Keep the source in view.

selected IBM teaching: access controls and policies
Bounded primary or first-party professional reference

Only How access control works and Access control policies; check actual models covered Guide section 10: How access control works and Access control policies only. Supplemental primary verification only (not a new whole-publication assignment): How access control works; Access control policies

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Policy enforcement and permitted resource actions only; no market/product claims. The article describes typical authenticated access; anonymous authorization is assessed separately.

NIST SP 800-162: ABAC and RBAC concepts
Bounded primary or first-party professional reference

Viewer p.15: RBAC paragraph only; optional first ABAC paragraph for comparison. The former viewer-p.14 access-matrix assignment is withdrawn: that page does not define an access-control matrix. Use NIST_MATRIX for the matrix definition.

Excluded or limited: No access-matrix definition is attributed to SP 800-162 p.14. Implementation advice and the remainder of the publication are outside this reading.

Editorial AI introduction
Editorial companion, selection or scope record; not independent primary evidence

Selected beginner AI explanations. Primary excerpts and reading limits remain the evidence.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

Correction, cause analysis, corrective action and effectiveness
Bounded primary or first-party professional reference

Viewer p.2 three definitions and the paragraph beginning “Corrective action cannot be taken”; p.3 three paragraphs after the 5 Whys table, ending before “In reviewing”; p.4 “Closing nonconformities” two paragraphs only. ISO 9001 concept supplement only. Skip the rigid 5 Whys table, generic software/brake examples, grammar/date heuristics and the unassigned contextual discussion before “Closing”. ISO 27001:2022 corrective action is clause 10.2; do not use the older guide’s 10.1 cross-references. Guide section 28: Viewer p.2 three definitions and “Corrective action cannot be taken” paragraph; p.3 three paragraphs after 5 Whys table before “In reviewing”; p.4 Closing two paragraphs only. Supplemental primary verification only (not a new whole-publication assignment): viewer p2 definitions and Corrective action cannot be taken paragraph; p3 three paragraphs after 5Whys table; p4 Closing nonconformities two paragraphs Viewer p.2: definitions, cause-analysis explanation and following effectiveness/closure paragraphs

Excluded or limited: ISO 9001 concept supplement only. Skip the rigid 5 Whys table, generic software/brake examples, grammar/date heuristics and the unassigned contextual discussion before “Closing”. ISO 27001:2022 corrective action is clause 10.2; do not use the older guide’s 10.1 cross-references. Preserve its historical ISO 9001 context. ISO 9001:2026 is the published edition; these older examples are not current ISO 27001 requirements. Verification limits: Original educational guidance (not formally endorsed ISO/IAF standard text). Several possible causes, iterative analysis and effectiveness evidence. Rigid5Whys table and examples excluded; no ISO27001 clause-number transfer. Historical QMS audit guidance used for stable correction/cause/corrective-action distinctions only. Not normative ISO27001 requirements.

Nonconformity — review and closing
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer p.2 three definitions and cause-determination paragraph; p.3 three paragraphs after the 5 Whys table, stopping before 'In reviewing'; p.4 Closing Nonconformities two paragraphs. Practice/feedback status: Concept guidance, no official answer key.

Excluded or limited: Historical quality-management concepts only, not ISO 27001 requirements. Exclude rigid 5 Whys table, software/brake examples, grammar/date heuristics and broad exceptions before Closing. ISO/IEC 27001:2022 corrective action is 10.2. Currency: Edition 1, 13 January 2016; ©2020 hosting copy; selected concepts verified 29 October 2026.

Competence needs and evidence of ability
Bounded primary or first-party professional reference

Viewer p.5 heading “Determination of necessary competence” and its three paragraphs; p.6 “Actions to acquire necessary competence” and “Evaluating effectiveness of those actions”, stop at “Documented information”. ISO 9001 guidance; transfer the concepts, not its QMS clause references. Completing a course alone does not prove competence. Do not infer the selected certificate’s experience or eligibility rules from examples about job qualifications. Guide section 6: Viewer p.5 “Determination” three paragraphs; p.6 “Actions” and “Evaluating effectiveness”, stop before documented information. Shared concept only. Guide section 26: Viewer p.5 Determination three paragraphs; p.6 Actions/Evaluating effectiveness before documented information. Supplemental primary verification only (not a new whole-publication assignment): viewer pp2–3 competence assessment discussion, including observation of task performance

Excluded or limited: ISO 9001 guidance; transfer the concepts, not its QMS clause references. Completing a course alone does not prove competence. Do not infer the selected certificate’s experience or eligibility rules from examples about job qualifications. Preserve its historical ISO 9001 context. ISO 9001:2026 is the published edition; these older examples are not current ISO 27001 requirements. Verification limits: Original educational auditing guidance, not a full ISO27001 competence requirement. Attendance is not substituted for demonstrated applied ability.

How to describe a nonconformity
Bounded primary or first-party professional reference

Viewer p.1: definition of nonconformity and its three-part evidence/requirement/statement list only; p.2 first two paragraphs and the final summary/NCR-record paragraphs; p.3 blank report form as a paper example. Informal ISO/IAF expert guidance for ISO 9001, not an endorsed standard or an ISO 27001 requirement checklist. Skip the overly compressed “If there is evidence” sentence: evidence must demonstrate failure of an identified requirement. Do not fill in real personal or organizational records. Guide section 28: Viewer p.1 definition/three-part record list; p.2 first two paragraphs and final summary/NCR reference; p.3 blank report only. Exclude compressed “If there is evidence” assertion. Supplemental primary verification only (not a new whole-publication assignment): Viewer p.1 definition and three-part evidence/requirement/statement list

Excluded or limited: Informal ISO/IAF expert guidance for ISO 9001, not an endorsed standard or an ISO 27001 requirement checklist. Skip the overly compressed “If there is evidence” sentence: evidence must demonstrate failure of an identified requirement. Do not fill in real personal or organizational records. Preserve its historical ISO 9001 context. ISO 9001:2026 is the published edition; these older examples are not current ISO 27001 requirements. Verification limits: Informal2016 guidance; evidence must demonstrate failure of an applicable requirement. Compressed If-there-is-evidence sentence not adopted.

Nonconformity — Documenting
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer p.1 three-part finding list; p.2 first two paragraphs and summary/report-record paragraph; pp.3–4 report form structure only. Use fictional information. Practice/feedback status: Blank example form, no keyed scenario.

Excluded or limited: Historical ISO 9001 guidance, not normative ISO/IEC 27001 text or a formally endorsed ISO/IAF standard. Exclude the compressed 'If there is evidence' assertion: the evidence must establish failure of an applicable requirement. Do not claim the historical ISO 9001 edition is current. Currency: Edition 1, 13 January 2016, four pages; verified from original committee PDF 29 October 2026.

Improvement and resource prioritization
Bounded primary or first-party professional reference

Viewer p.2 “Improvement of the product, process or improvement of the QMS?” first three paragraphs, stop before “Instead, the auditor”. Generic management-system concept only. Skip aeronautical defect-rate claims and the ISO 9001-specific conformity conclusions. This is not the text of ISO 27001 clause 10.1. Guide section 28: Viewer p.2 first three paragraphs from “Improvement of the product”; stop before “Instead the auditor”. Shared concept only. Supplemental primary verification only (not a new whole-publication assignment): viewer p2 Improvement of the product, process or improvement of the QMS? first3 paragraphs

Excluded or limited: Generic management-system concept only. Skip aeronautical defect-rate claims and the ISO 9001-specific conformity conclusions. This is not the text of ISO 27001 clause 10.1. Preserve its historical ISO 9001 context. ISO 9001:2026 is the published edition; these older examples are not current ISO 27001 requirements. Verification limits: Original educational guidance only; improvement can address system itself and prioritization. ISO9001 conformity assertions and aeronautical examples excluded.

Internal audit purpose and impartiality
Bounded primary or first-party professional reference

Viewer p.1 Introduction only; p.2 “Audit guidance” first two bullets (competence and objectivity/impartiality) only. ISO 9001 concept supplement. Other QMS requirements, cycle rules and ISO 19011 references are unassigned; it does not supply the complete PECB audit material.

Excluded or limited: ISO 9001 concept supplement. Other QMS requirements, cycle rules and ISO 19011 references are unassigned; it does not supply the complete PECB audit material. Preserve its historical ISO 9001 context. ISO 9001:2026 is the published edition; these older examples are not current ISO 27001 requirements.

Policy deployment and management-review decisions
Bounded primary or first-party professional reference

Viewer p.1 “Audit methods should include” five bullets; p.2 §3 first paragraph; p.3 paragraph beginning “As outputs” and its bullets, plus the single paragraph beginning “Documented information on management reviews”. ISO 9001 concept supplement only. Its input/output examples and review arrangements do not supply the exact ISO 27001:2022 9.3 requirements. Those and PECB policy taxonomy remain with authorized courseware. Guide section 27: Viewer p.1 five methods; p.2 §3 first paragraph; p.3 outputs paragraph/bullets and single review-record paragraph only. Supplemental primary verification only (not a new whole-publication assignment): Viewer p.2 §3 opening; p.3 As outputs paragraph/bullets and documented-information paragraph

Excluded or limited: ISO 9001 concept supplement only. Its input/output examples and review arrangements do not supply the exact ISO 27001:2022 9.3 requirements. Those and PECB policy taxonomy remain with authorized courseware. Preserve its historical ISO 9001 context. ISO 9001:2026 is the published edition; these older examples are not current ISO 27001 requirements. Verification limits: 2016 informal expert quality-system supplement. Management review concept only; not endorsed ISO27001 requirements.

Resources and management responsibility
Bounded primary or first-party professional reference

Viewer p.1 Introduction first two paragraphs; p.3 “Interviewing top management” paragraph and last paragraph beginning “Auditors should avoid”. ISO 9001 concept supplement only. The source’s specific resource categories, metrology, production clauses and examples are not ISO 27001 requirements. Guide section 26: Viewer p.1 first two introductory paragraphs; p.3 interview-with-management paragraph and final “Auditors should avoid” paragraph only. Supplemental primary verification only (not a new whole-publication assignment): Auditing Resources, edition2, p1 Introduction first two paragraphs; p3 Interviewing Top Management and final Auditors should avoid paragraph; PDF viewer pages 1,3

Excluded or limited: ISO 9001 concept supplement only. The source’s specific resource categories, metrology, production clauses and examples are not ISO 27001 requirements. Preserve its historical ISO 9001 context. ISO 9001:2026 is the published edition; these older examples are not current ISO 27001 requirements. Verification limits: Non-endorsed educational APG author guidance about adequacy for intended results; general concept only, not ISO27001 clause obligations.

optional APMG sample portal — access note only
Publisher access option; underlying lessons or questions are not verified teaching here

Optional free online sample access; selected product exists, public entry description only; actual questions and keys require review

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

Current Wi-Fi modes and deprecated protocols
Bounded primary or first-party professional reference

Only the list of six supported WPA2/WPA3 network types and the “Deprecated protocols” list with its warning and migration recommendation. Skip device/OS compatibility lists, absolute assurance wording, broad 128-bit statements and detailed R3/implementation sections. Personal and Enterprise are modes, not generations of Wi-Fi speed. This is a conceptual security overview, not a configuration guide. Guide section 13: Only the six security-mode names and deprecated-protocol list; no blanket device-support or assurance claims. Supplemental primary verification only (not a new whole-publication assignment): Apple Platform Security: six network type names; Deprecated protocols list and warning

Excluded or limited: Skip device/OS compatibility lists, absolute assurance wording, broad 128-bit statements and detailed R3/implementation sections. Personal and Enterprise are modes, not generations of Wi-Fi speed. This is a conceptual security overview, not a configuration guide. Verification limits: Only named security modes and deprecated entries; exclude broad assurance/128-bit and compatibility claims. Official live source also checked.

selected MITRE ATT&CK introduction
Bounded primary or first-party professional reference

Only introductory What is ATT&CK?, use, and tactics/techniques definitions Guide section 18: Introduction, use, tactics and techniques explanations only; no simulation or live tests. Supplemental primary verification only (not a new whole-publication assignment): FAQ: What is ATT&CK?; what are tactics/techniques/procedures? ATT&CK FAQ: What are tactics?, What are techniques?, relationship with Diamond Model

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Original publisher knowledge-base roles. Mapping/detection/attribution limits are logical inferences about evidence, not a claim MITRE validated fictional facts. Tactic purpose, technique method, credential example; technique label alone cannot prove a particular group.

Editorial identity and password companion
Editorial companion, selection or scope record; not independent primary evidence

Beginner identity, authentication and password orientation. It is not an independent authority.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

selected IBM teaching: business continuity
Bounded primary or first-party professional reference

Definitions, business continuity plan, comparison with disaster recovery, and the four planning steps; skip promotions Guide section 7: Definition, plan, BC-versus-DR and four planning steps only. Supplemental primary verification only (not a new whole-publication assignment): What is business continuity?; Business continuity plans versus disaster recovery plans Opening definition; Business continuity plans versus disaster recovery plans, relevant comparison paragraph

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Business functions and broader continuity versus technical recovery; excludes survey/cost figures and over-broad BIA risk-likelihood claim. Bounded modern BC/DR distinction only. Product, survey, legal and cost claims and an absolute proactive/reactive distinction are excluded.

BSI ISO 27001:2022 clause explanations
Bounded primary or first-party professional reference

PDF pp. 5–7 only: clause structure and short explanations; on p. 5 skip sections 2 and 3 (normative references/terms), which are not assigned as current vocabulary teaching PDF pp. 5–6: clauses 4–5; concise introduction; on p. 5 skip sections 2 and 3 (normative references/terms), which are not assigned as current vocabulary teaching PDF p. 6: clause 6 summary only; on p. 5 skip sections 2 and 3 (normative references/terms), which are not assigned as current vocabulary teaching PDF p. 6 SoA explanation and p. 7 Annex A paragraph; on p. 5 skip sections 2 and 3 (normative references/terms), which are not assigned as current vocabulary teaching PDF pp. 6–7: clauses 7–8; on p. 5 skip sections 2 and 3 (normative references/terms), which are not assigned as current vocabulary teaching PDF p. 7: clauses 9–10; on p. 5 skip sections 2 and 3 (normative references/terms), which are not assigned as current vocabulary teaching Guide section 5: Viewer pp.5–7 concise planning/risk overview; skip p.5 §§2–3. Guide section 23: Viewer pp.5–7 selected clause overview; skip p.5 §§2–3 as current reference/terminology teaching. Guide section 24: Viewer pp.5–7 selected context, leadership and planning explanations; p.5 §§2–3 excluded. Guide section 25: Viewer pp.5–7 planning and Annex A overview only; not full requirements/control descriptions. Guide section 26: Viewer pp.5–7 selected support/operation explanations only. Guide section 27: Viewer pp.5–7 selected clause 9 overview only. Supplemental primary verification only (not a new whole-publication assignment): ISO/IEC27001 implementation overview viewer p6 Clause7 Support; p7 AnnexA paragraph Viewer p.5 clause4 only; p.6 clauses5–7; p.7 clauses8–10 ISO27001:2022 implementation guide, clauses4-7 explanatory paragraphs; PDF viewer pages 5,6

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Standards-body overview: communications to whom/when/how and 93 reference controls; not full licensed standard/control teaching or proof of applicability. Primary professional implementation-guide explanation; orientation only. This is not ISO normative text. pp.5 clauses2–3 excluded as current vocabulary. BSI-authored conceptual orientation only; not normative clause text, a full scope checklist or complete SoA requirements.

ISO/IEC 27001:2022 Information Security — Your implementation guide
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer pp.5–7, selected clause 4–10 overview paragraphs. Read the relevant paragraph alongside the corresponding fictional work item, rather than assigning the whole brochure. Practice/feedback status: Guidance, without keyed exercises.

Excluded or limited: Skip marketing, certification promises, and pp.5 references describing ISO/IEC 27000 as current vocabulary: ISO/IEC 27000:2026 changed purpose. The short guide is not complete authorized requirements or Amendment 1 teaching. Currency: Cover explicitly identifies ISO/IEC 27001:2022; no reliable publication date printed in extracted pages. Current direct publisher PDF and 2026 roadmap link verified 29 October 2026.

BSI organizational reflection worksheet — selected questions
Bounded publisher practice or reflection; not a complete fresh exam

PDF p. 4, questions 1–7; apply to the fictional studio and identify evidence, not a yes/no maturity score PDF p. 5, questions 8–16; explain reasoning and supporting records PDF p. 5 questions 12–14 only; no full SoA is supplied PDF p. 6 questions 17–23 PDF p. 7 questions 24–26 and 29 only; skip repeated questions 27/28 and all scores. Direct SoA support: viewer p.5 question 13 covers chosen controls, selection/exclusion/addition reasons and implementation status; this is publisher guidance, not full normative clause 6.1.3.

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

Information Security Management System ISO/IEC 27001 — Self-assessment checklist
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer pp.4–6 questions 1–23; p.7 questions 24–26 and 29 once each. Use questions as prompts to identify fictional evidence, not as yes/no claims about a real organization. Practice/feedback status: No right/wrong publisher key: organization-specific self-assessment. No score may be used to predict exam success.

Excluded or limited: Exclude maturity scores, score-based certification recommendations, duplicate q27/q28, stray BCMS text and promotional follow-ons. No complete management-review input checklist. It is neither an exam mock nor an independently validated assessment. Currency: ©2025, 11-page PDF, retrieved 29 October 2026. Page 7 was rendered and visually inspected: q24/q28 and q25/q27 repeat.

Bluetooth SIG: Bluetooth Technology Overview
Bounded primary or first-party professional reference

Bluetooth Classic and Bluetooth LE introductory paragraphs only; skip PHY tables and promotion Guide section 13: Bluetooth Classic and Bluetooth LE introductory paragraphs only; skip comparison table/marketing.

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Radio family, variant functions and compatibility reasoning; no comparison-table numeric or product-marketing claims.

Bluetooth SIG: Bluetooth Security
Bounded primary or first-party professional reference

Opening security explanation only; security depends on implementation and configuration Guide section 13: Opening security concepts only; no implementation/configuration assignment. Supplemental primary verification only (not a new whole-publication assignment): Security in Bluetooth specifications; Bluetooth security education opening paragraphs

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Security choices and implementation responsibilities; family label alone does not establish security.

ISC2 CC exam outline, effective 1 September 2026
Official exam scope or route reference; not complete teaching

Current outline: viewer pp.1–3 orientation and exam information; pp.4–7 all 19 numbered objectives, their 59 printed bullets and parenthesized examples. Use the detailed five-domain table and objectives. Consult ISC2_AI_2026 separately for AI applications. Supplemental primary verification only (not a new whole-publication assignment): Viewer pp.1–3: title/effective date, About CC, experience and exam information

Excluded or limited: An outline defines exam scope and administration; it is not complete teaching or a practice assessment. The web page’s older introductory topic list is superseded by its detailed current domain sections. Verification limits: Current Sep2026 entry-level credential/exam context; chosen CC→PECB sequence is fictional/local study choice, not issuer prerequisite. The HTML page-title bullet under 3.2 is a formatting artifact; the PDF has three real bullets there. Invalid April 31 calendar text is not reliable scheduling information.

