endorsed ISO/IAF standard. Exclude the compressed 'If there is evidence' assertion: the evidence must establish failure of an applicable requirement. Do not claim the historical ISO 9001 edition is current.", "currency": "Edition 1, 13 January 2016, four pages; verified from original committee PDF 29 October 2026.", "verified_free": true, "practice_key_status": "Blank example form, no keyed scenario.", "primary_support_note": "Supports the shared finding pattern: applicable criterion, sufficient evidence and precise failure statement, followed by action/effectiveness records." }, { "id": "ISOG_APG_CLOSE", "title": "Nonconformity — review and closing", "issuer": "ISO 9001 Auditing Practices Group, hosted by ISO committee", "url": "https://committee.iso.org/files/live/sites/tc176/files/PDF%20APG%20New%20Disclaimer%2012-2023/ISO-TC%20176-TF_APG-ReviewNonconformity.pdf", "kind": "Original educational corrective-action guidance", "access": "Direct five-page public PDF; no account/payment.", "account_required": false, "exact_scope": "Viewer p.2 three definitions and cause-determination paragraph; p.3 three paragraphs after the 5 Whys table, stopping before 'In reviewing'; p.4 Closing Nonconformities two paragraphs.", "exclusions": "Historical quality-management concepts only, not ISO 27001 requirements. Exclude rigid 5 Whys table, software/brake examples, grammar/date heuristics and broad exceptions before Closing. ISO/IEC 27001:2022 corrective action is 10.2.", "currency": "Edition 1, 13 January 2016; ©2020 hosting copy; selected concepts verified 29 October 2026.", "verified_free": true, "practice_key_status": "Concept guidance, no official answer key.", "primary_support_note": "Supports distinguishing correction, cause analysis, cause-based action and objective evidence of effectiveness before closure. More than one cause may contribute." }, { "id": "ISOG_SGS_CHANGES", "title": "Comparing ISO/IEC 27001:2022 to ISO/IEC 27001:2013 — What are the changes?", "issuer": "SGS", "url": "https://www.sgs.com/-/media/sgscorp/documents/corporate/brochures/sgs-kn-iso-27001-2013-2022-guidance-doc-en.cdn.en-CI.pdf", "kind": "Primary certification-body edition-comparison guidance", "access": "Free seven-page direct PDF; no account/payment.", "account_required": false, "exact_scope": "Viewer p.2 new subclause table and switched 10.1/10.2 table; p.3 6.3/7.4/8.1 rows; p.4 monitoring, review-input change and Annex A distinction; p.5 6.1.3 and external-services rows.", "exclusions": "An edition-comparison document, not full requirements; ellipses omit substantial text. Historical comparison references are not present-edition claims. 2024 climate amendment is a separate reading.", "currency": "©2022; current direct publisher copy inspected 29 October 2026.", "verified_free": true, "practice_key_status": "No assessment/key.", "primary_support_note": "Confirms 2022 continual improvement 10.1 and nonconformity/corrective action 10.2; Annex A is not exhaustive, and control purposes/attributes are in 27002 rather than Annex A." }, { "id": "ISOG_PECB_COURSE", "title": "PECB ISO/IEC 27001 Foundation — public course and award information", "issuer": "PECB", "url": "https://pecb.com/en/education-and-certification-for-individuals/iso-iec-27001/iso-iec-27001-foundation/", "kind": "Free orientation to the selected paid route", "access": "Public page free; official course content and participation are paid.", "account_required": false, "exact_scope": "Learning objectives, educational approach, certificate requirements and general information only. Compare exact package inclusions before any purchase.", "exclusions": "This page does not provide course access, a regional quote, provider feedback, a booking or a credential. Do not transfer older Lead/Auditor routes or generic whitepaper exemption wording to this certificate programme.", "currency": "Live page checked 29 October 2026; consistent with edition-specific v1.5 handbook.", "verified_free": true, "practice_key_status": "Says course includes practical examples/discussions and exam-like practice tests; public page itself gives no test or key.", "primary_support_note": "The issuer requires the course, exam and application for the entry award; no professional or project experience prerequisite. Public general information describes exam/certificate fees as included in training; confirm written inclusions rather than automatically adding separate charges." }, { "id": "ISOG_PECB_ELEARNING", "title": "PECB ISO/IEC 27001 Foundation eLearning training brochure", "issuer": "PECB", "url": "https://pecb.com/pdf/brochures/iso-iec-27001-foundation-elearning.pdf", "kind": "Free delivery-format