Threat actors and their motivations
Bounded primary or first-party professional reference

Only “Types of cyber threat actors and their motivations”, introductory paragraph and Figure 1 long description; stop at Sophistication. The examples describe common malicious-actor motivations, not exclusive motives or reliable attribution of a particular attack. Do not treat all insiders as malicious or assume incidents always have deliberate causes. Guide section 18: Types/motivations introduction and Figure 1 description only; stop before Sophistication. Supplemental primary verification only (not a new whole-publication assignment): Introduction to the cyber threat environment: Types of cyber threat actors and their motivations; Figure1 long description

Excluded or limited: The examples describe common malicious-actor motivations, not exclusive motives or reliable attribution of a particular attack. Do not treat all insiders as malicious or assume incidents always have deliberate causes. Verification limits: Illustrative typical motives, not unique attribution evidence or a claim every insider is malicious.

Logging, monitoring and SIEM capabilities
Bounded primary or first-party professional reference

Viewer p.1: logging definition; monitoring definition and goal, stopping before the sentence prescribing who must perform it; “Security information and event management” paragraph and capability list; CSP questions on log availability, storage, retention and destruction. The universal role-separation sentence, other broad benefits, old linked guidance and unlisted p.2 deployment recommendations are not assigned. Read the current NIST incident-response rows for triage and evidence. Guide section 2: Viewer p.1 logging, monitoring and SIEM portions; skip the universal role-separation sentence. Guide section 17: Viewer p.1 logging/monitoring/SIEM and cloud-provider questions; skip the universal role-separation sentence. Supplemental primary verification only (not a new whole-publication assignment): ITSAP.80.085 viewer p1 logging definition and SIEM capability list Viewer p.1 logging/SIEM/CSP questions; p.2 log-protection bullet reviewed as audit supplement only ITSAP.80.085 p1 Logging/Monitoring definitions and Security information and event management paragraph/capability list; PDF viewer pages 1 Viewer p.1 SIEM capability list: notification/alert function

Excluded or limited: The universal role-separation sentence, other broad benefits, old linked guidance and unlisted p.2 deployment recommendations are not assigned. Read the current NIST incident-response rows for triage and evidence. Verification limits: Collection of activity/event data, correlation, real/potential threat notifications. Excludes universal separation-of-roles sentence and p2 deployment prescriptions. Event records/investigation and protection concepts; original unassigned universal role-separation and broad deployment advice not endorsed. Exclude universal staffing-separation sentence; SIEM functionality does not imply AI or exhaustive detection. Notification concept only. Unassigned p.2 recommendations and universal organization-role separation claims excluded.

CISA: GitHub - cisagov/bad-practices: CISA's catalog of bad practices that are exceptionally risky. · GitHub
Bounded primary or first-party professional reference

README scope paragraph and Bad Practices item 1 only; risk illustration, not product support dates or an EU legal rule Guide section 20: README scope/context and Bad Practices item 1 only; no live product-status inference. Supplemental primary verification only (not a new whole-publication assignment): README Bad Practices scope/context and first item only

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Risk of unsupported/end-of-life software, particularly critical infrastructure/NCFs and internet-facing technology; no product dates or proof of existing compromise.

Center for Internet Security: CIS Critical Security Control 8: Audit Log Management
Bounded primary or first-party professional reference

Short named-control Overview paragraph only; skip hub/promotional/version links Guide section 17: Short control Overview only. Supplemental primary verification only (not a new whole-publication assignment): Control8 assigned Overview only

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Collect/review/retain logs to help understand incidents; no claim all events are recorded.

Enterprise inventory and unauthorized assets
Bounded primary or first-party professional reference

Only the safeguard description paragraphs under 1.1 and 1.2; read their boundaries in the clean reader. CIS v8.1 assessment-specification source. No Inputs/Operations/Measures/Metrics formulas are assigned. CIS frequencies are framework guidance, not exam rules or a personal study schedule. Guide section 1: Descriptions of safeguards 1.1 and 1.2 only; no assessment formulas. Guide section 20: Safeguards 1.1/1.2 descriptions only. Supplemental primary verification only (not a new whole-publication assignment): Safeguards 1.1 and 1.2 description paragraphs

Excluded or limited: CIS v8.1 assessment-specification source. No Inputs/Operations/Measures/Metrics formulas are assigned. CIS frequencies are framework guidance, not exam rules or a personal study schedule. Verification limits: Inventory scope, owner/approval context, maintenance and unauthorized assets; no formulas or universal mandated frequencies.

Software inventory and support status
Bounded primary or first-party professional reference

Only safeguard description paragraphs under 2.1, 2.2 and 2.3. Skip all other content, formulas and tool implementation. Asset ownership, support exceptions and risk decisions need the organization’s process; a support exception does not remove the risk. Guide section 1: Descriptions of safeguards 2.1–2.3 only. Guide section 20: Safeguards 2.1–2.3 descriptions only. Supplemental primary verification only (not a new whole-publication assignment): Safeguards 2.1–2.3 description paragraphs

Excluded or limited: Skip all other content, formulas and tool implementation. Asset ownership, support exceptions and risk decisions need the organization’s process; a support exception does not remove the risk. Verification limits: Software inventory, business purpose, support, retirement and exceptions; not evidence of a particular product support date.

Data ownership, classification, handling, retention and disposal
Bounded primary or first-party professional reference

Only safeguard description paragraphs under 3.1, 3.2, 3.4, 3.5, 3.7 and 3.8. No assessment formulas, scoring or universal legal retention period. In particular the unassigned 3.7 operations include inconsistent M/M1 variable names. Disposal must follow applicable retention and preservation obligations, not simply delete everything old. Guide section 1: Descriptions 3.1, 3.2, 3.4, 3.5, 3.7 and 3.8 only. Guide section 16: Safeguard descriptions 3.1, 3.2, 3.4, 3.5, 3.7, 3.8 only. Supplemental primary verification only (not a new whole-publication assignment): Safeguards 3.1,3.2,3.4,3.5,3.7,3.8 description paragraphs Control3 descriptions 3.1 Establish and Maintain a Data Management Process; 3.4 Enforce Data Retention

Excluded or limited: No assessment formulas, scoring or universal legal retention period. In particular the unassigned 3.7 operations include inconsistent M/M1 variable names. Disposal must follow applicable retention and preservation obligations, not simply delete everything old. Verification limits: Data owner, classification, handling, retention, disposal and flows. No universal legal retention period; preservation obligations still apply. Business/context-based retention, minimum/maximum timelines, handling and disposal; no universal period.

Account inventory and lifecycle visibility
Bounded primary or first-party professional reference

Only the safeguard description paragraph under 5.1. Only the safeguard description paragraph under 5.1. Skip all other content. Use fictional accounts only. An account inventory does not itself grant access or prove a session has ended. Guide section 10: Safeguard 5.1 description only. Supplemental primary verification only (not a new whole-publication assignment): Safeguard 5.1 description Safeguard5.1 description paragraph

Excluded or limited: Skip all other content. Use fictional accounts only. An account inventory does not itself grant access or prove a session has ended. Verification limits: User, administrator and service account inventory; not proof that sessions have ended. User/admin/service account inventory; recurring authorization validation; not token revocation guarantees.

Access lifecycle, reviews and revocation evidence
Bounded primary or first-party professional reference

Only safeguard description paragraphs under 6.1, 6.6 and 6.8; under 6.2 read only the second sentence about preserving audit trails. Skip all formulas/other content and the 6.2 first sentence’s unqualified whole-account disabling language for role changes. Revoke access that is no longer approved; a move does not universally require disabling every account. An account change does not prove every session/token has stopped. Confirm actual IAM behavior; this plan changes none. Guide section 2: Descriptions 6.1, 6.6, 6.8; 6.2 second sentence only. Guide section 10: 6.1, 6.6 and 6.8 descriptions; 6.2 second sentence only. Exclude whole-account-disable wording for every role change. Supplemental primary verification only (not a new whole-publication assignment): Safeguards 6.1,6.6,6.8; 6.2 second sentence only Control6 descriptions: 6.1 Establish an Access Granting Process; 6.8 Define and Maintain RBAC; 6.2 audit-trail sentence

Excluded or limited: Skip all formulas/other content and the 6.2 first sentence’s unqualified whole-account disabling language for role changes. Revoke access that is no longer approved; a move does not universally require disabling every account. An account change does not prove every session/token has stopped. Confirm actual IAM behavior; this plan changes none. Verification limits: Documented granting, appropriate role privileges and reviews, preservation of audit trails. Excluded whole-account-disable rule for every role move is not adopted. Only described conceptual grant/review/revoke concepts; no unqualified whole-account disabling for every role change.

Center for Internet Security: CIS Critical Security Control 3: Data Protection
Bounded primary or first-party professional reference

Short Overview paragraph only; no complete handling procedure is supplied

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

Center for Internet Security: CIS Critical Security Control 1: Inventory and Control of Enterprise Assets
Bounded primary or first-party professional reference

Short named-control Overview paragraph only; skip hub/promotional/version links

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

Center for Internet Security: CIS Critical Security Control 4: Secure Configuration of Enterprise Assets and Software
Bounded primary or first-party professional reference

Short named-control Overview paragraph only; skip hub/promotional/version links Guide section 20: Short control Overview only. Supplemental primary verification only (not a new whole-publication assignment): Control4 Overview paragraph

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Establish and maintain secure configuration; no full detailed baseline implementation tutorial.

Center for Internet Security: CIS Critical Security Control 2: Inventory and Control of Software Assets
Bounded primary or first-party professional reference

Short named-control Overview paragraph only; skip hub/promotional/version links

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

IAF/ISO climate-context explanation
Bounded primary or first-party professional reference

PDF pp. 1–2: context of the 2024 climate amendment PDF pp. 1–2, context explanation

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

Editorial cloud companion
Editorial companion, selection or scope record; not independent primary evidence

Cloud characteristics, deployment/service models and provider/customer responsibilities at concept level.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

NIST cloud characteristics and models
Bounded primary or first-party professional reference

PDF pp. 6–7 §2: five essential characteristics, three service models and four deployment models Revisit PDF pp. 6–7 definitions Guide section 14: Viewer pp.6–7 §2: five characteristics, three service models and four deployment models. Hybrid-cloud correction: distinct cloud infrastructures remain separate but are connected by technology that permits data and applications to move between them. Mere integration without that portability is insufficient. Supplemental primary verification only (not a new whole-publication assignment): SP800-145 viewer pp6–7 section2: five essential characteristics and four deployment models Viewer pp.6–7 §2, essential characteristics/service/deployment models SP 800-145 §2 Essential Characteristics, Service Models, Deployment Models; printed pp2-3; PDF viewer pages 5,6,7

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Computing/deployment model definitions only, not evidence of implementation security or compliance. NIST SP800-145 cloud definitions; hybrid requires unique infrastructures bound for data/application portability. Stable cloud taxonomy; model labels do not guarantee security, isolation, suitability or unlimited capacity.

Editorial cryptography companion
Editorial companion, selection or scope record; not independent primary evidence

Conceptual encryption, hashing, keys, post-quantum cryptography and data-handling orientation.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

NIST Cybersecurity Framework 2.0
Bounded primary or first-party professional reference

PDF pp. 6–10 only: sections 1–2 PDF pp. 11–12, section 3.1 Profiles only; stop before 3.2 Guide section 3: Viewer pp.6–10 §§1–2; pp.11–12 §3.1 current/target profiles only. Supplemental primary verification only (not a new whole-publication assignment): CSF2.0 viewer p23 ID.AM-08

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Systems/hardware/software/services/data managed throughout lifecycle; not a prescriptive universal phase taxonomy.

CyBOK Risk Management & Governance v1.1.2
Bounded primary or first-party professional reference

Optional only: PDF p. 4 and top of p. 5, sections 1–2; stop before section 3 Guide section 3: Viewer p.4 top and p.5 §§1–2 only; stop before §3. Supplemental primary verification only (not a new whole-publication assignment): Viewer pp.4–5 §§1–2, stopping before §3

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Original professional explanation of risk governance and uncertainty; no universal risk formula imported.

Cisco Cyber Threat Management
Publisher access option; underlying lessons or questions are not verified teaching here

Optional Cisco course entry point for threat-management learning. Public access description only.

Excluded or limited: The public course page does not verify every lesson, quiz, key or current CC alignment.

Cisco Networking Basics
Publisher access option; underlying lessons or questions are not verified teaching here

Optional networking concepts and labs: communication models, segmentation, TCP/UDP and ports, and application services. Public syllabus scope only.

Excluded or limited: Course metadata is not the lessons or lab feedback. Protocol demonstrations are not secure production recommendations.

EDPB Data Protection Officer: selected reading
Optional official EU privacy context; not legal advice

“Does my organisation need a DPO”, to replace the old PDF’s incorrect test

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Applicability and legal obligations depend on jurisdiction and circumstances; this site supplies no legal determination.

selected IBM teaching: disaster recovery definition
Bounded primary or first-party professional reference

Definition and purpose only; this article does not cover recovery-testing methods Guide section 7: Definition and purpose only; no recovery-objective teaching claimed from this source. Supplemental primary verification only (not a new whole-publication assignment): Disaster recovery (DR), defined: first paragraph and planning/backups paragraph Disaster recovery (DR), defined, opening and recovery-purpose paragraphs

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Technology/data recovery and insufficiency of backups alone. Excludes prices, current regulatory prescriptions and marketing benefit guarantees. Technology/data recovery distinction. Product and marketing claims excluded.

selected ISACA definitions: due care and due diligence
Bounded primary or first-party professional reference

Only the two assigned glossary definitions Guide section 4: ISACA due care and due diligence definition entries only. Supplemental primary verification only (not a new whole-publication assignment): Due care and Due diligence definition entries

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Reasonable conduct versus prudent thorough investigation; not legal advice or universal before/after timeline.

ENISA SME awareness leaflet, 2021
Bounded primary or first-party professional reference

Optional only: PDF pp. 3, 5, 9 and 11 Guide section 20: Optional viewer p.11 maintained websites and information-sharing concepts only; not legal or operational-testing instructions.

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

First-, second- and third-party audit definitions
Bounded primary or first-party professional reference

Only the Audit definition and Notes 1–2, including the origin-document attribution to ISO 19011:2018. EU agency terminology reference, not railway compliance training or the complete/current ISO 19011 standard. An internal audit can be performed on the organization’s behalf by an external consultant. Guide section 27: Audit definition and Notes 1–2 only; ISO 19011:2018-origin entry, not a claim to save the latest full standard. Supplemental primary verification only (not a new whole-publication assignment): Audit definition and Notes1–2, explicitly attributed to ISO19011:2018 Audit definition and Notes1–2 Audit definition Notes1-2 and Origin document attribution Definition and Notes1–2: first-party by/on behalf of organization; second-party interested parties; third-party independent auditing organizations

Excluded or limited: EU agency terminology reference, not railway compliance training or the complete/current ISO 19011 standard. An internal audit can be performed on the organization’s behalf by an external consultant. Verification limits: Dated shared definition: systematic/independent/documented evidence evaluation against criteria. Not latest/full auditing standard or auditor qualification. First/second/third-party relationships; independence/objective evidence. Not latest fullISO19011 or railway compliance instruction. Official agency terminology reproduction with dated ISO19011:2018 origin; not complete/current standard or certification training. Published bounded terminology excerpt with ISO19011:2018 provenance, not a claim to possess the latest whole standard.

selected ISC2 Code of Ethics
Bounded primary or first-party professional reference

Actual ISC2 ethics preamble and canons Guide section 4: ISC2 Code of Ethics preamble and four canons; paraphrased, not a replacement for the official code. Supplemental primary verification only (not a new whole-publication assignment): Code preamble; four mandatory canons; professional-judgment limitation Code of Ethics: preamble and four canons

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Principle application only; no public disclosure or complaint action assigned. ISC2 high-level canons support honest, responsible, competent conduct; not PECB-specific code text, credential acceptance or legal advice.

ISC2 Code of Ethics — current official preamble and canons
Bounded primary definition; source context applies

Code preamble and four mandatory canons only. Complaint procedures, forms and reporting are not assigned or acted on.

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

Editorial selection of EXIN concept practice
Editorial companion, selection or scope record; not independent primary evidence

A selection of 12 concept checks from another issuer’s sample. Publisher rationale applies to those selected items; they do not establish CC or PECB readiness.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

Editorial source and scope review
Editorial companion, selection or scope record; not independent primary evidence

Records source limits, corrections and outstanding teaching/practice needs. It is not issuer approval or independent certification.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

Editorial security and everyday IT foundations
Editorial companion, selection or scope record; not independent primary evidence

Beginner IT and security orientation; follow the named primary readings for individual concepts.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

Editorial resource catalogue
Editorial companion, selection or scope record; not independent primary evidence

Navigation to selected free and optional resources. A catalogue is not substantive teaching.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

Editorial practice index
Editorial companion, selection or scope record; not independent primary evidence

Distinguishes short checks, selected publisher feedback, reflection prompts and independent assessment. Seen items are revision, not a fresh mock.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

Editorial coverage and remaining needs
Editorial companion, selection or scope record; not independent primary evidence

Describes curriculum and assessment gaps. It does not determine an individual’s competence, access or credential status.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

Editorial paper exercises and selected publisher practice
Editorial companion, selection or scope record; not independent primary evidence

Source-guided fictional paper tasks. Suggested reasoning is editorial, not an issuer exam key or a validated readiness score.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

Editorial targeted reading route
Editorial companion, selection or scope record; not independent primary evidence

Navigation through bounded readings and exact exclusions; linked publications are not whole-course assignments.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

NIST governance reporting and dashboard examples
Bounded primary or first-party professional reference

Viewer p. 41 first two paragraphs and Figure 11, stop before risk-capacity discussion; p. 42 §5.1 only, stop before §5.2; p. 44 §5.3 only, beginning at that heading. Reporting/scorecard/dashboard examples are illustrative; skip preceding quarterly-reporting prescriptions and all remaining sections. Revisit only the assigned reporting/dashboard excerpts on pp. 41, 42 and 44 Supplemental primary verification only (not a new whole-publication assignment): IR8286Cr1 viewer p41 first2 paragraphs and Figure11; p42 section5.1; p44 section5.3 IR 8286Cr1 §5 first two paragraphs and Fig11; §5.1 Key CSRM Mechanisms; §5.3 Evaluating Risks; PDF viewer pages 41,42,44

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Monitor/evaluate/adjust, contextual metrics and dashboarding for stakeholders. Illustrative guidance, not an issuer-mandated screen design; excludes quarterly disclosure prescription and risk-capacity material. Primary-author governance communication guidance; interpretation/action linkage supported, but no exclusive dashboard/report/scorecard taxonomy.

Editorial guide explanations
Editorial companion, selection or scope record; not independent primary evidence

Guide sections 8, 19, 24 and 27 explain reporting, response-plan orientation, policy operation, and analysis/measurement/evaluation. “Analysis” and generic “scorecard” retain the site’s explanatory usage; primary examples do not establish a universal normative taxonomy.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

The threat-intelligence lifecycle
Bounded primary or first-party professional reference

Viewer p.17 §3.1 definition and first explanation paragraph; §3.2 five-phase lifecycle through the three continuing bullets at the top of p.18; p.18 §3.3 as a comparison of the guide’s strategic/operational/tactical categories. 2019 government structures, supplier/tool examples and old TLP:WHITE markings are not current instructions. This is one lifecycle variant, not a universal number or naming of phases. The guide expressly says its delivery-level labels are not a definitive structure. Guide section 18: Viewer p.17 §3.1 definition/explanation; §3.2 through five lifecycle bullets on p.18; p.18 §3.3 categories as one variant only. Supplemental primary verification only (not a new whole-publication assignment): Viewer pp.17–18 §§3.1–3.2, five phases and their explanations

Excluded or limited: 2019 government structures, supplier/tool examples and old TLP:WHITE markings are not current instructions. This is one lifecycle variant, not a universal number or naming of phases. The guide expressly says its delivery-level labels are not a definitive structure. Verification limits: One lifecycle variant; decision needs and feedback. Historical government structures/TLP markings not current instructions.

selected Microsoft teaching: identity and access lifecycle
Bounded primary or first-party professional reference

Only Identity lifecycle, Access lifecycle and Privileged access lifecycle; stop before License requirements Guide section 10: Identity, Access and Privileged access lifecycle sections only; stop before License requirements. Supplemental primary verification only (not a new whole-publication assignment): What is Microsoft Entra ID Governance? Identity lifecycle; Access lifecycle Identity lifecycle; Access lifecycle; Privileged access lifecycle; stop before License requirements Microsoft Entra ID Governance overview: identity lifecycle and access lifecycle sections

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Original illustrative identity/access lifecycle, changes on role moves and access removal; no license or product-feature inference for hypothetical systems. Original product-author conceptual lifecycle illustration; does not establish every system behaves like Entra. First-party examples of identity/access provisioning and changes; actual identity binding, approvals and implementation need evidence.

IETF RFC 9499 DNS terminology
Bounded primary or first-party professional reference

Selected domain-name/resource-record/server/resolver definitions in sections 2,5,6 only; no DNSSEC/configuration assignment. Guide section 11: RFC 9499 selected domain/resource-record/server/resolver definitions in §§2, 5 and 6 only. Supplemental primary verification only (not a new whole-publication assignment): RFC9499 sections2,5,6 domain names/resource records/address records/resolver/authoritative server definitions RFC9499 §2 domain name and DNS discussion

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Naming roles and record relationships, not one-to-one website/address guarantees; no DNSSEC/configuration advice. Domain-name lookup context, separate from IP delivery; no DNS configuration instruction.

IETF RFC 8200 IPv6
Bounded primary or first-party professional reference

Section 1 address expansion from 32 to 128 bits only. Guide section 11: RFC 8200 §1 address expansion only. Supplemental primary verification only (not a new whole-publication assignment): RFC8200 §1 Expanded Addressing Capabilities; §2 packet/linkMTU definitions

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: 32/128-bit distinction and packet header/payload. §2 is audit supplement; address length does not demonstrate protection.

IETF RFC 1122 Internet layers
Bounded primary or first-party professional reference

Section 1.1.3 four layer names/basic roles only; old protocol/security mandates excluded. Guide section 11: RFC 1122 §1.1.3: four layer names/basic roles only; old security/configuration mandates excluded. Supplemental primary verification only (not a new whole-publication assignment): RFC1122 section1.3.3 Terminology, Segment/Message/IP Datagram entries, printed pp17–18 RFC1122 §1.1.3 pp.8–10

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Supplemental stable terminology for headers/application data and IP encapsulation. Not a packet-analysis/fragmentation lesson; no old implementation/security mandates adopted. Four groups and IP addressing/datagram/transport/link functions; no old implementation/security mandates reinstated.

IETF RFC 9293 TCP
Bounded primary or first-party professional reference

Section 2 opening paragraphs and 3.1 Source/Destination Port definitions only. Guide section 11: RFC 9293 §2 opening and §3.1 Source/Destination Port definitions only. Supplemental primary verification only (not a new whole-publication assignment): RFC9293 §2.2 Key TCP Concepts opening paragraphs RFC 9293 §2.2 Key TCP Concepts; §3.1 Source Port and Destination Port

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Reliable ordered byte stream; application stream transported over multiple segments/IP datagrams. Transport concepts only; ordering/reliability do not by themselves establish confidentiality or business-logic correctness.

current NIST incident-response introduction
Bounded primary or first-party professional reference

PDF pp. 9–10 executive summary and introductory examples; p. 13 Figure 2 and explanation only Additional current teaching: viewer p.33 rows DE.AE, DE.AE-02/03; p.34 DE.AE-04/06/07/08; pp.34–36 RS.MA overview and RS.MA-01/02/03/04/05; p.37 RS.AN-06/07 only. Organizational risk priorities, correlation, triage, escalation, records and evidence. These are recommendations in a CSF profile, not a universal mandatory sequence. Revisit PDF p. 13 Figure 2 and explanation Additional current teaching: viewer p.33 rows DE.AE, DE.AE-02/03; p.34 DE.AE-04/06/07/08; pp.34–36 RS.MA overview and RS.MA-01/02/03/04/05; p.37 RS.AN-06/07 only. Organizational risk priorities, correlation, triage, escalation, records and evidence. These are recommendations in a CSF profile, not a universal mandatory sequence. Guide section 17: Viewer pp.33–34 DE.AE-02/03/04/06/07/08 selected rows; pp.34–36 RS.MA overview and 01–05 only, subject to current register boundaries. Guide section 19: Viewer pp.9–10 introduction; p.13 Figure 2/explanation. Selected pp.33–37 event-analysis and incident-management rows plus p.37 RS.AN-06/07 only; RS.AN-03 is not assigned. No full profile/forensics course. Glossary incident/event definitions: viewer p.10 introduction only; model distinction: p.13 Figure 2 and explanation; escalation/elevation: p.36 RS.MA-04 only; evidence: p.37 RS.AN-06/07 only. IR-plan entry is an introductory synthesis linked to the guide and existing RS.MA-01, not a complete new plan lesson. Supplemental primary verification only (not a new whole-publication assignment): SP800-61r3 viewer pp33–34 DE.AE/DE.AE-02/03/06/07/08; p36 RS.MA-04; p37 RS.AN-06/07 Viewer pp.9–10 Introduction; p.13 Figure 2; pp.15–17 roles/policy; p.34 DE.AE-08; pp.35–36 RS.MA-01/02/03/04/05; p.37 RS.AN-06/07 SP 800-61r3 Table3 RS.AN-07: incident data integrity/provenance, R1 retention and evidence preservation; PDF viewer pages 37 SP 800-61r3 §1 Introduction event/adverse event/incident definitions; Table3 RS.MA-02 and RS.MA-03; PDF viewer pages 10,35,36 Viewer p.10 §1 event/adverse-event/incident definitions and analysis; p.34 DE.AE-08; p.36 RS.MA-04 N1

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Alerts/anomalies require contextual analysis; incidents need criteria; elevation terminology is NIST-context-specific; evidence provenance/custody depends on circumstances. RS.AN-03 excluded. Incident concepts and selected coordination recommendations. US FISMA-origin incident definition; not universal legal definition or full plan lesson. pp.15–17 are audit supplements beyond the original assigned route. Evidence-preservation requirements may constrain routine disposal; fictional ongoing-matter review does not assert a particular legal hold or deadline. Event versus incident classification and risk/context prioritization; alert, negative consequence or reported test alone does not settle validity. NIST-context vocabulary. Escalation generally increases resources/time frames; elevation usually involves higher management. The quiz names the selected context. US FISMA-origin incident definition is not a universal legal definition.

NIST SP 800-61r3: timeline, protected evidence and improvement rows
Bounded primary or first-party teaching/practice reference; exact assigned scope only

One-based viewer pp.27–28 (printed 19–20), Table 2 ID.IM-01/02/03 and ID.IM-04 recommendations R1–R4; viewer p.36 (printed 28), Table 3 RS.AN-03 recommendation R1 only, on reconstructing the sequence and involved assets; viewer p.37 (printed 29), RS.AN-06 and RS.AN-07 in full. The RS.AN-03 R1 timeline row is an explicit new selection beyond the earlier route's exclusion; the other RS.AN-03 recommendations remain unassigned. Practice/feedback status: Recommendations, not a question bank. The fictional CC06 handling and decision records have an explained editorial model.

Excluded or limited: No complete technical response procedure, forensic acquisition laboratory, legal notification timetable or mandatory universal chain-of-custody process. Do not substitute the superseded r2 lifecycle for r3's current CSF-based presentation. Currency: April 2025 revision 3, which supersedes revision 2; original publication/history and selected rows checked 29 October 2026.

ISACA Germany guide — strictly selected examples
Bounded primary or first-party professional reference

PDF p. 22 KPI/KRI/KCI examples only; skip references, documentation lists and other text Additional exact selections: viewer p.19 “Documentation and reporting” first three bullets (including continuation at the top of the right column); p.23 left column only, from “The number and type of documents also vary” through the document-control questions. Skip the right-column required-records list with wrong 10.1 references, other legal/role/transition material and all unlisted text. Concepts and tool criteria only, not an authoritative ISO requirements checklist. PDF p. 36, §3.14 and its PDCA example only; stop before Success factors; skip the preceding incident-documentation section Additional exact selections: viewer p.19 “Documentation and reporting” first three bullets (including continuation at the top of the right column); p.23 left column only, from “The number and type of documents also vary” through the document-control questions. Skip the right-column required-records list with wrong 10.1 references, other legal/role/transition material and all unlisted text. Concepts and tool criteria only, not an authoritative ISO requirements checklist. PDF p. 33 ONLY “Differentiation between internal ISMS audits and certification audits”; stop at the next heading Guide section 8: Viewer p.22 KPI/KRI/KCI examples only; skip adjacent requirements and older measurement references. Guide section 23: Viewer p.36 §3.14 PDCA example only, stop before Success factors; skip preceding incident-documentation claims. Guide section 26: Viewer p.23 LEFT column only through document-control questions; RIGHT list excluded. Guide section 27: Viewer p.33 subsection on internal ISMS versus certification audits only; no later lines-of-defence teaching. Supplemental primary verification only (not a new whole-publication assignment): Viewer p.22 right-column Relevant KxIs examples only Implementation guide ISO/IEC27001:2022, §3.1 Definition of the scope of application; PDF viewer pages 10 Implementation guide ISO/IEC27001:2022 §3.1 SoA paragraph; §3.3 documentation and reporting-on-implementation-status paragraph; PDF viewer pages 10,12

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Original professional KPI/KRI/KCI examples; conceptual role inference, not an ISO-mandated universal taxonomy or source of excluded documentation lists. Primary-author conceptual guidance on boundaries/inclusions/interfaces only; not independently verified normative text or a real scope review. Author guidance supports justified choices and applied/implementation status; no claim of complete required contents or full licensed ISO verification.

ISC2 official AI exam guidance — CC pages only
Official exam scope or route reference; not complete teaching

ISC2 September 1, 2026 AI guidance: viewer pp.4–6 (printed pp.3–5), CC section only. These are applications of existing domains, not new numbered objectives or a teaching course. Other certification sections are unassigned. Guide section 10: ISC2 September 1, 2026 AI guidance: viewer pp.4–6 (printed pp.3–5), CC section only. These are applications of existing domains, not new numbered objectives or a teaching course. Other certification sections are unassigned. Guide section 14: ISC2 September 1, 2026 AI guidance: viewer pp.4–6 (printed pp.3–5), CC section only. These are applications of existing domains, not new numbered objectives or a teaching course. Other certification sections are unassigned. Guide section 17: ISC2 September 1, 2026 AI guidance: viewer pp.4–6 (printed pp.3–5), CC section only. These are applications of existing domains, not new numbered objectives or a teaching course. Other certification sections are unassigned. Guide section 22: ISC2 September 1, 2026 AI guidance: viewer pp.4–6 (printed pp.3–5), CC section only. These are applications of existing domains, not new numbered objectives or a teaching course. Other certification sections are unassigned. Supplemental primary verification only (not a new whole-publication assignment): Viewer p.5 Domain3: Identity And Access Management (IAM) Concepts

Excluded or limited: Viewer pp.1–3 are orientation; pp.7–29 concern other certifications and are unassigned. Do not import their work depth or assurance claims into CC. Verification limits: Formal lifecycle for bots/service accounts and least privilege. Publisher teaching guidance, not proof a specific implementation works.

ISC2 Flashcards
Publisher access option; underlying lessons or questions are not verified teaching here

access note; terminology practice only

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

ISC2 CC short knowledge check — live questions and immediate explanations
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Ten selected-topic questions were inspected through the issuer-linked public widget: due care/diligence, RTO, least privilege, conventional zones, threat modelling, a risk decision, GRC frameworks/tools, ABAC, administrative controls and public-key confidentiality. Individual explanations were displayed. Use as short topic practice, following the current outline separately. Practice/feedback status: Issuer's immediate explanations observed for the ten items; final score report not obtained because it requires details. This is not validation of a full examination bank.

Excluded or limited: Not a full current-outline assessment, no complete five-domain or AI-application coverage established. Do not use the broad wording of its risk-tolerance item as the precise NIST appetite/tolerance distinction. Conventional internal-zone labels do not establish Zero Trust or make internal traffic safe. The website links to the publisher; no questions or keys are copied. Currency: Live browser inspection 29 October 2026; widget content and access may change. The visible final step was a results form, not an additional scored question.

Official ISO/IEC 27001:2022 overview; not the full standard
Bounded primary or first-party professional reference

Official overview, for orientation only Supplemental primary verification only (not a new whole-publication assignment): What is ISO/IEC27001?; reference2022; edition3

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: ISMS requirements role only; not full text or assessment evidence.

ISO/IEC 27001:2022 — official requirements standard access boundary
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Public catalogue identifies the published 2022 third edition, its purpose, and one amendment. Only catalogue and limited preview are free public reading verified here. Practice/feedback status: No exam questions/key.

Excluded or limited: No full clauses, Annex A reproduction or unrestricted redistribution right is supplied by this link. Full access remains conditional on a valid licence. Currency: Catalogue inspected 29 October 2026: ISO/IEC 27001:2022, edition 3, publication October 2022, one amendment.

Editorial ISO family and edition guide
Editorial companion, selection or scope record; not independent primary evidence

Explains distinct roles of ISO/IEC 27000, 27001, 27002, 27003 and 27005. Edition notes are dated; full requirements are not reproduced.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

Management-system vocabulary from ISO TC176
Bounded primary or first-party professional reference

Read only the named entries: p.7 competence (ISO 9000:2015 entry); p.11 continual improvement, correction, corrective action; p.15 documented information; p.16 effectiveness/efficiency; p.21 management system and measurement; p.22 monitoring; p.23 nonconformity, objective, objective evidence; p.25 performance/policy; p.34 review. This is a free 2022 reference list with dated source attributions, not the full or latest ISO standard. Stable selected definitions introduce concepts; do not adopt all listed editions, notes or quality-system requirements as the PECB syllabus. Skip all other entries, including measurement-equipment/calibration and electoral material. Guide section 23: Only selected stable shared terms, with their explicit 2015 origin; not a latest full ISO standard. Guide section 26: Selected shared competence, documented-information, monitoring and measurement definitions only. Guide section 27: Selected monitoring, measurement and audit vocabulary only; 2015-origin shared concepts. Guide section 28: Selected nonconformity and corrective-action shared definitions only. Additional glossary-only term: viewer p.19 interested-party/stakeholder entry, attributed to ISO 9000:2015; definition only. All other p.19 terms and notes remain unassigned. Supplemental primary verification only (not a new whole-publication assignment): 2022 alphabetical list viewer p7 competence ISO9000:2015; p11 continual improvement/correction/corrective action; p15 documented information; p16 effectiveness/efficiency Viewer p.19 interested party; p.21 management system/measurement; p.22 monitoring; p.23 nonconformity/objective/objective evidence; p.25 performance Terms in TC176 Standards, alphabetical listing: record, ISO9000:2015 3.8.10; PDF viewer pages 32 Viewer p.21 measurement; p.22 monitoring; p.11 correction/corrective-action notes

Excluded or limited: This is a free 2022 reference list with dated source attributions, not the full or latest ISO standard. Stable selected definitions introduce concepts; do not adopt all listed editions, notes or quality-system requirements as the PECB syllabus. Skip all other entries, including measurement-equipment/calibration and electoral material. The p.19 interested-party definition is a newly bounded glossary supplement; it does not supply ISO 27001 requirements or make this the latest complete ISO vocabulary. Preserve its historical ISO 9001 context. ISO 9001:2026 is the published edition; these older examples are not current ISO 27001 requirements. Verification limits: Use only named shared concepts with their 2015 origin; not full/latest ISO27001 requirements or proof of required-record completeness. Historical2022 reference compiling ISO9000:2015-origin shared concepts. No latest-edition or complete ISO27001 claim. Generic record definition only, not a claim to supply the current ISO27000 vocabulary or ISO27001 requirements. 2022 compilation with ISO9000:2015 provenance: historical, bounded concept supplement, not current ISO27001 normative text or latest ISO9001 requirements.

NIST measurement and metrics teaching
Bounded primary or first-party professional reference

PDF p. 9 opening paragraph; p. 10 §1.4; pp. 17–19 §§2.3–2.4 only; stop before §2.5 on p. 20 Revisit the assigned definitions and metrics pages Guide section 5: Viewer p.10 §1.4 and pp.17–19 §§2.3–2.4 only. Guide section 8: Viewer p.9 opening; p.10 §1.4; pp.17–19 §§2.3–2.4 only. Guide section 25: Viewer pp.17–19 selected measure-selection principles only. Guide section 27: Exact definitions/selection sections listed in section 8. Viewer p.10 section 1.4: information security, measures, metrics and measurement definitions within this NIST document's scope; no universal replacement of other vocabularies. Supplemental primary verification only (not a new whole-publication assignment): SP800-55v1 viewer pp17–19 sections2.3–2.4 Viewer p.10 §1.4; pp.12–13 §2/2.1; p.20 §3 scope paragraph SP 800-55v1 §1.4 Terminology; Table1 ordinal versus ratio; §2.2 Types of Assessment; PDF viewer pages 10,11,15,16 Viewer p.10 §1.4: assessment, measurement and metric definitions

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Meaningful/accurate/time-referenced/comparable metrics and unambiguous outputs tied to objectives. Measures/metrics nomenclature remains source-specific. NIST SP800-55v1 assessment, measure, measurement and metric vocabulary. Audit supplement for scope paragraph; selected NIST usage, not universal taxonomy. Measurement meanings only; numbered categories do not establish ratios or measured loss; no universal risk formula. Values, judging against criteria and defined measurement-method distinctions, applied to fictional recovery results.