and paid-content orientation", "access": "Public ten-page brochure; actual course uses a PECB account and purchased/enrolled access.", "account_required": false, "exact_scope": "Viewer pp.3–4 describe delivery and quizzes; pp.7–8 show the agenda and learning objectives. Inspect this as product information only.", "exclusions": "Do not promise a Foundation correction key merely because the generic brochure says additional files depend on the training course. Do not treat generic 'unlimited access' wording as a verified access period. Confirm actual activities, keys, feedback, standards access and duration with the provider and current handbook.", "currency": "Brochure explicitly references ISO/IEC 27001:2022; no reliable publication date printed in selected text. Checked 29 October 2026.", "verified_free": true, "practice_key_status": "Brochure mentions quizzes and course-dependent exercise/correction files behind enrolled access. No public full Foundation keyed assessment is supplied.", "primary_support_note": "Useful evidence that material access and included practice must be checked within the selected package; it is not free replacement teaching." }, { "id": "ISOG_ISO27001_LICENSE", "title": "ISO/IEC 27001:2022 — official requirements standard access boundary", "issuer": "ISO", "url": "https://www.iso.org/standard/27001", "kind": "Licensed requirements standard, with free catalogue/preview", "access": "Catalogue is free; full standard is priced/licensed. Use legitimate course, employer or library provision where available before buying separately.", "account_required": false, "exact_scope": "Public catalogue identifies the published 2022 third edition, its purpose, and one amendment. Only catalogue and limited preview are free public reading verified here.", "exclusions": "No full clauses, Annex A reproduction or unrestricted redistribution right is supplied by this link. Full access remains conditional on a valid licence.", "currency": "Catalogue inspected 29 October 2026: ISO/IEC 27001:2022, edition 3, publication October 2022, one amendment.", "verified_free": false, "practice_key_status": "No exam questions/key.", "primary_support_note": "Keeps supplemental guides separate from the authoritative requirements. A bibliography or public abstract does not establish full licensed standards access." }, { "id": "ISOG_ISO27002_LICENSE", "title": "ISO/IEC 27002:2022 — official control-guidance access boundary", "issuer": "ISO", "url": "https://www.iso.org/standard/75652.html", "kind": "Licensed control-guidance standard, with free catalogue/preview", "access": "Catalogue and limited preview free; full 27002 is priced/licensed. Do not automatically add a purchase if legitimate included/library/employer access exists.", "account_required": false, "exact_scope": "Official catalogue purpose, edition and access terms; no complete control teaching or all 93 controls reproduced.", "exclusions": "Not a free full control course or a redistribution licence. A few theme examples cannot replace required course control-level coverage.", "currency": "Catalogue inspected 29 October 2026: edition 3, February 2022, corrected March 2022.", "verified_free": false, "practice_key_status": "No exam questions/key.", "primary_support_note": "27002 is control guidance, distinct from 27001 requirements and the selected PECB course." }, { "id": "ISOG_ISO27000_OVERVIEW", "title": "ISO/IEC 27000:2026 — current ISMS overview and family relationships", "issuer": "ISO", "url": "https://www.iso.org/standard/27000", "kind": "Free catalogue overview and CHF0 publication listing", "access": "Public catalogue overview read without account. It lists CHF0 for the publication, but no checkout was performed and unrestricted redistribution is not granted.", "account_required": false, "exact_scope": "Catalogue sections What is, Why important and FAQ only: ISMS concepts, principles and family relationships.", "exclusions": "The sixth edition is not primarily a terminology document and does not supply ISO27001 requirements. CHF0 is not permission to republish the standard. Full download/checkout/account process not tested.", "currency": "Published July 2026, edition 6; catalogue identifies 2018 as withdrawn; verified 29 October 2026.", "verified_free": true, "practice_key_status": "No assessment/key.", "primary_support_note": "Useful free orientation; do not preserve the obsolete claim that ISO/IEC 27000:2026 is the current vocabulary source." }, { "id": "ISC2_Knowledge_Check", "title": "ISC2 CC short knowledge check — live questions and immediate explanations", "issuer": "ISC2", "url": "https://cloud.connect.isc2.org/cc-quiz", "kind": "Official