Microsoft: Dynamic Data Masking - SQL Server
Bounded primary or first-party professional reference

Opening definition plus Security considerations for dynamic data masking only; no SQL/deployment exercise Guide section 16: Opening definition and Security considerations only; no SQL/deployment. Supplemental primary verification only (not a new whole-publication assignment): Dynamic data masking: opening/Overview; Security Note: Bypassing masking using inference or brute-force techniques, first paragraph only

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Representation/query-result exposure limits, unchanged underlying data, complementary encryption/access controls and residual inference risk. No SQL commands or deployment tutorial relied on.

Microsoft: What is Microsoft Sentinel SIEM?
Bounded primary or first-party professional reference

What is Microsoft Sentinel? and Collect, Detect, Investigate, Respond capability descriptions only; skip AI, portal, deployment and subscription details Guide section 17: What is Microsoft Sentinel? and Collect/Detect/Investigate/Respond capability descriptions only; product example, no account.

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

Microsoft: Learn about sensitivity labels
Bounded primary or first-party professional reference

Read the opening classification/protection explanation, the two bullets about protection settings and labels without protection, and What a sensitivity label is. Stop before What sensitivity labels can do. Product example, not a universal classification scheme: label names and enforcement depend on policy/configuration. Skip licensing, tenant limits, deployment, Copilot and changing portal details. No account or subscription is needed for this reading. Guide section 16: Opening classification/protection explanation, two protection/no-protection bullets and “What a sensitivity label is”; stop before capabilities. Supplemental primary verification only (not a new whole-publication assignment): Opening label/protection paragraphs; Label content without using any protection settings; What a sensitivity label is

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Primary product example: classification marker may have no configured protection. No universal category list or licence/deployment claim.

NCSC Top Tips for Staff infographic
Bounded primary or first-party professional reference

PDF p. 1

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

Security culture, leadership and reporting
Bounded primary or first-party professional reference

Viewer pp.37–39: positive culture, leadership, clear communication, safe reporting, training and indicators of success. Other chapters, old statistics and UK legal/reporting details are unassigned. The board question PDF repeats p.39; repetition is not new practice. Guide section 6: Viewer pp.37–39 selected culture/leadership/reporting/training indicators only. Guide section 26: Viewer pp.37–39 selected culture/leadership/learning context.

Excluded or limited: Other chapters, old statistics and UK legal/reporting details are unassigned. The board question PDF repeats p.39; repetition is not new practice.

Governance questions with publisher suggested answers
Bounded publisher practice or reflection; not a complete fresh exam

Viewer p.2 Q2–6; p.3 Q1–4; p.4 Q1–2; p.5 Q1, Q3, Q4; p.10 Q1–3; p.11 Q4 and its first two answer paragraphs only. Use the selected-question route in the practice workbook. 18 selected organizational reflection prompts; suggested responses are not exam keys. Frequencies and targets are guidance in context, not ISO mandates. Skip p.11 Q5/contact list, unselected prompts and duplicate material. Guide section 3: Only the 18 selected board questions and suggested responses listed in the practice route. Guide section 24: Only selected governance questions and publisher suggested responses.

Excluded or limited: 18 selected organizational reflection prompts; suggested responses are not exam keys. Frequencies and targets are guidance in context, not ISO mandates. Skip p.11 Q5/contact list, unselected prompts and duplicate material.

Three phishing checks with publisher answers
Bounded publisher practice or reflection; not a complete fresh exam

Viewer pp.4–9 only: three question/answer pairs (phishing, spear phishing, non-email methods). Skip pp.10–13 (including the 2019 statistics question), historic case costs, and later visual-sign heuristics. Good spelling or a plausible sender is not proof a message is safe. Guide section 6: Viewer pp.4–9: PH1–PH3 and their publisher answers. Supplemental primary verification only (not a new whole-publication assignment): Viewer pp.5/7/9 publisher answers to selected phishing questions

Excluded or limited: Skip pp.10–13 (including the 2019 statistics question), historic case costs, and later visual-sign heuristics. Good spelling or a plausible sender is not proof a message is safe. Verification limits: Deception and harmful action, targeting and non-email channels; no historic statistics or visual heuristic guarantees.

Two ransomware checks and a response discussion
Bounded publisher practice or reflection; not a complete fresh exam

Viewer pp.4–7: two question/answer pairs; pp.9–11: fictional scenario and discussion consequences; p.13 four reflection statements only. The infection routes on p.7 are examples, not an exhaustive list. Skip historic counts/costs on p.8, UK reporting contacts/payment discussion on p.12, and remaining material. Never interpret a discussion prompt as advice to pay or as a guaranteed recovery method. Guide section 19: Viewer pp.4–7 RA1/RA2 checks/answers; pp.9–11 and p.13 discussion/reflection only.

Excluded or limited: The infection routes on p.7 are examples, not an exhaustive list. Skip historic counts/costs on p.8, UK reporting contacts/payment discussion on p.12, and remaining material. Never interpret a discussion prompt as advice to pay or as a guaranteed recovery method.

two NCSC password checks with publisher feedback
Bounded publisher practice or reflection; not a complete fresh exam

Attempt the two password checks after the beginner lessons; reveal publisher feedback afterwards Guide section 30: Two selected password checks only.

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading.

Editorial networking bridge
Editorial companion, selection or scope record; not independent primary evidence

Network layers, addressing, DNS, ports and segmentation orientation. Older protocol mandates and implementation recipes are excluded.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

NIST AI RMF: selected AI, trustworthiness and monitoring concepts
Bounded primary or first-party professional reference

Viewer p.6 Executive Summary first three paragraphs; p.17 §3 first paragraph and the paragraph beginning “Addressing AI trustworthiness”; p.18 §3.1 first two paragraphs; p.34 MEASURE 1.1/1.2 and 2.3/2.4/2.5; p.43 drift-maintenance bullet only. No full AI RMF course is claimed. Guide section 21: Viewer p.34 MEASURE 2.3/2.4/2.5 only: evaluation conditions, deployed functionality and generalizability limits. Guide section 22: Viewer p.6 Executive Summary first three paragraphs; p.17 §3 first paragraph and the paragraph beginning “Addressing AI trustworthiness”; p.18 §3.1 first two paragraphs; p.34 MEASURE 1.1/1.2 and 2.3/2.4/2.5; p.43 drift-maintenance bullet only. No full AI RMF course is claimed. Supplemental primary verification only (not a new whole-publication assignment): AI RMF1.0 viewer p6 Executive Summary first3 paragraphs; p17 section3 opening and trade-offs paragraph; p18 section3.1 first2 paragraphs; p34 MEASURE1.1/1.2/2.3–2.5; p43 drift-maintenance bullet Viewer p.19 §3.1 validity/accuracy/generalization; p.20 §3.2 safety; p.22 §3.7 fairness AI RMF1.0 Part1 §1 Introduction: inherent socio-technical nature; PDF viewer pages 6 Viewer p.43 AppendixB drift/maintenance bullet

Excluded or limited: All other sections remain unassigned. This is voluntary contextual risk guidance, not an exam blueprint, universal legal requirement or a complete deployment/AI-governance course. Verification limits: Contextual AI definition, trustworthiness, change/drift and monitoring; voluntary guidance, not an exam blueprint or complete drift diagnosis. Contextual testing and trustworthiness concepts; no assertion that learning assures these properties. Interacting human, social and technical context; not proof of organizational outcome from one component benchmark. Changing data and deployment context can affect performance; drift is an investigation hypothesis, not proof of an attack.

NIST AI 100-2e2025 — selected poisoning concepts only
Bounded primary or first-party professional reference

Viewer p.12 Executive Summary first four paragraphs; p.32 §2.3 first two paragraphs; p.39 §2.3.4 first sentence only. The known-error taxonomy index on printed p.x/viewer p.10 is excluded; selected errata is supplied for context. Guide section 22: Viewer p.12 Executive Summary first four paragraphs; p.32 §2.3 first two paragraphs; p.39 §2.3.4 first sentence only. The known-error taxonomy index on printed p.x/viewer p.10 is excluded; selected errata is supplied for context. Supplemental primary verification only (not a new whole-publication assignment): AI100-2e2025 viewer p32 section2.3 first2 paragraphs; p39 section2.3.4 first sentence Viewer p.18 §2.1.1 Training-time attacks; p.39 §2.3.4 opening and federated update paragraph Viewer p.32 §2.3 first two paragraphs; p.39 §2.3.4 first sentence; p.12 Executive Summary first four paragraphs

Excluded or limited: Printed p.x/viewer p.10 taxonomy index has published errata and is not assigned. All mathematical attack methods, experiments, tool use, mitigation recipes and other pages are unassigned. Verification limits: Adversarial training-stage poisoning and direct-model distinction. Known-error taxonomy index p10 and attack procedures excluded; no mitigation guarantee. Adversarial training/model/update manipulation; distinction from data poisoning. Advanced attack methods not assigned as exercises. Data/model poisoning distinctions at training stage. Known-error index on printed p.x is excluded; no attack recipes.

NIST current authentication: selected password rules
Bounded primary or first-party professional reference

Viewer p.25, section 3.1.1.2 items 1,5,6,8 only; minimums, rotation/composition and knowledge-based questions in NIST scope. Guide section 9: Viewer p.25 §3.1.1.2 items 1, 5, 6 and 8 only; no broader assurance-level implementation assignment. Supplemental primary verification only (not a new whole-publication assignment): SP 800-63B-4 viewer p12 section 1 first three paragraphs; pp17–18 section 2.2/2.2.1; p24 section3.1.1 first paragraph; p54 section4.1 opening; p64 section5 opening and5.1 opening Viewer p.12 §1 scope; pp.13/16 AAL/authenticator concepts; pp.24–25 §3.1.1; p.46 §3.2.5; AppendixD selected MFA/password/phishing-resistance entries

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Supplemental audit evidence beyond the selected password-only assignment: identity evidence, distinct factors, authenticator binding and sessions. No assurance-level deployment prescription or universal human-identity guarantee. Human digital authentication concepts; distinct factors and phishing resistance separate. Supplements beyond original password-only excerpt do not create new full teaching assignment.

Recovery priorities, RTO/RPO and testing
Bounded primary or first-party professional reference

Viewer p.29, §3.2 purpose paragraph only, stop before “The BIA should be performed”; p.31 MTD/RTO/RPO definition bullets and following RTO/MTD explanation, excluding footnotes; p.33 §3.2.3 only; p.41 §3.5 first sentence and paragraph starting “For each TT&E activity”. 2010 federal mandates, old six-step RMF, impact-tier schedules, old media/platform examples and the remaining technical implementation guidance are unassigned. These are stable recovery-planning concepts, not EU legal requirements. Guide section 1: Viewer p.29 §3.2 purpose, stopping at “The BIA should be performed”. Guide section 7: Viewer p.29 §3.2 purpose; p.31 MTD/RTO/RPO bullets and RTO/MTD explanation, skip footnotes; p.33 §3.2.3 only; p.41 §3.5 first sentence and TT&E results paragraph. RTO, RPO and MTD entries: viewer p.31 definition bullets and following RTO/MTD explanation only; exclude footnotes and old federal mandates. These are the objective definitions, not the separately bounded IBM DR article. Supplemental primary verification only (not a new whole-publication assignment): SP800-34r1 viewer p29 section3.2 purpose paragraph; p31 RTO/RPO definitions; p33 section3.2.3; p41 section3.5 first sentence and TT&E-results paragraph Viewer p.31 MTD/RTO/RPO bullets and following comparison SP 800-34r1 §3.2.1 MTD/RTO/RPO definition bullets and following RTO/MTD paragraph; PDF viewer pages 31 SP800-34r1 §3.5.3 Exercises: Tabletop Exercises bullet; PDF viewer pages 43 Viewer p.31, printed p.17: MTD/RTO/RPO bullets and next RTO/MTD/reprocessing paragraph; viewer p.41 §3.5 first operability-testing sentence

Excluded or limited: 2010 federal mandates, old six-step RMF, impact-tier schedules, old media/platform examples and the remaining technical implementation guidance are unassigned. These are stable recovery-planning concepts, not EU legal requirements. Verification limits: Stable disruption/dependency/recovery-priority/test concepts only; old federal mandates, impact schedules, six-step RMF and implementation recipes excluded. Stable business interruption/resource recovery/data recovery concepts; no2010 mandates or footnotes imported. Stable objective definitions only, excluding old federal mandates, footnotes and platform configurations; exercise arithmetic is fictional inference. Discussion-only exercise concept, no old federal frequency requirements or full technical readiness inference. Stable recovery definitions and testing purpose only. Footnotes, old platforms/configurations and unrelated recommendations excluded.

NIST stable cryptographic mechanisms concepts
Bounded primary or first-party professional reference

Viewer p.29 section 3.1 first two paragraphs; pp.30–31 opening section 3.2, stop before Several classes; p.34 first two paragraphs of 3.3 and footnote 49; p.44 section 4.2.3 first three paragraphs. Old algorithms/approval/key-size lists excluded. Guide section 15: Viewer p.29 §3.1 first two paragraphs; pp.30–31 §3.2 opening through first paragraph on p.31; p.34 §3.3 first two paragraphs/footnote 49; p.44 §4.2.3 first three paragraphs. No algorithm/approval/key-size lists. Supplemental primary verification only (not a new whole-publication assignment): SP800-175Br1 viewer p29 section3.1 first2 paragraphs; pp30–31 section3.2 opening; p34 section3.3 first2 paragraphs and footnote49; p44 section4.2.3 first3 paragraphs; supplemental audit reading viewer p50 section5 Key Management first3 paragraphs Viewer p.44 §4.2.3 first three paragraphs SP 800-175Br1 §1.3 Certificate/Private key/Public key/Secret key; §3.2 first paragraphs; §4.2.3 first paragraphs; PDF viewer pages 11,12,16,17,18,30,31,35,44,45 Viewer p.29 §3.1 hash comparison; p.31 opening encryption paragraph; p.34 §3.3; p.42 §4.2.1 unprotected-hash warning; p.44 §4.2.3 opening signature paragraphs

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Stable hash/encryption/key-pair/signature concepts. All old algorithm approvals/key-size lists, SHA1/TDEA/DSA advice excluded. Not current deployment-selection guidance. The p50 supplement supports key generation/use/protection/retirement concepts only; no algorithm/key-size guidance or purchase/deployment requirement is imported. Signature key pair, secrecy, authentication/non-repudiation support; no unconditional individual attribution/legal result. Stable key-role, shared-secret, signature and trust concepts ONLY. Old algorithm tables, approvals, transition dates, strengths and deployment recommendations are not verified or imported. Stable concept/key-role support only. Old algorithm approval, mode, key-size and deployment recommendations excluded.

Threat information, context and safe sharing
Bounded primary or first-party professional reference

Viewer p.5 Executive Summary second and third paragraphs only; p.7 heading “Protect the security and privacy of sensitive information” and its paragraph only. 2016 tool/feed/protocol details and distribution labels elsewhere are unassigned. A raw indicator needs context and evaluation; a sharing recommendation does not authorize disclosure of private data. Guide section 18: Viewer p.5 Executive Summary second/third paragraphs and p.7 security/privacy sharing paragraph only. Supplemental primary verification only (not a new whole-publication assignment): SP800-150 viewer p5 Executive Summary second/third paragraphs

Excluded or limited: 2016 tool/feed/protocol details and distribution labels elsewhere are unassigned. A raw indicator needs context and evaluation; a sharing recommendation does not authorize disclosure of private data. Verification limits: Threat information, analysis/interpretation/enrichment for decisions. No raw indicator assumed a complete assessment, no sharing authorization.

NIST: discretionary access control (DAC) - Glossary
Bounded primary or first-party professional reference

Definitions/source pairs: NIST SP 800-192 plain-language definition and SP 800-53 Rev. 5 definition only Guide section 10: Selected SP 800-192 / SP 800-53r5 definition-source pairs only. Supplemental primary verification only (not a new whole-publication assignment): SP800-192 and SP800-53r5 definition/source pairs

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Bounded discretionary decisions/delegation; organizational policy can restrict discretion. No legal-title claim.

Port filters, application awareness and network zones
Bounded primary or first-party professional reference

Viewer p.12 §2.1.1 first two sentences; p.15 §2.1.3 begin at “Stateful protocol analysis improves” and continue through the FTP put example, stop before “This feature”; p.21 opening paragraph on application-based host firewalls; p.24 Figures 3-1/3-2 and the paragraph segment beginning “It is common to put public-facing servers” through the paragraph’s end. 2009 market claims (“newer trend”, prevalence of hardware), ActiveX/SSL examples, broad DMZ bypass discussion and all deployment/protocol rules are excluded. A port number does not prove the application, and a firewall does not guarantee safety. Guide section 12: Viewer p.12 §2.1.1 first two sentences; p.15 “Stateful protocol analysis improves” through FTP put example; p.21 application-based firewall opening; p.24 Figures 3-1/3-2 and the segment starting “It is common to put public-facing servers”. Supplemental primary verification only (not a new whole-publication assignment): SP800-41r1 viewer p24 figures3-1/3-2 and paragraph segment It is common to put public-facing servers through paragraph end Viewer p.11 §2 opening definition; p.12 §2.1/2.1.1; p.15 §2.1.3 through FTP-put example

Excluded or limited: 2009 market claims (“newer trend”, prevalence of hardware), ActiveX/SSL examples, broad DMZ bypass discussion and all deployment/protocol rules are excluded. A port number does not prove the application, and a firewall does not guarantee safety. Verification limits: Public-facing DMZ servers and controlled traffic to protected network. Broad bypass discussion, old protocol/deployment rules and market claims excluded. Traffic enforcement and differing filtering capabilities. p.11 is audit support, not reinstating dated market/deployment claims.

NIST SP 800-41r1: packet, application and inspection boundaries
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer p.11 (printed 2-1), section 2 layer-role paragraph/Figure 2-1 only; Viewer pp.12–13 (printed 2-2–2-3), section 2.1.1 only through the source/destination/protocol/port/interface filtering list; viewer p.14 (printed 2-4), section 2.1.2 first four paragraphs and Table 2-1 on TCP connection state/source-destination ports; viewer p.15 (printed 2-5), section 2.1.3 first three paragraphs on application behaviour, commands and input validation; viewer p.16 (printed 2-6), section 2.1.4 only the two-connection proxy explanation and the paragraph on optional decryption, inspection and re-encryption; viewer p.21 (printed 2-11), section 2.3 in full. Page numbers are one-based PDF viewer pages. Practice/feedback status: No publisher questions or key in the selected passages. CC04 supplies an original worked model with explained expected outcomes.

Excluded or limited: Historical 2009 teaching, not current firewall product advice. Skip obsolete product examples, market trends, older SSL/FIPS recommendations and other unassigned configuration material. A host application allowlist, a network application-aware firewall and server-side business authorization are distinct controls. Currency: September 2009 revision 1; checked against the original PDF on 29 October 2026 for stable distinctions only. Modern product behaviour must be checked separately.

NIST SP 800-41r1: the firewall traffic-control concept
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer p.11 (printed 2-1), section 2 first sentence defining a firewall's traffic-control role. This supplements the site's existing NIST_FIREWALL resource only for the explicit IDS/firewall comparison. Practice/feedback status: One conceptual definition; no practice key.

Excluded or limited: 2009 deployment rules, old protocol examples, market claims and compliance statements are unassigned. No claim that a firewall authenticates a model output or guarantees safe content. Currency: September 2009 publication; only the stable named concept reused, checked 2026-10-29.

Why an outside consultant can perform a first-party audit
Bounded primary or first-party professional reference

Only the definition, Notes 1–2 and consultant example, retaining attribution to ISO 17000:2020. Conformity-assessment vocabulary reference, not a replacement for the exact ISMS requirements or PECB course. Guide section 27: Selected ISO/IEC 17000:2020-origin first-party definition/context only. Supplemental primary verification only (not a new whole-publication assignment): Definition, Notes1–2; external consultant internal-audit example

Excluded or limited: Conformity-assessment vocabulary reference, not a replacement for the exact ISMS requirements or PECB course. Verification limits: Published primary terminology excerpt; first-party relationship including external body acting on behalf of and controlled by organization.

NIST CSRC generative-AI definition
Bounded primary definition; source context applies

The generative artificial intelligence definition attributed to NIST SP 800-218A only; no implementation or full-document assignment. Supplemental primary verification only (not a new whole-publication assignment): Generative artificial intelligence definition; source SP800-218A Definitions: NISTSP800-218A entry

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Synthetic content including images/audio/video/text; definition-source pair only. Synthetic content-generation concept only.

NIST hash security properties
Bounded primary or first-party professional reference

Three collision/preimage/second-preimage properties only; no algorithm lists/tables. Guide section 15: Only collision, preimage and second-preimage resistance definitions; no strength/algorithm tables. Supplemental primary verification only (not a new whole-publication assignment): Security Strengths of Approved Hash Functions: collision, preimage, second-preimage definitions Hash Functions: Security Strengths of Approved Hash Functions, three property definitions

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Only three computational-resistance properties. No algorithm/strength tables or inference that collisions cannot exist. Only collision/preimage/second-preimage definitions and fixed-length digest concept; no strength-table or algorithm-approval inference.

NIST: internet of things - Glossary
Bounded primary or first-party professional reference

Definitions with their source context only; recognize overlap with industrial/OT devices Guide section 13: Selected definition and its source context only. Supplemental primary verification only (not a new whole-publication assignment): Selected Internet of Things definition/source pairs, SP1800-16B/C

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Network/internet connectivity context for IoT; does not make all integrated computing IoT.

Awareness, training and learning-program improvement
Bounded primary or first-party professional reference

Viewer p.15 §1.3 through p.16; p.28 §2.3 only, stop before Table 1; p.32 Table 2 and the following privacy paragraph; p.68 §5.2.1 only. US-specific law, mandated training frequencies, the 24-hour account-policy example, federal roles and other sections are unassigned. Organizational training schedules in the source are not a study timetable. Guide section 6: Viewer pp.15–16 §1.3; p.28 §2.3 before Table 1; p.32 Table 2/privacy paragraph; p.68 §5.2.1 only. Supplemental primary verification only (not a new whole-publication assignment): SP 800-50r1 §1.4 Cybersecurity and Privacy Culture; AppendixB awareness/content/competency/training; §5.2 learner evaluation Levels2-3; PDF viewer pages 17,71,72,82,83,86

Excluded or limited: US-specific law, mandated training frequencies, the 24-hour account-policy example, federal roles and other sections are unassigned. Organizational training schedules in the source are not a study timetable. Verification limits: Understanding, task learning and demonstrated capability are distinct; source notes labels vary, so quiz distinctions are introductory rather than universal course taxonomy.

NIST SP 1500-29 — LLM definition only
Bounded primary definition; source context applies

Viewer p.13 (printed p.5), first sentence of the Large Language Models (LLM) bullet only. No other content is assigned. Supplemental primary verification only (not a new whole-publication assignment): Viewer p.13 printedp.5: first sentence of Large Language Models bullet

Excluded or limited: All later sentences in the LLM bullet, its generative/discriminatory taxonomy and training generalizations, other definitions, fire-service recommendations and all remaining pages are unassigned. This is not an extra exam syllabus or an AI deployment course. Verification limits: Selected deep-learning/text-dataset definition only; later taxonomy/training statements excluded.

NIST: mandatory access control (MAC) - Glossary
Bounded primary or first-party professional reference

Definition/source pair from SP 800-53 Rev. 5 only; restrictions and explicitly trusted subjects matter Guide section 10: SP 800-53r5 definition-source pair only. Supplemental primary verification only (not a new whole-publication assignment): Mandatory access control definition/source pair SP800-53Rev5

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Uniform constraints on discretion; explicitly trusted subjects possible; no claim central administration uniquely determines a model.

NIST CSRC machine-learning definition
Bounded primary definition; source context applies

Machine Learning definition attributed to NIST SP 800-55v1 only; acronym/source list and navigation do not supply additional definitions. Supplemental primary verification only (not a new whole-publication assignment): Machine Learning definition attributed to SP800-55v1 Definitions: NISTSP800-55v1 entry

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Data adaptation with an accuracy-improvement goal; goal is not a result guarantee. Learning/adapting from data concept only.

Patch workflow, verification, support and useful metrics
Bounded primary or first-party professional reference

Viewer p.11 §2.2 through p.12 immediately before §2.3; pp.12–14 §§2.3.1–2.3.4 (skip old BIOS-reference footnote); p.23 §3.6 through p.24 Table 1 and its first explanatory paragraph; p.25 §3.7 eight procurement questions. Skip p.25 opening continuation about passive/active scans and all remaining unassigned sections. Matrix figures are notional examples, not required deadlines or proof of security. No patch deployment or software purchase is assigned. Guide section 20: Viewer pp.11–12 §2.2; pp.12–14 §§2.3.1–4, skip BIOS footnote; pp.23–24 §3.6/Table 1/following paragraph; p.25 §3.7 eight procurement questions. Exclude opening passive/active-scan conflation on p.25. Supplemental primary verification only (not a new whole-publication assignment): Viewer pp.11–12 §2.2; pp.12–14 §§2.3.1–2.3.4

Excluded or limited: Skip p.25 opening continuation about passive/active scans and all remaining unassigned sections. Matrix figures are notional examples, not required deadlines or proof of security. No patch deployment or software purchase is assigned. Verification limits: Affected assets; preparation, deployment, verification and monitoring. No old footnote or universal illustrative deadline imported.

NIST SP 800-63B-4: phishing-resistance definition
Bounded primary definition; source context applies

Viewer p.46 (printed p.35), section 3.2.5 first two paragraphs only: verifier-impersonation context and phishing-resistance definition. This is a new bounded glossary reading in the already-selected final 2025 PDF. Supplemental primary verification only (not a new whole-publication assignment): SP 800-63B-4 §3.2.5 Phishing Resistance, printed p35; PDF viewer pages 46 SP 800-63B-4 §5.2 Reauthentication, federation-session paragraph, printed p56; PDF viewer pages 67,68

Excluded or limited: All later paragraphs, strength/algorithm requirements, channel binding and implementation advice are unassigned by this glossary. The study guide's separate password assignment on viewer p.25 is unchanged. Verification limits: Protocol property and relayable-OTP distinction only; not protection against every social-engineering attack. IdP and relying-party sessions can end independently; one account change does not prove every session/token or unrelated application is invalidated.

VPN tunnel boundaries and access restrictions
Bounded primary or first-party professional reference

Viewer p.15 §2.2.1 opening paragraph; p.16 Figure 2-1 and the first paragraph below the figure only; p.17 first two paragraphs, stopping before §2.2.2. 2016 client plug-in/SSL terminology and protocol/cryptography configuration advice are unassigned. The owner still lists r2 as final; a proposed r3 is not substituted for the final. VPN protection covers the tunnel, not every route, endpoint, stored file or Internet identity. Guide section 12: Viewer p.15 §2.2.1 opening; p.16 Figure 2-1/one paragraph; p.17 first two paragraphs before §2.2.2. Supplemental primary verification only (not a new whole-publication assignment): SP 800-46r2 §2.2.1 Tunneling, first paragraphs and tunnel boundary paragraph, printed pp5-6; PDF viewer pages 15,16

Excluded or limited: 2016 client plug-in/SSL terminology and protocol/cryptography configuration advice are unassigned. The owner still lists r2 as final; a proposed r3 is not substituted for the final. VPN protection covers the tunnel, not every route, endpoint, stored file or Internet identity. Verification limits: Conceptual tunnel/endpoint boundary only; no old protocol, client plug-in or configuration recommendation.

Testing concepts, interpretation and authorized scope
Bounded primary or first-party professional reference

Viewer p.26 §4.2 first paragraph and the paragraph beginning “Some scanners can help identify”; p.27 §4.3 opening paragraph and its three capability bullets continuing at the top of p.28; p.40 §5.3 second paragraph only; pp.67–68 Appendix B rules-of-engagement template. Stable planning/definition examples from 2008. Skip old tools, scanning commands/evasion techniques, exploitation, annual-frequency claims, wireless configuration and all other content. The scope template is a paper planning example: specify approval, allowed/excluded targets, methods, stop/resume criteria and reporting. No real test is assigned. Guide section 21: Viewer p.26 §4.2 opening/“Some scanners” paragraph; pp.27–28 §4.3 opening/three bullets; p.40 §5.3 second paragraph; pp.67–68 rules-of-engagement template only. Supplemental primary verification only (not a new whole-publication assignment): Viewer p.29 §4.3 false positive/negative paragraphs; p.36 §5.2 opening definition; pp.67–68 Appendix B scope, limitations, targets, authorized activities SP 800-115 AppendixB Rules of Engagement Template: §§1.1-1.4,2.1-2.3,3.1-3.2,4,5.3,6; PDF viewer pages 67,68,69 SP 800-115 §4.3 Vulnerability Scanning, interpretation and false-positive/negative limitations; PDF viewer pages 27,29

Excluded or limited: Stable planning/definition examples from 2008. Skip old tools, scanning commands/evasion techniques, exploitation, annual-frequency claims, wireless configuration and all other content. The scope template is a paper planning example: specify approval, allowed/excluded targets, methods, stop/resume criteria and reporting. No real test is assigned. Verification limits: Stable testing concepts and rules of engagement. pp.29/36 are audit supplements to bounded teaching; old tools/frequencies/configuration recommendations excluded. Illustrative authorization/boundaries/contact/stop-condition/evidence/reporting template only; no actual testing authorized. Stable scanning limitations and validation concepts only; no current tool capabilities or instructions to run scans.

NIST SP 800-115: rules of engagement, protected findings and verified follow-up
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer p.40 (printed 5-6), section 5.3, only the final paragraph on reporting successful/unsuccessful tactics and improving systems rather than singling out people; viewer pp.67–69 (printed B-1–B-3), Appendix B sections 1.1–1.4, 2.1–2.3, 3, 4, 5.1, 5.3 and 6; viewer p.60 (printed 7-6), section 7.4.2 only the secure-storage/access/retention paragraphs; viewer pp.62–64 (printed 8-1–8-3), section 8.1 first paragraph, 8.2 first paragraph and 8.3 implementation/verification/tracking discussion. The exercise applies the template to a fictional physical/social process test. Practice/feedback status: The template has no publisher answer key. CC05 supplies an original case and explained editorial model; it is not NIST-issued assessment material.

Excluded or limited: Exclude operational attack instructions, Appendix A's obsolete tools, live phishing/entry attempts, old cryptographic examples, old sanitization categories, universal test-frequency claims and the claim that a retest must be an exact mirror to have any value. No jurisdiction-specific legal authority or permission to test a real person/system follows from this reading. Currency: September 2008 publication; selected authorization, reporting, data-handling and follow-up concepts only, read 29 October 2026. Technical tools and product recommendations are not treated as current.

NIST: Virtual Local Area Network - Glossary
Bounded primary or first-party professional reference

VLAN definition and cited source context only Guide section 12: Selected definition/source context only. Supplemental primary verification only (not a new whole-publication assignment): CSRC Glossary Virtual Local Area Network: definitions sourced to SP1800-15B and SP1800-15C

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Data-link logical broadcast-domain division only; complete-path isolation/encryption conclusions require additional evidence.

NIST OT/ICS introduction — two short excerpts
Bounded primary or first-party professional reference

Viewer p. 5 abstract and p. 18 first paragraph only. OT/ICS examples and safety, reliability and performance considerations. Revision 3 is the current final; September 2026 Revision 4 is a public draft, not assigned as a final standard. Guide section 13: Viewer p.5 abstract and p.18 first paragraph only. Supplemental primary verification only (not a new whole-publication assignment): SP800-82r3 viewer p5 Abstract and p18 Executive Summary first paragraph Viewer p.5 Abstract and p.18 Executive Summary opening paragraph

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: OT programmable systems interacting with the physical environment; ICS examples. No universal equivalence with embedded or IoT systems. OT physical interaction and ICS examples; performance/reliability/safety context, not current deployment instructions.

Editorial access and payment orientation
Editorial companion, selection or scope record; not independent primary evidence

Separates free references, optional learning purchases, the selected paid PECB course and credential fees. Confirm current issuer and package terms before payment.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

PECB ISO/IEC 27001:2022 Foundation Candidate Handbook, v1.5 (2026)
Official exam scope or route reference; not complete teaching

Viewer pp.5–7: course and assessment process, including p.5 footnote; pp.8–10: both domains and their 65 competency/knowledge statements plus exam format; p.11: five sample questions; pp.12–14: certificate/application rules, cycle and fee/route footnotes, including p.14 accreditation wording. Supplemental primary verification only (not a new whole-publication assignment): ISO27001:2022 Foundation Candidate Handbook v1.5 (2026), viewer p4 Purpose and scope Viewer p.8 Domain1; p.9 Domain2 knowledge statement5; p.11 sampleQ3 labels only; p.12 Foundation requirements/designation

Excluded or limited: A blueprint is not complete teaching. The five public samples do not supply a complete official keyed mock. Policy category names are identified, but exact definitions and boundaries still need authoritative course teaching. Fee figures are not a package quote. Use the directly opened v1.5 document, not inconsistent search-index version snippets. Verification limits: Personal introductory certificate program, distinct from organization management-system certification; not authority to serve as certification body. Issuer names/blueprint/award route; policy-category boundaries and official answer key unavailable. No inferred policy classification.

PECB ISO/IEC 27001:2022 Foundation Candidate Handbook, v1.5
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer pp.5 and 12: course prerequisite and award steps; pp.8–10: two domains and competency/knowledge statements; p.11: five public samples. Read the current rules before relying on administrative details. Practice/feedback status: Five questions on p.11; no answer key or explanations found in this complete 15-page handbook. No full free current PECB keyed mock verified.

Excluded or limited: Not the course, standard text, complete assessment or answer key. Names the three policy categories but does not define their boundaries. Do not infer answers from distractors. Currency: ©2026, Candidate Handbook Version 1.5, 15 pages; downloaded and text inspected 29 October 2026.

PECB’s examples of the four Annex A themes
Bounded primary or first-party professional reference

Only the four theme headings and their two examples each, beginning “The four themes of the security controls”. Skip all other page copy, including generalized revision claims. Eight examples do not teach every Annex A control or decide applicability; full course/control teaching remains outstanding. Guide section 25: Only four theme headings and two examples per theme; not a complete Annex A lesson. Supplemental primary verification only (not a new whole-publication assignment): Four theme headings and two examples each beginning The four themes of the security controls Four-theme headings: organizational, people, physical, technological; selected examples under each heading

Excluded or limited: Skip all other page copy, including generalized revision claims. Eight examples do not teach every Annex A control or decide applicability; full course/control teaching remains outstanding. Verification limits: Organizational, people, physical, technological examples only; screening and awareness are people examples, distinct from general control categories. Issuer theme names/examples only; not the full 93-control licensed guidance.

NIST policy types and configuration-change concepts
Bounded primary or first-party professional reference

PDF p. 36 §5.1 through the procedures paragraph on p. 37 only PDF p. 58 §8.3 through its continuation on p. 59, stop before §8.4; configuration/change decisions only p. 37 §5.2 first two sentences; p. 38 §5.3 first two sentences; §5.4 introductory paragraph across pp. 40–41 only. NIST policy names are background, not the exact PECB taxonomy Guide section 3: Viewer pp.36–37 §5.1 through procedures; p.37 §5.2 first two sentences; p.38 §5.3 first two sentences; pp.40–41 §5.4 introduction only. Guide section 20: Viewer p.58 §8.3 through p.59 before §8.4 only. Supplemental primary verification only (not a new whole-publication assignment): SP 800-12r1 viewer pp12–13 section1.4 CIA/security-control entries SP 800-12r1 viewer p19 section2.6 first paragraph and layered example through first sentence on p20; pp36–37 section5.1 procedures paragraph SP 800-12r1 viewer p24 section3.4 Information Owner/Steward SP 800-12r1 viewer pp58–59 section8.3; p58 section8.2 first element; p59 section8.4 usability-test sentence Viewer p.13 §1.4 integrity/data/system-integrity definitions SP 800-12r1 §10.13 Physical and Environmental Protection, printed p66; PDF viewer pages 76,77 SP 800-12r1 chapter5 Policy; §5.1 Standards, Guidelines, and Procedures; PDF viewer pages 36 SP 800-12r1 §5.3 Issue-Specific Policy and §5.6 Cost Considerations; PDF viewer pages 38,43 SP 800-12r1 Appendix A Privilege; §5.4.3 System-Specific Policy Implementation; PDF viewer pages 42,92 SP 800-12r1 §5.4.3 System-Specific Policy Implementation; PDF viewer pages 42 SP 800-12r1 chapter4 Threats: Social Engineering bullet; PDF viewer pages 31 Viewer p.19, printed p.9, §2.6 defense-in-depth paragraph: administrative defenses, security technologies and physical defenses

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Supplemental audit reading of stable terminology, not old federal legal requirements. Integrity also covers improper/accidental damage; no implication that one event has only one impact. Administrative policies/procedures distinguished from security technologies and physical safeguards. Excludes near-real-time notification assertion; classification can overlap. Supplemental audit reading: authority/responsibility for use/protection policies, distinct from owning infrastructure. Federal organizational example used only as a conceptual role. Configuration tracking/approval/documentation and inspection/testing. Supplemental backup usability sentence is audit evidence, not an expanded student assignment. Historical federal-context concepts; accidental changes count. Audit supplement, not importing2017 legal guidance. Physical/environmental-control classification; no current configuration prescription. Conceptual primary-author guidance only; no claim of complete requirements or real-world verification. Development, review, dissemination and implementation are supported; no mandatory universal lifecycle sequence. Technology enforces policy only with suitable design, programming, installation, configuration and maintenance. Separation of conflicting authority; two accounts controlled by one person do not by themselves provide independent responsibility. Human manipulation mechanism; independent verification in fictional scenarios is applied reasoning, not a quoted universal procedure. Stable general category distinction only. No old technology recommendations.

selected NIST PQC introduction
Bounded primary or first-party professional reference

Only “What is Post-Quantum Cryptography (PQC)?” and the introductory quantum-resistant terminology Guide section 15: selected NIST PQC introductory purpose only; not deployment advice. Supplemental primary verification only (not a new whole-publication assignment): Frequently Asked Questions: What is Post-Quantum Cryptography?; Discovery and Inventory: What is a cryptographic inventory?