short practice; selected topics", "access": "Free questions and immediate explanations were inspected in the public widget on 29 October 2026. The final results report requires a personal-details form and privacy agreement; it is optional for reading the individual explanations. No form was submitted during this review.", "account_required": "No account/details needed for the inspected questions and their immediate explanations. A results form asks for name, email, country and company; training-interest sharing and future-offer choices also appear.", "exact_scope": "Ten selected-topic questions were inspected through the issuer-linked public widget: due care/diligence, RTO, least privilege, conventional zones, threat modelling, a risk decision, GRC frameworks/tools, ABAC, administrative controls and public-key confidentiality. Individual explanations were displayed. Use as short topic practice, following the current outline separately.", "exclusions": "Not a full current-outline assessment, no complete five-domain or AI-application coverage established. Do not use the broad wording of its risk-tolerance item as the precise NIST appetite/tolerance distinction. Conventional internal-zone labels do not establish Zero Trust or make internal traffic safe. The website links to the publisher; no questions or keys are copied.", "currency": "Live browser inspection 29 October 2026; widget content and access may change. The visible final step was a results form, not an additional scored question.", "verified_free": true, "practice_key_status": "Issuer's immediate explanations observed for the ten items; final score report not obtained because it requires details. This is not validation of a full examination bank.", "primary_support_note": "Official ISC2 knowledge-check hub links to this widget. Live access and feedback inspection is recorded separately from publisher alignment claims." }, { "id": "CCP_PEARSON_DEMO", "title": "Pearson computer-based examination demonstration", "issuer": "Pearson VUE", "url": "https://www.pearsonvue.com/us/en/test-takers/demo-test.html", "kind": "Free examination-interface orientation", "access": "Free public orientation page and demonstration launch link. No purchase is required to read the page. The generic demo is optional; the complete interactive session was not completed in this review.", "account_required": "No account required for the public orientation page; demonstration access may depend on browser compatibility.", "exact_scope": "Public description and launch link for learning computer-based examination navigation. Use to reduce interface unfamiliarity only, then follow ISC2's own current examination rules.", "exclusions": "Not cybersecurity teaching, a CC mock, an official CC key or evidence that every generic demo tool appears in CC. Generic back/review controls must not be transferred to CC: ISC2 says finalized CAT answers cannot be reviewed or changed.", "currency": "Pearson public page opened 29 October 2026. The launch redirected to Pearson's test delivery endpoint, which the web reader could not load; no successful full demo run is claimed.", "verified_free": true, "practice_key_status": "No cybersecurity answer key; orientation only.", "primary_support_note": "Original examination-delivery provider describes the purpose of its own demo. ISC2 CAT guidance supplies the separate CC rule boundary." }, { "id": "CCP_FREE_PROGRAM_STATUS", "title": "ISC2 announcement ending new One Million CC enrollments", "issuer": "ISC2", "url": "https://www.isc2.org/insights/2026/04/one-million-certified-cyber-conclusion", "kind": "Official access and cost clarification", "access": "Free public announcement. It does not provide a new free course or examination entitlement.", "account_required": false, "exact_scope": "Program Conclusion and Certified in Cybersecurity Availability: new program enrollments closed on 20 May 2026. Existing unexpired exam codes may be used to sit by 31 December 2026; existing course access depends on its own expiry. Official course purchase is not required to sit CC.", "exclusions": "No claim about an individual learner's code or course access. Older free-offer tutorials are excluded as instructions for new applicants. This announcement is access evidence, not teaching or a practice assessment.", "currency": "Official 22 April 2026 announcement directly read again on 29 October 2026.", "verified_free": true, "practice_key_status": "Not a question set.", "primary_support_note": "Issuer's own program-closure and access rules, not an affiliate's description." }, { "id": "AIG_NIST_ERM_DIRECTION", "title": "NIST IR 8286r1: enterprise risk direction, appetite and tolerance", "issuer": "NIST", "url": "https://nvlpubs.nist.gov/nistpubs/ir/2025/NIST.IR.8286r1.pdf", "kind": "Free primary reference, selected passage only", "access": "Public official PDF readable without account or payment; selected passage independently checked on 29 October 2026.", "account_required": false, "exact_scope": "Viewer p.16 (printed p.7), section 2.1 Enterprise Risk Direction: appetite and tolerance paragraphs, footnote 11, and email availability example only.", "exclusions": "No full enterprise risk course, mandatory Cedar threshold, official exercise key or learner marking. The federal performance-variance quotation is context-specific.", "currency": "NIST IR 8286r1, December 2025; official final publisher page confirms this supersedes the 2020 edition.", "verified_free": true, "practice_key_status": "Conceptual guidance with illustrative example; no assessment or scored key.", "primary_support_note": "Supports explicit appetite/tolerance teaching. Footnote 11 notes that some earlier NIST guidance uses tolerance to cover both concepts." }, { "id": "CCG_MITRE_HISTORICAL_COMPARISONS", "title": "MITRE current definitions for comparing the historical ticket", "issuer": "MITRE ATT&CK", "url": "https://attack.mitre.org/techniques/T1059/003/", "additional_urls": [ "https://attack.mitre.org/techniques/T1518/001/" ], "kind": "Free primary reference; selected current definitions", "access": "Both current public technique definitions were opened and read in the source review; no account or payment.", "account_required": false, "exact_scope": "Opening definition and ID/tactic metadata for T1059.003 Windows Command Shell and T1518.001 Security Software Discovery only. Compare with cmd.exe and security-tool discovery evidence in the old ticket, without replacing its historical key.", "exclusions": "No command execution, target probing, replacement publisher key or automatic mapping of every firewall query to one technique. Historical and current versions remain distinct.", "currency": "Current publisher definitions checked 29 October 2026; recheck version metadata when comparing a later ATT&CK release.", "verified_free": true, "practice_key_status": "Current definitions support an editorial comparison; they are not a new official ticket key.", "primary_support_note": "Both current definitions were directly inspected by the CC reviewer." } ], "rejected_or_unverified": [ { "title": "ASD Network segmentation and segregation — Anti-patterns", "url": "https://www.cyber.gov.au/publication/network-segmentation-and-segregation-anti-patterns", "status": "not_counted", "reason": "Search indexing exposed useful text and indicated a 2026 revision, but repeated full public page reads timed out in the browser reader and an ordinary direct request. It is not counted as fully reviewed teaching or closure. Use the verified implementing-segmentation and NIST inspection passages instead." }, { "title": "NCSC Exercise in a Box catalogue / complete exercise packs", "url": "https://www.ncsc.gov.uk/section/exercise-in-a-box/overview", "status": "catalogue_only_not_counted", "reason": "The overview and Getting started page are free and were read; the latter describes downloaded facilitator/participant packs and scribe sheets. Those pages alone do not verify the content or feedback of every exercise pack or any service account requirement. No signup was performed, and the whole catalogue is not claimed as completed teaching. The actual exercise-creation article and complete original CC06 case supply the bounded new coverage." }, { "title": "CISA CTEP package listing / separate AAR-IP template", "url": "https://www.cisa.gov/resources-tools/resources/ctep-package-documents", "status": "listing_not_counted_as_content", "reason": "The package listing did not load in the browser reader. Only the specific Facilitator/Evaluator Handbook whose pages were actually read through an ordinary public request is counted. No claim is made that every situation manual, template or answer was reviewed." }, { "title": "UK government tailgating PDF", "url": "https://www.security.gov.uk/wp-content/uploads/2024/04/tailgating.pdf", "status": "unverified_not_counted", "reason": "Public browser reader returned 403; actual document teaching was not read in this review, so its title/search description is not used as evidence for closure." }, { "title": "Cisco networking / Packet Tracer catalogue and commercial CC guide listings", "url": "https://www.netacad.com/courses/networking-basics", "status": "not_counted_for_assigned_case", "reason": "No account was created, simulator installed, commercial book