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Conceptual purpose and inventory preparation only; no algorithm selection, approval inference, deadlines or complete migration plan.

EDPB Data protection basics: selected reading
Optional official EU privacy context; not legal advice

“Does the GDPR apply” and principles, as an EU example Guide section 2: “Does GDPR apply” and data-protection principles only; EU example, not a complete law course. Supplemental primary verification only (not a new whole-publication assignment): The key principles of the GDPR: Purpose limitation, Data minimisation, Storage limitation, Security; good-practices checklist

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Applicability and legal obligations depend on jurisdiction and circumstances; this site supplies no legal determination. Verification limits: EU/EEA conceptual data-protection example; no universal retention deadline or legal applicability conclusion for fictional organizations.

NIST SP 1300: CSF 2.0 Small Business Quick-Start Guide
Bounded primary or first-party professional reference

PDF pp. 2–8 only: Overview and six Functions PDF pp. 3–5, as examples PDF pp. 3, 7–8 PDF pp. 4, 6–8 PDF pp. 7–8 Guide section 3: Viewer pp.2–8: six CSF functions and small-business orientation. Supplemental primary verification only (not a new whole-publication assignment): SP1300 viewer p3 Govern legal/regulatory/contractual context; p4 Identify inventories/services/data Viewer p.2 Framework overview; p.3 Govern actions and questions

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Applicability depends on organization; inventory can include services/data. Small-business conceptual guidance, no complete compliance determination. Voluntary organizing framework, governance, accountability, applicable legal/regulatory/contractual requirements.

Editorial selection policy for legacy course material
Editorial companion, selection or scope record; not independent primary evidence

Earlier course versions do not establish current exam coverage. Follow current issuer outlines and the specifically retained primary readings.

Excluded or limited: Use underlying publisher references within their stated scopes. This editorial record supplies no official exam key, full course, legal conclusion or credential entitlement.

NIST IR 8286A Revision 1: selected risk-scenario examples, December 2025
Bounded primary or first-party professional reference

PDF p. 21: prose above Figure 4 and Figure 4 only; p. 35: Figure 8 and its explanation; p. 55: Figure 12 and its explanation Additional method-selection teaching: viewer p.58 §2.3.1 first paragraph and IEC quotation only; p.59 final three paragraphs beginning “As shown by the referenced standards”. Skip the hypothetical 21% loss calculation and advanced method sections. Compare useful output, reliable data, uncertainty, stakeholder needs, resources and strategy; no mandatory ISO risk formula. Only the previously assigned portions on PDF pp. 21, 35, 55; illustrative risk teaching, not ISO requirements Additional method-selection teaching: viewer p.58 §2.3.1 first paragraph and IEC quotation only; p.59 final three paragraphs beginning “As shown by the referenced standards”. Skip the hypothetical 21% loss calculation and advanced method sections. Compare useful output, reliable data, uncertainty, stakeholder needs, resources and strategy; no mandatory ISO risk formula. Guide section 5: Viewer p.21 prose above Figure 4 and Figure 4; p.35 Figure 8/explanation; p.55 Figure 12/explanation; p.58 §2.3.1 first paragraph/IEC quotation; p.59 final three paragraphs only. Supplemental primary verification only (not a new whole-publication assignment): Viewer p.21 prose above Figure4; p.35 Figure8 explanation; p.55 Figure12 explanation IR 8286Ar1 Executive Summary; §2.2 Risk Identification and Fig8; §2.2.2.1 Threat Enumeration; §2.2.3; §2.3 Detailed Risk Analysis; PDF viewer pages 12,34,35,36,39,40,48,49,57,58

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Scenario context, consequences on objectives and distinction of likelihood/impact. Figures extracted text may omit graphical labels; no graphics-only claims used. Primary-author scenario, threat/vulnerability and uncertainty concepts only; no ISO requirements, universal scoring formula, or actual event inference.

NIST risk lifecycle, register and KPI/KRI examples
Bounded primary or first-party professional reference

PDF pp. 17–18 §2.1.2 and Figure 2 through the six steps/risk-register text, stop before §2.2 PDF p. 45 §3.6.2 KPI/KRI only; stop before §3.6.3 Revisit only pp. 17–18 §2.1.2 / Figure 2 and register discussion; illustrative NIST background, not ISO treatment requirements Guide section 5: Viewer pp.17–18 §2.1.2 and Figure 2 through register discussion, stop before §2.2. Guide section 8: Viewer p.45 §3.6.2 KPI/KRI only, stop before §3.6.3. Guide section 25: Viewer pp.17–18 selected illustrative lifecycle/register only. Supplemental primary verification only (not a new whole-publication assignment): Viewer p.45 §3.6.2 Key Risk Indicators and Key Performance Indicators IR 8286r1 §2.1 six-step notional lifecycle; §3.6 Monitor, Evaluate, and Adjust; PDF viewer pages 18,43,44 IR 8286r1 §3 Table1 notional CSRR elements and following model qualification; PDF viewer pages 21,22 IR 8286r1 §3.5 and Table2 negative-risk response types; §3.5.2 Responding to Residual Risk; PDF viewer pages 39,41 IR 8286r1 §3.4 Prioritize the Risks, threshold comparison and enterprise-context paragraphs; PDF viewer pages 38,39 Viewer p.18 §2.1.2 steps2–3; p.20 §3 opening scenario elements; p.39 §3.5 opening; p.40 §3.5.1 preventive/detective paragraph

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Indicators relative to objective/exposure/tolerance; no guarantee of future incidents or universal naming boundary. Notional guidance and roles only, not a mandatory ISO/PECB process or full formal approval framework. Illustrative fields, ownership and maintained status; not a universal mandatory template and not proof of decision quality. Contextual response, retained exposure, approval and monitoring concepts; insurance can leave nontransferable consequences. Analyzed exposure compared against enterprise thresholds; no claim of universal thresholds or certainty of realized loss. Risk scenario elements and assessment/treatment distinctions. Fictional business examples are applied reasoning; no universal numeric risk formula.

NIST IR 8286r1: enterprise risk direction, appetite and tolerance
Bounded primary teaching reference; exact assigned scope only

Viewer p.16 (printed p.7), section 2.1 Enterprise Risk Direction: appetite and tolerance paragraphs, footnote 11, and email availability example only. Feedback status: Conceptual guidance with illustrative example; no assessment or scored key.

Excluded or limited: No full enterprise risk course, mandatory Cedar threshold, official exercise key or learner marking. The federal performance-variance quotation is context-specific. Currency: NIST IR 8286r1, December 2025; official final publisher page confirms this supersedes the 2020 edition.

current NIST media-sanitization concepts
Bounded primary or first-party professional reference

Viewer p. 10 Executive Summary; first paragraph only of §3.1.1 Clear on p. 17, §3.1.2 Purge on p. 19, §3.1.3 Destroy on p. 20. No command, physical destruction or real-device exercise. Current 2025 revision replaces r1; selection depends on medium, sensitivity and circumstances. Guide section 16: Viewer p.10 Executive Summary; first paragraph only of Clear p.17, Purge p.19 and Destroy p.20. Supplemental primary verification only (not a new whole-publication assignment): SP800-88r2 viewer p17 section3.1.1 first paragraph; p19 section3.1.2 first paragraph; p20 section3.1.3 first paragraph Viewer p.10 Executive Summary SP 800-88r2 §3.1.2 Purge Sanitization Method; §3.1.3 first paragraph; PDF viewer pages 19,20

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Clear/Purge/Destroy outcomes only: hard-copy exclusions, simple versus laboratory recovery and usability. No device-specific technique, overwrite recipe or authorization to destroy real records. 2025r2 definition, media/sensitivity/confidentiality obligations; no universal delete instruction. 2025 definitions: advanced-recovery infeasibility, potential reuse, hard-copy exclusion and virtual-storage limitations; no device-specific recipe.

selected OWASP static/dynamic testing explanation
Bounded primary or first-party professional reference

What is SAST?, How SAST works, Limitations, Complementary security testing Guide section 21: What/How/Limitations/Complementary approaches only; no tools or execution. Supplemental primary verification only (not a new whole-publication assignment): What is SAST?; How SAST works; Limitations; Complementary security testing Developer Guide Static Analysis: What is SAST?, How SAST works, Limitations, Complementary security testing

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Static code/artifact analysis without execution versus DAST of running application; no live test authorization inferred. Artifact examination without executing target; false findings and complementary runtime testing acknowledged. Official live source also checked.

selected Microsoft example: red, blue and joint exercises
Bounded primary or first-party professional reference

Only Penetration testing and assessment, Red teams, Blue teams and Joint exercises Guide section 21: Penetration testing and red/blue/joint conceptual sections only. Supplemental primary verification only (not a new whole-publication assignment): Microsoft security incident management: Preparation, Blue teams; Red teams; Joint exercises Microsoft security incident management: Preparation — Attack simulation, Red teams, Blue teams, Joint exercises

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Original provider exercise example for defensive/adversarial/cooperative functions. Its separate full-time departments are not asserted as a universal organizational requirement. Provider worked example supports adversarial and joint collaborative functions; no real testing authorization or fixed organizational chart requirement.

selected OWASP threat modeling
Bounded primary or first-party professional reference

Introduction and Overview, including the four-question framework only; advanced methods deferred Guide section 21: Introduction/overview and four-question framework only; no application testing. Supplemental primary verification only (not a new whole-publication assignment): Threat Modeling Cheat Sheet: Overview, four questions; System Modeling; Review and Validation

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Author-selected structured reasoning; not one universally mandatory method. Official live source also checked.

NIST Zero Trust and micro-segmentation explanation
Bounded primary or first-party professional reference

Viewer p. 13 first paragraph and definition box; p. 15 tenets 1–3 only; p. 21 §3.1.2 micro-segmentation only, stop before §3.1.3. Do not read blanket collection language as privacy/legal advice; implementation and product choices are deferred. Guide section 12: Viewer p.13 opening/definition; p.15 tenets 1–3; p.21 §3.1.2 only. Supplemental primary verification only (not a new whole-publication assignment): Viewer p.21 §3.1.2 ZTA Using Micro-Segmentation SP 800-207 Abstract; §1 Introduction and §5 Threats Associated with ZTA; PDF viewer pages 4,10,37

Excluded or limited: Other passages, implementation instructions and full-course coverage are outside this selected reading. Verification limits: Individual/small resource groups and enforcement points; conceptual granularity, not complete ZTA implementation. No implicit trust from location/ownership; guiding principles and continuing risks, not single-product/no-risk guarantee.

NIST: Access Control Matrix definition, attributed to NISTIR 7316
Supplemental primary or first-party professional reference; verification scope only

Only the glossary definition and its NISTIR 7316 attribution: rows identify subjects, columns identify objects, and entries specify the associated access rights.

Excluded or limited: This direct definition replaces the incorrect SP 800-162 p.14 locator. It does not teach a full access-control implementation.

Configuring Accounting
Supplemental primary or first-party professional reference; verification scope only

PDFp1 opening; pp2–3 Named Method Lists for Accounting type list 2012 product-original conceptual example: activity records for auditing, EXEC sessions, Commands, Connection and System types; no current configuration/deployment advice. PDF p.1 opening accounting explanation; pp.2–3 Named Method Lists, Commands accounting Stable AAA activity-record concept only. Old product configuration commands and protocol recommendations are excluded.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. 2012 product-original conceptual example: activity records for auditing, EXEC sessions, Commands, Connection and System types; no current configuration/deployment advice. Stable AAA activity-record concept only. Old product configuration commands and protocol recommendations are excluded.

Machine Learning Glossary: Agentic
Supplemental primary or first-party professional reference; verification scope only

agent; action space; agentic; agentic workflow Planning/acting, resources/tools/APIs/permissions and varying agent contexts (generative versus reinforcement learning); no claim every agent has one LLM architecture.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Planning/acting, resources/tools/APIs/permissions and varying agent contexts (generative versus reinforcement learning); no claim every agent has one LLM architecture.

application glossary
Supplemental primary or first-party professional reference; verification scope only

Definitions: SP800-137/SP800-37r2 software program; SP1800-16B/C/D functional task examples Software and organizational task examples; not every hardware/software application definition is adopted.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Software and organizational task examples; not every hardware/software application definition is adopted.

operating system glossary
Supplemental primary or first-party professional reference; verification scope only

Definitions sourced to SP800-86 and SP800-152 Platform for programs; hardware-resource management and common services. Other older boot-order assertions not adopted.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Platform for programs; hardware-resource management and common services. Other older boot-order assertions not adopted.

asset glossary
Supplemental primary or first-party professional reference; verification scope only

Definitions: organizational mission/business value; tangible and intangible examples Value to objectives including information, services/capabilities/knowledge as relevant intangible resources; ownership/location does not alone determine value.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Value to objectives including information, services/capabilities/knowledge as relevant intangible resources; ownership/location does not alone determine value.

ISC2 Annual Maintenance Fees
Supplemental primary or first-party professional reference; verification scope only

Members AMF; Associates AMF; How to Pay Your AMF Recurring issuer payment distinct from learning; voucher handling shows entitlement needs verification. No particular individual waiver or future price inferred. MembersAMF and FAQs Credential fees separate from free learning; no quote of actual course package or claim paid status.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Recurring issuer payment distinct from learning; voucher handling shows entitlement needs verification. No particular individual waiver or future price inferred. Credential fees separate from free learning; no quote of actual course package or claim paid status.

Membership Policies and Procedures
Supplemental primary or first-party professional reference; verification scope only

Certification Maintenance Policy sections4,4.1,4.2 CPE and AMF are separate maintenance requirements; actual acceptance/evidence and individual standing require issuer rules. No credit awarded by this quiz.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. CPE and AMF are separate maintenance requirements; actual acceptance/evidence and individual standing require issuer rules. No credit awarded by this quiz.

Computerized Adaptive Testing
Supplemental primary or first-party professional reference; verification scope only

How Does it Work?; FAQs What is CAT? and How does CAT work?; item review/results FAQs Ability estimated from responses/difficulty, subsequent selection adapted; no future booking guarantees.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Ability estimated from responses/difficulty, subsequent selection adapted; no future booking guarantees.

How Does ISC2 Generate and Score Certification Exams?
Supplemental primary or first-party professional reference; verification scope only

What is a scaled score for linear examinations?; passing proficiency for adaptive testing; raw-correct-count FAQ Raw-to-scaled conversion is not raw percentage; linear and adaptive score interpretations remain distinct.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Raw-to-scaled conversion is not raw percentage; linear and adaptive score interpretations remain distinct.

configuration baseline glossary
Supplemental primary or first-party professional reference; verification scope only

SP800-128 Baseline Configuration definition/source pair Reviewed/agreed specifications at a given time under change control, not perpetual security assurance.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Reviewed/agreed specifications at a given time under change control, not perpetual security assurance.

chain of custody glossary
Supplemental primary or first-party professional reference; verification scope only

SP800-101r1 definition/source pair Document evidence handlers/date/time/transfers/purpose; combined with IR2025 contextual limits.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Document evidence handlers/date/time/transfers/purpose; combined with IR2025 contextual limits.

backup glossary
Supplemental primary or first-party professional reference; verification scope only

SP800-34r1 definition/source pair Copy of files/programs for recovery; distinct from current configuration or permissions.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Copy of files/programs for recovery; distinct from current configuration or permissions.

Introduction to dashboards for Power BI designers
Supplemental primary or first-party professional reference; verification scope only

Opening definition; Dashboard basics; Advantages of dashboards Original product example of concise visualization/metrics for monitoring; product single-page constraint is not imposed universally.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Original product example of concise visualization/metrics for monitoring; product single-page constraint is not imposed universally.

Glossary of Computer System Software Development Terminology (8/95)
Supplemental primary or first-party professional reference; verification scope only

embedded computer entry Dated nonbinding reference: integrated computing dedicated to device functions. No connectivity requirement imported; not a current medical-device compliance checklist.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Dated nonbinding reference: integrated computing dedicated to device functions. No connectivity requirement imported; not a current medical-device compliance checklist.

End-of-Life Policy
Supplemental primary or first-party professional reference; verification scope only

Purpose; Scope; EOL milestones; Definitions EOL and Last Date of Support Original vendor example separating EOL process and support milestone/contract; vendor-specific dates not universalized.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Original vendor example separating EOL process and support milestone/contract; vendor-specific dates not universalized.

cryptographic key glossary
Supplemental primary or first-party professional reference; verification scope only

FIPS186-5/FIPS201-3 parameter definition/source pairs Parameter determining algorithm operation. Key secrecy/lifecycle significance additionally supported by selected SP800-175Br1 concepts.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Parameter determining algorithm operation. Key secrecy/lifecycle significance additionally supported by selected SP800-175Br1 concepts.

EXIN Information Security Foundation Sample Exam (ISFS.EN)
Supplemental primary or first-party professional reference; verification scope only

Viewer p3 contents: question/answer-key locations; p14 Answer key heading and Q2 correct-answer mapping Publisher-original example of numbered intended answers and separately supplied rationale. Other questions/distractor rationales not evidence for this audit. Does not endorse editorial quiz or validate current exam equivalence.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Publisher-original example of numbered intended answers and separately supplied rationale. Other questions/distractor rationales not evidence for this audit. Does not endorse editorial quiz or validate current exam equivalence.

blue team glossary
Supplemental primary or first-party professional reference; verification scope only

First definition/source pair, CNSSI4009-2022 Group with defensive role against mock attackers, not a requirement for a standalone department; alternative meanings remain contextual.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Group with defensive role against mock attackers, not a requirement for a standalone department; alternative meanings remain contextual.

Security and Privacy Controls for Information Systems and Organizations, SP800-53r5
Supplemental primary or first-party professional reference; verification scope only

Viewer p71/printedp44 AC-14 Control and Discussion Supplemental primary evidence that specified public actions can be permitted without identification/authentication; not a mandate to allow anonymous access to every system.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Supplemental primary evidence that specified public actions can be permitted without identification/authentication; not a mandate to allow anonymous access to every system.