purchased or complete course feedback inspected. Catalogue availability and a proposed book purchase do not supply the required reviewed walkthrough. The free sources and original paper model are sufficient for the bounded CC04 objective." }, { "title": "Microsoft Foundry guardrails exercise", "url": "https://learn.microsoft.com/en-us/training/modules/responsible-ai-studio/7-exercise-content-filters", "status": "Excluded from the free no-account route", "reason": "Actual unit read. It says an Azure subscription is needed and the exercise deploys an AI model. The instructions are publicly readable, but service/API/compute use is not established as free. No subscription, trial or model was started." }, { "title": "Microsoft responsible AI module assessment", "url": "https://learn.microsoft.com/en-us/training/modules/responsible-ai-studio/8-knowledge-check", "status": "Questions public; returned publisher key/rationale unverified", "reason": "Actual current assessment unit opened: three multiple-choice questions are visible, and the page says all must be answered before checking work. No submitted-answer feedback/rationales were verified. The module page says sign-in is needed to earn a profile pass designation. Do not advertise it as independently marked feedback on these four artifacts or as a complete CC AI assessment." }, { "title": "Australia National AI Centre Test your scenario facilitator package", "url": "https://www.ai.gov.au/practical-guides-and-learning/planning-tools-and-templates/test-your-scenario", "status": "Potentially useful official free discussion package; not counted as gap coverage", "reason": "Public landing page directly read and lists facilitator PDF and three scenario slide downloads. PDF initially reported 9 pages but repeated content fetches timed out, so actual facilitator guidance/scenario content and any answer guidance were not verified. Catalogue/landing-page discovery alone is insufficient." }, { "title": "NIST Playbook linked resource catalogues and use-case index", "url": "https://airc.nist.gov/airmf-resources/playbook/", "status": "Not counted as additional teaching or feedback", "reason": "The selected actual subcategory passages, rather than the resource index alone, supply teaching. Unread third-party references and unverified case catalogues do not establish free access, instructional completeness, feedback or exam alignment." }, { "title": "Wiley CC Study Guide and unspecified paid/current course practice", "url": "https://www.wiley.com/en-ie/cc-certified-in-cybersecurity-study-guide-2nd-edition-p-9781394454891", "status": "No free full-content or marked-feedback claim made", "reason": "Existing paid-route pointer retained for the parent audit only. This research did not purchase, access paid chapters or verify feedback on AI01/AI02/AI04/AI05 artifacts. No need to pay is inferred from the remaining independent-feedback gap." }, { "title": "Exact current PECB three-policy definitions", "status": "Not verified", "reason": "The current official handbook names three categories; the current public policy article does not define all three. The 2017 PECB Insights article uses governance-level/technical-level categories, a different two-level framework. No current official contrasting examples or classification key located." }, { "title": "Full free current official PECB Foundation keyed assessment", "status": "Not found in bounded primary-source search", "reason": "Current handbook has five unkeyed public samples. Course page describes included practice, and brochure mentions course-dependent correction files behind enrolled access. No full public current 40-question Foundation test with a verified issuer key located. This is a search finding, not proof no such resource can ever exist." }, { "title": "ISACA landing page's English download", "url": "https://www.isaca.de/publikationen/publikationen/leitfaeden/implementierungsleitfaden-iso-iec-27001-2022.html", "status": "Do not use its English link as a 2022 edition", "reason": "At the check, its English hyperlink targeted ISACA_Implementation_Guideline_ISMS_2016.pdf. Use the separately verified current publisher English PDF in ISOG_ISACA_GUIDE." }, { "title": "Older BSI globalassets guide and webinar URLs", "status": "Redirected", "reason": "The old globalassets/localfiles/en-gb guide URL and en-th November 2022 webinar PDF URL redirected to regional home pages. Search-index snippets alone were not accepted as a working free resource." }, { "title": "BSI certification-kit signup, delegate workbooks and paid SME handbook", "status": "Excluded from free no-signup teaching", "reason": "The certification-kit page asks for a form; course delegate materials are restricted to delegates, and the SME handbook is a paid product. No signups, purchases or unofficial copies used." }, { "title": "Guessed BSI workbook filename", "status": "Invalid resource", "reason": "The attempted iso27001_workbook.pdf path redirected to the BSI homepage. It is not a verified PDF; the actual free self-assessment checklist has a different URL." }, { "title": "ENISA supplementary mapping spreadsheet", "url": "https://www.enisa.europa.eu/sites/default/files/2025-09/ENISA_Technical_Implementation_Guidance_Mapping_table_version_1.2.xlsx", "status": "Not assigned as teaching", "reason": "Official landing page links this workbook, but content was not inspected in this subtask. It is a mapping aid, not evidence of a complete keyed ISO Foundation assessment or an official ISMS fill-in template." }, { "title": "Unofficial course PDFs, exam dumps, community 'real exam' banks and secondary policy-taxonomy keys", "status": "Excluded", "reason": "No leaked/restricted course materials, candidate recollections, exam dumps or invented publisher keys were used. Search snippets or a third party's confidence claim do not establish authorized current answers." }, { "candidate": "Old tutorials advertising universally free new CC enrollment", "reason": "Excluded as access instructions: the issuer closed new One Million program enrollments on 20 May 2026." }, { "candidate": "Third-party current-outline free full-mock advertising", "reason": "Advertisements and partner claims did not establish complete item/answer provenance, coverage and feedback in this review. Not adopted as a verified full assessment." }, { "candidate": "Pearson demo as a CC CAT simulator", "reason": "Excluded inference: a generic navigation demo does not reproduce CC content, CAT item selection or CC review rules." } ], "authorship": "Original editorial cases and model guidance based on bounded primary readings. No publisher exam items or full licensed requirements are reproduced.", "review_status": "All nineteen new guides and their assigned public primary scopes independently reviewed on29October2026; corrections integrated. Eight bounded introductory material needs supplied, nine partial, two official needs open. No issuer approval, learner assessment, full normative access or complete exam-readiness claim.", "independent_review": { "guide_count": 19, "all_assigned_guide_fields_reread": true, "original_need_components_reviewed": true, "primary_source_scope_review": "All assigned passages were rechecked through publisher text or registered original public PDFs; individual access/version limits are retained in source records.", "separate_subject_reviews": 3, "corrections_integrated": true, "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "quiz_855_semantically_rereviewed_in_this_update": false, "coverage_register": "exam-coverage.html" }, "previous_materials_summary": { "original_gap_areas": 19, "introductory_gaps_addressed": 8, "partial": 9, "open": 2, "remaining_partial_or_open": 11, "publisher_scope_records_reviewed": 51, "free_reading_or_orientation_records": 49, "licensed_full_material_boundaries": 2, "source_records_added": 50, "source_records_updated": 1, "new_distinct_publisher_urls": 29, "basis": "Counts describe available material for the original bounded introductory needs, not independent marking, mastery, exam coverage percentages or complete certification preparation." }, "review_update": { "date": "2026-10-29", "kind": "second_review_of_all_nineteen_guides", "changes": [ "Evidence-versus-proposal timeline repair", "Comparable anomaly windows and classification", "Explicit risk direction and role separation", "ISO continuity, awareness, measures, party requirements and source exclusions", "Course ethics/deadline/package distinctions", "Scope register and route separation" ], "coverage_summary": { "cc_objectives_checked": 19, "cc_printed_bullet_positions_checked": 59, "cc_ai_applications_checked": 5, "pecb_statements_checked": 65, "complete_exam_coverage_claimed": false, "pass_prediction": false }, "independent_review": { "guide_count": 19, "all_assigned_guide_fields_reread": true, "original_need_components_reviewed": true, "primary_source_scope_review": "All assigned passages were rechecked through publisher text or registered original public PDFs; individual access/version limits are retained in source records.", "separate_subject_reviews": 3, "corrections_integrated": true, "learner_work_assessed": false, "full_licensed_normative_text_checked": false, "quiz_855_semantically_rereviewed_in_this_update": false, "coverage_register": "exam-coverage.html" } } }