ISO/IEC27002:2022 official overview
Supplemental primary or first-party professional reference; verification scope only

What is ISO/IEC27002?; relationship and certification FAQs Control guidance distinct from27001 requirements and organizational certification.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Control guidance distinct from27001 requirements and organizational certification.

ISO/IEC 27002:2022 — official control-guidance access boundary
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Official catalogue purpose, edition and access terms; no complete control teaching or all 93 controls reproduced. Practice/feedback status: No exam questions/key.

Excluded or limited: Not a free full control course or a redistribution licence. A few theme examples cannot replace required course control-level coverage. Currency: Catalogue inspected 29 October 2026: edition 3, February 2022, corrected March 2022.

ISO/IEC27003:2017 official catalogue
Supplemental primary or first-party professional reference; verification scope only

Abstract; edition2,2017-03 Official abstract explicitly says explanation/guidance on27001:2013. No relabeling as2022 guidance.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Official abstract explicitly says explanation/guidance on27001:2013. No relabeling as2022 guidance.

ISO/IEC27005:2022 official overview
Supplemental primary or first-party professional reference; verification scope only

What is ISO/IEC27005?; reference/edition Information-security risk-management guidance role, no detailed normative reconstruction.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Information-security risk-management guidance role, no detailed normative reconstruction.

ISO/IEC20000-1:2018 official catalogue
Supplemental primary or first-party professional reference; verification scope only

Abstract opening paragraph Service-management-system requirements role, not interchangeable with ISMS requirements.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Service-management-system requirements role, not interchangeable with ISMS requirements.

ISO9001:2026 official catalogue
Supplemental primary or first-party professional reference; verification scope only

Title; linked from2015 withdrawal notice Current quality-management-system requirements role. No full2026 requirements taught.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Current quality-management-system requirements role. No full2026 requirements taught.

ISO9001:2015 official withdrawal notice
Supplemental primary or first-party professional reference; verification scope only

Status/FAQ/new version; lifecycle withdrawal2026-09-16 2015 withdrawn/replaced by2026. Retain explicit historical terminology origins rather than imply current normative teaching.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. 2015 withdrawn/replaced by2026. Retain explicit historical terminology origins rather than imply current normative teaching.

RFC4949 Internet Security Glossary v2
Supplemental primary or first-party professional reference; verification scope only

Exact named entries Hardware, Network, Virtual private network Informational original technical glossary, not an Internet standard; physical hardware/network/tunnel distinctions only.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Informational original technical glossary, not an Internet standard; physical hardware/network/tunnel distinctions only.

Information definition-source pairs
Supplemental primary or first-party professional reference; verification scope only

SP800-88r2 meaningful-expression definition; NISTIR4734 semantic-context pair Specific meaning/context concept. Multiple source-dependent definitions coexist.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Specific meaning/context concept. Multiple source-dependent definitions coexist.

Operating-system definition-source pairs
Supplemental primary or first-party professional reference; verification scope only

SP800-152 resource/common-services definition; SP800-82r3 sequencing/I/O/resource/data services pair Resource management/application platform concepts, not automatic root-cause diagnosis.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Resource management/application platform concepts, not automatic root-cause diagnosis.

Insider-threat definition-source pair
Supplemental primary or first-party professional reference; verification scope only

SP800-53Rev5 adapted CNSSI4009-2022 pair Authorized-access harm can be witting or unwitting; organizational concept, not presumption of wrongdoing.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Authorized-access harm can be witting or unwitting; organizational concept, not presumption of wrongdoing.

Malware definition-source pairs
Supplemental primary or first-party professional reference; verification scope only

SP800-12Rev1 malicious-code pair and SP800-83r1 malware pair Intent to harm CIA; ordinary accidental malfunction alone does not establish malware.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Intent to harm CIA; ordinary accidental malfunction alone does not establish malware.

Least-privilege definition-source pairs
Supplemental primary or first-party professional reference; verification scope only

SP800-12Rev1/CNSSI minimum-task-access pair Task-needed permissions, including processes; no universal product configuration specified.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Task-needed permissions, including processes; no universal product configuration specified.

NISTIR8259r1 Foundational Cybersecurity Activities for IoT Product Manufacturers
Supplemental primary or first-party professional reference; verification scope only

AppendixB Glossary, printedp.52, IoT Device/IoT System/IoT Platform entries Current primary supplement for physical sensor/actuator plus network/computing concepts, beyond narrower selected glossary pairs.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Current primary supplement for physical sensor/actuator plus network/computing concepts, beyond narrower selected glossary pairs.

ITU-TX.200(07/1994) Basic Reference Model
Supplemental primary or first-party professional reference; verification scope only

§1.4 conceptual purpose; §4.3.5–6; §6.1 specific layers, printedp.28 Seven-layer reference model; not physical implementation inventory. Official status page confirms in force.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Seven-layer reference model; not physical implementation inventory. Official status page confirms in force.

RFC4632 CIDR
Supplemental primary or first-party professional reference; verification scope only

§3.1 Basic Concept and Prefix Notation, printedp.5 Explicit configured prefix, classful defaults not inferred. No allocation/deployment policy imported.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Explicit configured prefix, classful defaults not inferred. No allocation/deployment policy imported.

NISTAI600-1 Generative AI Profile
Supplemental primary or first-party professional reference; verification scope only

§2 overview risk2; §2.2 Confabulation, printedp.6 Confident plausible output can be false; verification need. No new AI deployment instructions.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Confident plausible output can be false; verification need. No new AI deployment instructions.

NIST AI 600-1: selected acceptable-use, inventory and fallback actions
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Section 2.4 Data Privacy, viewer p.11 (printed p.7); GV-1.3-002, viewer p.18 (printed p.14); GV-1.4-002, viewer p.19 (printed p.15); GV-1.6-003, viewer p.20 (printed p.16); GV-3.2-003, viewer p.22 (printed p.18); GV-6.2-001, viewer p.25 (printed p.21); GV-6.2-003 and GV-6.2-006, viewer p.26 (printed p.22). Read only these identifiers/passages. Practice/feedback status: Guidance and suggested actions, with no scored learner answer key.

Excluded or limited: Voluntary suggested actions; no legal conclusion, universal threshold or full GenAI engineering course. Historical executive-order context and unrelated high-risk capability sections are unassigned. Copying model weights is not assumed possible for a hosted API. Currency: July 2024 publication; exact passages checked 2026-10-29. Reassess alongside future AI RMF/profile revisions.

ISC2 FAQ CC certification next steps
Supplemental primary or first-party professional reference; verification scope only

CC passing/application/firstAMF questions Formal exam/application/fee steps; glossary mapping not credential award.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Formal exam/application/fee steps; glossary mapping not credential award.

Practice Exams
Supplemental primary or first-party professional reference; verification scope only

Opening purpose and Is this the official certification examination? Practice/self-assessment separate from formal examination/certification; cannot prove selected this site’s assessment completeness.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Practice/self-assessment separate from formal examination/certification; cannot prove selected this site’s assessment completeness.

Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud
Supplemental primary or first-party professional reference; verification scope only

Opening paragraphs; AI-Generated Text bullets Believable fraud and corrected spelling; polish/AI wording does not authenticate a request.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Believable fraud and corrected spelling; polish/AI wording does not authenticate a request.

FBI IC3: AI voice/video impersonation and independent contact verification
Bounded primary or first-party teaching/practice reference; exact assigned scope only

AI-Generated Audio, aka Vocal Cloning; AI-Generated Videos; under Tips to protect yourself, the bullet on ending a call and contacting the claimed organization through independently researched contact information. Practice/feedback status: Public-awareness advice; no exercise key or learner marking.

Excluded or limited: Visual imperfections and voice/tone heuristics are unassigned and must not be treated as authentication. US complaint procedures and financial/investment advice are outside scope. Currency: PSA dated 2024-12-03; selected defensive concepts checked 2026-10-29.

What are workload identities?
Supplemental primary or first-party professional reference; verification scope only

Opening definition; machine/nonhuman vs human identities; security context Software service identity and distinct credential mechanisms; not prescribing human prompts to every automation.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Software service identity and distinct credential mechanisms; not prescribing human prompts to every automation.

The process approach in ISO9001:2015, ISO/TC176/SC2/N1289
Supplemental primary or first-party professional reference; verification scope only

PDF p2: PDCA Plan/Do/Check/Act definitions and continual-improvement sentence Only generic process-improvement concepts; not ISO27001 mandatory method or clause map. Public web PDF was read, whole-document assignment excluded.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Only generic process-improvement concepts; not ISO27001 mandatory method or clause map. Public web PDF was read, whole-document assignment excluded. Preserve its historical ISO 9001 context. ISO 9001:2026 is the published edition; these older examples are not current ISO 27001 requirements.

RFC6335 Service Name and Transport Protocol Port Number Registry
Supplemental primary or first-party professional reference; verification scope only

§9 Security Considerations, p23 Assigned ports do not prove service identity or good traffic; no live network claim.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Assigned ports do not prove service identity or good traffic; no live network claim.

RFC768 User Datagram Protocol
Supplemental primary or first-party professional reference; verification scope only

Introduction pp1-2; Fields: Destination Port Stable datagram and non-guaranteed delivery/ordering concepts; no present-day algorithm or configuration advice.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Stable datagram and non-guaranteed delivery/ordering concepts; no present-day algorithm or configuration advice.

RFC8085 UDP Usage Guidelines
Supplemental primary or first-party professional reference; verification scope only

§1 Introduction; §3.3 Reliability Guidelines, p21 Applications requiring reliable/ordered delivery must supply suitable mechanisms; suitability depends on requirements.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Applications requiring reliable/ordered delivery must supply suitable mechanisms; suitability depends on requirements.

Shared responsibility in the cloud
Supplemental primary or first-party professional reference; verification scope only

Introduction; governance-responsibility note; Division of responsibility; Responsibility matrix; Responsibilities you always retain Provider-authored illustrative model; not a legal conclusion or alteration of contracts; no inference that SaaS use transfers model-weight ownership.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Provider-authored illustrative model; not a legal conclusion or alteration of contracts; no inference that SaaS use transfers model-weight ownership.

Microsoft Learn: cloud responsibility matrix and retained customer duties
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Opening IaaS/PaaS/SaaS definitions; governance note; Responsibility matrix; Responsibilities you always retain; Shared responsibilities explained. Practice/feedback status: Reference matrix, not scored learner practice.

Excluded or limited: Specific services may combine models. Do not infer contract terms or that all responsibility moves to a SaaS provider. No deployment, account creation, cloud usage or product evaluation is required. Currency: Live article and matrix checked 2026-10-29. Current matrix labels some application/network/device areas shared; avoid oversimplified old diagrams.

What is single sign-on in Microsoft Entra ID?
Supplemental primary or first-party professional reference; verification scope only

Introduction and How SSO works with Microsoft Entra ID First-party SSO sign-in explanation only; separate account authorization and session revocation require additional evidence.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. First-party SSO sign-in explanation only; separate account authorization and session revocation require additional evidence.

software — CSRC Glossary
Supplemental primary or first-party professional reference; verification scope only

Definitions: computer programs and associated data (SP800-37r2/SP800-53r5); application-code/library examples (SP800-213) Use software program versus physical hardware/user transaction data distinction; software may also include associated data, so no universal exclusion of all data.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Use software program versus physical hardware/user transaction data distinction; software may also include associated data, so no universal exclusion of all data.

Balanced Scorecard Basics
Supplemental primary or first-party professional reference; verification scope only

What Is a Balanced Scorecard?; What Are Performance Measures (KPIs)? Primary author of its own explanatory methodology: objectives/actual-target comparison supports quiz purpose; generic scorecard label is an editorial simplification, not a complete Balanced Scorecard or exclusive taxonomy.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Primary author of its own explanatory methodology: objectives/actual-target comparison supports quiz purpose; generic scorecard label is an editorial simplification, not a complete Balanced Scorecard or exclusive taxonomy.

Post-Quantum Cryptography FAQs
Supplemental primary or first-party professional reference; verification scope only

FAQ: To protect against the threat of quantum computers, should we double the key length for AES now? Only different primitive/attack behavior supports nonuniform risk inference; no imported key-size or algorithm approvals.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Only different primitive/attack behavior supports nonuniform risk inference; no imported key-size or algorithm approvals.

Recommended settings for Wi-Fi routers and access points
Supplemental primary or first-party professional reference; verification scope only

Security; Radio mode Only security-mode versus radio-generation distinction; does not transfer Apple compatibility assurances to arbitrary devices.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Only security-mode versus radio-generation distinction; does not transfer Apple compatibility assurances to arbitrary devices.

threat actor — CSRC Glossary
Supplemental primary or first-party professional reference; verification scope only

Definition sourced to SP800-150: individual or group posing a threat Actor is entity, distinct from tool/action/weakness; no actual attribution or unique motive claim.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Actor is entity, distinct from tool/action/weakness; no actual attribution or unique motive claim.

Best practices and methodological guidelines for conducting gas risk assessments, JRC68735
Supplemental primary or first-party professional reference; verification scope only

§3 Proposed Risk Assessment framework, PDF p17 figure; Annex1 Risk assessment paragraph, PDF p49 Primary-author methodological guidance uses identification-analysis-evaluation convention; only abstract concepts transferred. No gas-sector duties or exact/current ISO requirements imported.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Primary-author methodological guidance uses identification-analysis-evaluation convention; only abstract concepts transferred. No gas-sector duties or exact/current ISO requirements imported.

What are redundancy, replication, and backup?
Supplemental primary or first-party professional reference; verification scope only

Introduction definitions; Redundancy; Physical locations in the cloud; Replication: redundancy for data; Backup Current first-party conceptual source distinguishes additional running components from timestamped recovery copies and shared failure scopes; no Azure-specific configuration prescriptions imported. Opening three definitions; Redundancy; Physical locations in the cloud; Backup; Backup versus replication General reliability concepts and restore testing. Specific Azure service designs, prices and guarantees excluded.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Current first-party conceptual source distinguishes additional running components from timestamped recovery copies and shared failure scopes; no Azure-specific configuration prescriptions imported. General reliability concepts and restore testing. Specific Azure service designs, prices and guarantees excluded.

Architecture strategies for designing for redundancy
Supplemental primary or first-party professional reference; verification scope only

Definitions and following critical-flow paragraphs; Trade-offs: low-latency redundancy and large-scale events Conceptual spare capacity and shared failure risk only; fictional common-power example is inference, not a claim about a reviewed installation.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Conceptual spare capacity and shared failure risk only; fictional common-power example is inference, not a claim about a reviewed installation.

ISO — Standards
Supplemental primary or first-party professional reference; verification scope only

ISO standards are internationally agreed by experts, opening paragraphs Formal-standard meaning only; no standard version, full normative content, certification or legal requirement inferred.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Formal-standard meaning only; no standard version, full normative content, certification or legal requirement inferred.

FIPS199: Security Objectives
Supplemental primary or first-party professional reference; verification scope only

Viewer p.6, printed p.2, §3 Security Objectives, CIA definitions only Stable objective definitions. Historical federal legal references, applicability and categorization instructions are excluded.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Stable objective definitions. Historical federal legal references, applicability and categorization instructions are excluded.

Authentication: published definitions
Supplemental primary or first-party professional reference; verification scope only

Definitions: FIPS200 identity-verification entry Identity claim verification only; not a prescription for resetting accounts.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Identity claim verification only; not a prescription for resetting accounts.

Authorization: access-permission definition
Supplemental primary or first-party professional reference; verification scope only

Definitions: NISTSP800-162-derived permit/deny subject-access entry Use access-permission sense, not authorization-to-operate sense.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Use access-permission sense, not authorization-to-operate sense.

Introduction to AI agents and agent use cases
Supplemental primary or first-party professional reference; verification scope only

Defining AI Agents and Types of AI Agents / What are AI Agents? system, model, actions and tools bullets Original publisher beginner explanation. Selected modern LLM agent example; agents predate LLMs. Not a universal standard or a tool-permission guarantee.

Excluded or limited: Only the named definitions and passages support this site. Whole-document teaching and deployment guidance are excluded. Original publisher beginner explanation. Selected modern LLM agent example; agents predate LLMs. Not a universal standard or a tool-permission guarantee.

ISO/IEC 27000:2026 official overview and edition record
Official standards catalogue; role and edition metadata only

Edition 6 (July 2026): overview, core concepts and relationships across the ISMS family. It is not a requirements standard or a replacement for every prior terminology source.

Excluded or limited: No full normative text is reproduced. Historical vocabulary is not silently relabeled as a 2026 definition.

ISO/IEC 27000:2026 — current ISMS overview and family relationships
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Catalogue sections What is, Why important and FAQ only: ISMS concepts, principles and family relationships. Practice/feedback status: No assessment/key.

Excluded or limited: The sixth edition is not primarily a terminology document and does not supply ISO27001 requirements. CHF0 is not permission to republish the standard. Full download/checkout/account process not tested. Currency: Published July 2026, edition 6; catalogue identifies 2018 as withdrawn; verified 29 October 2026.

Cisco Packet Tracer learning collection
Optional learning or access resource; public description only

Optional introductory Packet Tracer learning for packet flow and network/IoT concepts.

Excluded or limited: Course metadata is not lab execution or a CC mock. No simulator installation or account is required by this site.

Network segmentation and segregation — Overview
Bounded primary or first-party professional reference

Key segmentation terms, communication-flow controls and strategic architecture purpose.

Excluded or limited: Executive guidance is not a packet/port lab or a marked assessment. Australian context does not determine another jurisdiction’s obligations.

Network segmentation and segregation — Anti-patterns
Bounded primary or first-party professional reference

Anti-patterns 1 and 4, followed by the sanitised investigation case; connect diagrams, rules, historical paths and observed traffic.

Excluded or limited: Contextual case only; it does not prescribe one universal architecture or supply an official exam key.

A Guide to Penetration Testing
Bounded primary or first-party professional reference

Viewer p.34: opening scope/approval paragraphs and the valid target-environment, reporting, communication and liability rows. Viewer p.43: finding narratives, evidence, risk and remediation reporting in the left/centre columns.

Excluded or limited: Its table of contents gives some incorrect page references; use viewer pages. On p.34, the row headed “Network or web application firewalls deployed” contains staffing/timing material and is not a valid category; skip it and the garbled follow-up row. Skip p.43 sector-reporting column and p.44 scheme-status claims. Not a marked physical/social test case.

Cyber Assurance of Physical Security Systems: no-test-environment case
Bounded primary or first-party professional reference

Viewer p.17 only: the case illustrates why a separate test environment matters when changes could affect physical-security systems.

Excluded or limited: IT security of physical-security equipment is different from testing a person’s response to tailgating or impersonation. No course key is provided. The remaining controls, password appendix and scheme requirements are not assigned or validated as current.

Tailgating awareness poster
Bounded primary or first-party professional reference

One page: following through a barrier and maintenance/delivery identity examples.

Excluded or limited: Exclude its overly broad opening definition as formal taxonomy. UK pass/reporting rules are contextual. Awareness is not test authorisation or a marked assessment.

What is voice phishing (vishing)?
Bounded primary or first-party professional reference

Impersonation/voice cloning, corporate-extortion example and verification through a trusted callback route.

Excluded or limited: Do not rely on poor grammar or audio artefacts to recognise every AI-enabled attack. Canadian recovery contacts are not applicable local contacts.

AI-enabled cyber incident tabletop exercise plan
Bounded primary or first-party professional reference

Viewer p.1 purpose; pp.2–3 Module 1; p.4 initial investigation; p.5 Day 6 first scenario; p.6 finding events; p.7 Day 21.

Excluded or limited: Desired discussion outcomes are facilitator aims, not verified exam answers. Names/domains/model versions are fictional. Skip Day 33/US-government sharing and duplicate later pages. No technical reproduction is assigned.

CISA JCDC AI Cyber Tabletop Exercise: scenario and facilitator outcomes
Bounded primary or first-party teaching/practice reference; exact assigned scope only

p.1 purpose/objectives; p.3 Day 2 risk prioritization and lifecycle evaluation, plus Day 4 unexpected model update; p.5 Day 6 10:12 AM untrusted-model discussion; p.7 Day 21 post-incident evaluation/continuity; pp.9-10 facilitator refocus questions corresponding to those injects only. Practice/feedback status: Verified: discussion questions and Desired Discussion Outcomes beside injects; pp.9-10 provide facilitator refocus questions. Reading all 10 pages found no scored answer key or individual marking service. Desired outcomes guide a discussion, not a uniquely correct answer.

Excluded or limited: Fictional organizations, models, sites, attack injects and timelines are scenario devices, not current intelligence or real product instructions. Do not load a model or visit scenario download sites. US operational/reporting contacts and TLP roundtable sections are unassigned. It is a discussion exercise, not a keyed CC/PECB exam. Currency: June 2024 exercise artifact checked 2026-10-29. Retained for its named discussion concepts and facilitator structure; no current threat or product claim is imported.

CTEP Facilitator/Evaluator Handbook
Bounded primary or first-party professional reference

Viewer p.6 evaluator questions before the lessons heading; p.7 after-action reporting and improvement planning.

Excluded or limited: Chemical/public-health examples, old Appendix B and US capability requirements are not assigned. This evaluation method does not supply ISO requirements or validate a learner’s answers.

CISA CTEP Facilitator/Evaluator Handbook: evidence, decisions and after-action improvement
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer/printed pp.3–7, Facilitator and Evaluator Guidance: Observing and Evaluating, the decision-note questions, Hot Wash, Analyze Data, Identify Root Causes and Develop Recommendations, and After-Action Report and Improvement Plan. Focus on comparing observed discussion with the pre-existing plan and assigning actions, owners and timescales. Practice/feedback status: Facilitator guidance with decision prompts, not correct/incorrect exam answers. The integrated CC06 model is original editorial application.

Excluded or limited: No full CTEP scenario package or publisher marking key is supplied. Skip the older unrelated public-health example in Appendix B and the full national-capability catalogue. An inference about a cause must be checked; an evaluator should not invent one simply to fill the report. Currency: The linked file is labelled 2020. Used for stable evaluation and improvement concepts, read 29 October 2026; it is not a current legal, sectoral or exam requirement.

Exercise in a Box
Optional learning or access resource; public description only

Official entry point for facilitated incident-response exercises.

Excluded or limited: Check available scenarios and access conditions. A service description does not establish a complete current CC mock or verified answer set.

Best Practices for MITRE ATT&CK Mapping
Bounded primary or first-party professional reference

Viewer pp.6–9: evidence-to-behaviour mapping method; pp.13–14: common analytic errors; p.17: Table 3 draft/improved reporting comparison.

Excluded or limited: Historical technique examples are not a current threat catalogue or a complete defence plan. Check changed technique definitions on the official ATT&CK site when needed. Skip raw-data tooling/ICS specialist material and p.18’s dated implementation recommendations.

CISA/HSSEDI best practices for ATT&CK mapping: evidence before technique labels
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer/printed pp.7–10, Mapping MITRE ATT&CK into Finished Reports, steps 1–6; pp.13–14, Common Mistakes and its two guidance tables. Extract reported behaviours, obtain context, align tactic/technique/sub-technique and compare proposed mappings. Pay particular attention to port 443 not proving HTTP and a VPN report not proving valid-account abuse. Practice/feedback status: Contains worked mapping examples and error explanations; not a CC exam key. The CC08 fictional report and model are original editorial application of the method.

Excluded or limited: Historical v12 counts, older tactic names, unrelated ICS guidance and linked third-party tools are outside scope. Use current MITRE definitions for each technique in the new exercise. No port number, malware label or single technique establishes actor identity or complete prevention. Currency: January 2023 version 2; used for stable analytical method, not the present size or taxonomy of ATT&CK. Selected pages read 29 October 2026.

AI RMF Playbook
Bounded primary or first-party professional reference

Viewer pp.9–10 GOVERN 1.3; p.39 MANAGE 1.2; p.98 MEASURE 1.1; p.100 MEASURE 1.2; p.103 MEASURE 2.1.

Excluded or limited: Not a mandatory checklist. References, specialist research and old legal proposals are not assigned as current. No marked drift/risk-appetite case is supplied.

Guidelines for secure AI system development
Bounded primary or first-party professional reference

Viewer p.12 asset/configuration documentation; p.14 incident procedures; p.15 user guidance/responsibilities; p.16 behaviour/input monitoring and secure updates.

Excluded or limited: Exclude further reading pp.17–20 as a current resource list. A lifecycle explanation does not supply an assessed recovery or change-testing case.

Artificial intelligence shared responsibility model
Bounded primary or first-party professional reference

Division of responsibility and the AI platform/application/usage distinctions; AI usage policy and awareness paragraphs.

Excluded or limited: Illustrative Microsoft deployment context, not a legal contract or a universal responsibility matrix. Skip product-selection recommendations and product-control assurances. No Azure subscription, image download or deployment is needed.

Microsoft Learn: AI platform, application and usage responsibilities
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Opening governance-responsibility note; AI layer overview subsections AI platform, AI application and AI usage, including acceptable-use and synthetic-media awareness paragraphs. Practice/feedback status: Guidance, not keyed practice or proof that provider/customer controls work.

Excluded or limited: Illustrative governance division, not a legal allocation or modification of customer/provider agreements. Product recommendations, purchases, service configuration and agent-specific architecture are unassigned. Currency: Page last updated 2026-08-24; assigned text read 2026-10-29. Check the selected service's actual agreement/control documentation for real decisions.

Microsoft Sentinel anomalies reference
Bounded primary or first-party professional reference

UEBA/ML comparison and the description at the second occurrence of “Detect machine generated network beaconing behavior”, stopping before Attribute.

Excluded or limited: DGA entries discontinued 8 March 2026 are excluded. A SIEM detection example is not a full IDS/firewall lesson; a deviation score is not proof of compromise or a probability.

Microsoft Sentinel: deviation from a baseline is an investigation signal
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Opening explanation of learned activity baselines; the Anomalies table score description immediately before the discontinuation note. Do not read or implement the catalogue of detection rules. Practice/feedback status: Documentation, not a free keyed lab or learner marking service.

Excluded or limited: No deployment lab, alert threshold recommendation or interpretation of a score as probability of attack. Specifically exclude discontinued DGA detections, which the current page says ended 2026-03-08 due to low result quality. Currency: Live article checked 2026-10-29, including the March 2026 discontinuation notice. Product behaviour and rules can change.

Handle false positives in Microsoft Sentinel
Bounded primary or first-party professional reference

Introductory false-positive cause examples only.

Excluded or limited: Operational/code sections are excluded. In particular, the page’s claimed “only both” Boolean example actually excludes either matching attribute and must not be studied or run as correct.

Microsoft Sentinel: legitimate activity can cause false positives
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Opening statement that analytics rules are imperfect; False positive causes and prevention heading and the bullets on normal service-principal activity and intentional security scanning only. Practice/feedback status: Documentation examples; no scored answer key.

Excluded or limited: No portal instructions, automation-rule changes, broad allowlisting or implementation recommendation. Current migration/custom-detection marketing and operational cost claims are unassigned. Currency: Live article checked 2026-10-29. Use only the selected concepts, independent of changing portal workflows.

NIS2 Technical Implementation Guidance
Bounded primary or first-party professional reference

14–17; risk approval pp.22–23; incidents pp.33–34; continuity pp.52–53 and p.55; evaluation pp.108–110; data handling pp.150–151. Exact stops remain in the existing reading addendum.

Excluded or limited: Exclude viewer p.54’s incorrect RPO wording and p.24’s loose capacity/tolerance examples. This advice has a defined EU digital-provider/subsector context; it is not a universal legal checklist or full ISO text.

ISO/IEC 27001:2022/Amd 1:2024 — Climate action changes
Official amendment metadata and access reference; not the full base standard

Official amendment record for ISO/IEC 27001:2022/Amd 1:2024. Climate-context changes concern clauses 4.1 and 4.2.

Excluded or limited: The amendment does not replace the base requirements standard. Confirm exact inclusion in the selected course/exam scope with PECB.

ISO/IEC 27001:2022 — A practical guide for SMEs
Optional learning or access resource; public description only

ISO’s practical SME guide is an optional explanatory companion to clauses 4–10.

Excluded or limited: Publisher metadata does not establish full content quality, complete Annex A teaching or satisfaction of the selected PECB course requirement.

Selected PECB ISO/IEC 27001:2022 Foundation course
Required official course for the selected PECB certificate route; public description only

Official course route: complete the ISO/IEC 27001:2022 Foundation course, take its assessment and apply for the certificate under issuer rules. The public description advertises practical exercises and practice tests.

Excluded or limited: Public descriptions do not verify every private lesson, exercise, key or feedback set. Confirm the package, language, access period, completion rules, feedback, legitimate standards access, voucher validity, taxes and retake terms.

PECB ISO/IEC 27001 Foundation — public course and award information
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Learning objectives, educational approach, certificate requirements and general information only. Compare exact package inclusions before any purchase. Practice/feedback status: Says course includes practical examples/discussions and exam-like practice tests; public page itself gives no test or key.

Excluded or limited: This page does not provide course access, a regional quote, provider feedback, a booking or a credential. Do not transfer older Lead/Auditor routes or generic whitepaper exemption wording to this certificate programme. Currency: Live page checked 29 October 2026; consistent with edition-specific v1.5 handbook.

PECB Foundation eLearning brochure
Optional learning or access resource; public description only

Viewer p.4: platform/materials and conditional exercise-correction keys; p.7: course sections 1–13.

Excluded or limited: A brochure is access and syllabus metadata, not lessons, an exam key or proof of course completion. Marketing language does not establish lifetime access or override the current course requirement.

PECB ISO/IEC 27001 Foundation eLearning training brochure
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer pp.3–4 describe delivery and quizzes; pp.7–8 show the agenda and learning objectives. Inspect this as product information only. Practice/feedback status: Brochure mentions quizzes and course-dependent exercise/correction files behind enrolled access. No public full Foundation keyed assessment is supplied.

Excluded or limited: Do not promise a Foundation correction key merely because the generic brochure says additional files depend on the training course. Do not treat generic 'unlimited access' wording as a verified access period. Confirm actual activities, keys, feedback, standards access and duration with the provider and current handbook. Currency: Brochure explicitly references ISO/IEC 27001:2022; no reliable publication date printed in selected text. Checked 29 October 2026.

CC Certified in Cybersecurity Study Guide, 2nd Edition
Optional learning or access resource; public description only

Publisher-described optional second-edition CC teaching and practice option targeting the 2026 outline and AI guidance. Use the publisher contents list to locate relevant chapters.

Excluded or limited: Full text, assessment alignment, rationales and online entitlement require review. This is commercial publisher material, not an ISC2 official course or a compulsory purchase.

Wiley second-edition table of contents
Optional learning or access resource; public description only

Bibliographic chapter map: network architecture 15–16; physical/social tests 11/23; incidents 19/21; CTI 20; AI 24 plus relevant domain chapters.

Excluded or limited: Chapter locations do not establish teaching depth or answer-key correctness. This contents list is not the book.

Current official CC adaptive online self-paced training
Optional learning or access resource; public description only

Official optional self-paced CC training entry point. Provider descriptions identify coverage for the September 2026 outline and include learning assessments.

Excluded or limited: Check the current option, duration, included questions, feedback and total directly with ISC2. Course completion is distinct from certification. This site does not independently verify the full private question/key set.

ISC2 knowledge checks and CC self-study tools
Optional learning or access resource; public description only

Official entry point to short CC knowledge checks and flashcards.

Excluded or limited: A short quiz or flashcards do not satisfy the need for fresh mixed/full-assessment practice with checked explanations. Recheck current outline alignment and actual contents.

ISO/IEC 27001:2022 structural preview — BSI/ISO publications on ANSI
Primary standards-publication preview; displayed structure only

English BSI preview: viewer p.5 / printed iii confirms clause headings, including 10.1 and 10.2. Its contents page omits 6.3. French ISO preview: viewer p.3 / printed iii explicitly includes 6.3 as well as 10.1 and 10.2. These are structural locators only.

Excluded or limited: This is not the full requirements text, a complete Annex A explanation, or official PECB courseware. Historical national-foreword transition wording is excluded. The preview does not close licensed teaching or assessment gaps.

Implementing network segmentation and segregation: enforced flows and management separation
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Read What is network segmentation and segregation? first two paragraphs; How can network segmentation and segregation be implemented? five themes and the following logical, authentication and application filtering bullets; Example implementations, Segmenting a network to protect key hosts, first six bullets. These passages explain partitioning versus enforced communication rules, least necessary flows, separate management, explicit authorization and several filtering layers. Practice/feedback status: No publisher answer key. Paired with the original CC04 paper walkthrough and explained editorial checks below.

Excluded or limited: The remainder is optional context. No product configuration, exhaustive architecture, fixed deployment schedule or operational validation is supplied. The fictional walkthrough and its port choices are editorial applications, not an ASD reference design. Currency: Publisher page says published 4 September 2012, last reviewed 24 March 2023. Stable architectural concepts only; accessed 29 October 2026. The separately listed 2026 anti-pattern page was not counted because complete direct reading timed out.

NCSC effective cyber exercise creation: test a stated plan and act on lessons
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Read Step 1, Step 3, Step 5 and Steps 7–9. Learn why the plan and objectives precede the exercise, how expected behaviour and metrics are stated, how labelled injects guide discussion, and how observation, participant feedback, business ownership and implementation belong in follow-up. Practice/feedback status: No single correct-answer key; explicit expected actions must be set for the chosen exercise. CC06 supplies a plan before its injects and a reasoned editorial comparison.

Excluded or limited: The paid assured-provider scheme and external service links are not required. This article is not a scenario answer key or independent capability validation. Do not apply its team-exercise instructions as a live test assignment. Currency: Article version 1.0, published 3 February 2020 and reviewed 7 February 2020. Stable exercise design concepts; public page read 29 October 2026.

MITRE CTI Module 1: finding behaviours and choosing supported mapping depth
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer p.8 mapping process; pp.12–15 finding/researching behaviour; pp.29–34 choosing techniques/sub-techniques and using context; pp.43–44 exercise method and comparison with other analysts. The training's home page is now https://attack.mitre.org/resources/learn-more-about-attack/training/cti/ . Practice/feedback status: The module offers worked examples and comparison discussion. Publisher exercises are version-bounded and are not independently validated learner assessments.

Excluded or limited: The full videos and all 65 slides were not reviewed. Current technique counts, old names and historical knowledge checks are not presented as current exam material. Do not run any report's commands or contact any listed infrastructure. Currency: Slides describe November 2020 training and carry a 2024 copyright footer. MITRE's training page explicitly recommends ATT&CK v8 for matching its exercises. Selected method remains useful; verify current definitions separately.

MITRE CTI Module 4: prioritising and tailoring defensive recommendations
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer pp.7–8 defensive recommendation process and prioritisation; pp.25–28 organizational capabilities, constraints and option trade-offs; p.32 recommendation types; pp.35–36 guided exercise instructions and review prompts. Optional publisher worksheet: https://attack.mitre.org/docs/training-cti/Making%20Defensive%20Recommendations%20Guided%20Exercise.rtf . Work on paper with the supplied assumptions. Practice/feedback status: Publisher-guided open-ended exercise and slide discussion; multiple defensible recommendations, no single scored exam key. The new CC08 model makes its assumptions and validation criteria explicit.

Excluded or limited: Older example control choices are not universal recommendations. The guided worksheet depends on earlier Cobalt Kitty material and ATT&CK v8; it is an optional continuation, not the complete beginner case here. No current product effectiveness or purchase recommendation follows. Currency: 2024 footer; training page flags older ATT&CK v8 exercise context. The current knowledge base has revised detection structures; use current technique pages for the new case, not historical detection labels by rote.

MITRE simulated incident ticket 473822 with publisher mapping answers
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Optional after the beginner CC08 case: read the simulated ticket as evidence, do not execute its commands; propose mappings for the recorded commands, then compare with the complete one-page publisher answer sheet. It includes raw-data context and several discovery mappings. Practice/feedback status: Publisher-provided one set of mapping answers was actually read. The sheet supplies labels, not full explanatory rationales, exam alignment or an independent readiness result.

Excluded or limited: Not a current CC mock, not narrative-report practice by itself, and not an official rationale for every mapping. No command execution, malware use, target probing or assumption that the key matches current ATT&CK exactly. Currency: 2019 exercise; MITRE's current training page says use ATT&CK v8 to match training results. The answer repeatedly uses parent T1059 and names from its original context. Current definitions may support different depth or names; preserve the historical label and record the difference.

Current T1566.002 Spearphishing Link: definition, mitigations and detection
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Opening definition, ID/tactic/version metadata, mitigation rows M1021/M1054/M1017, and Detection Strategy DET0107 rows AN0298–AN0301. Use the specific link-delivery behaviour, and identify relevant mail, web and endpoint evidence rather than assuming a generic phishing label proves compromise. Practice/feedback status: Technique definition and candidate defence examples, no exam key. Supports the explained editorial mapping of the fictional mail event.

Excluded or limited: The many historical actor/procedure examples are unassigned. Current detection descriptions are candidate analytics requiring local validation, not a promise every tool detects the behaviour. Currency: Live page checked 29 October 2026; version 2.8, last modified 11 September 2026 as displayed. Snapshot facts can change.

Current T1059.001 PowerShell: execution, legitimate use and contextual detection
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Opening definition and metadata; Mitigations M1042 and M1038; Detection Strategy DET0455 / AN1252. Understand that PowerShell can be legitimate, and that execution context, parent processes and subsequent behaviour affect a detection decision. Practice/feedback status: No publisher question key. Supplies the exact current technique and candidate defensive concepts for CC08's fictional behaviour.

Excluded or limited: Offensive tool links, command execution, historical actor examples and execution policy as a complete security boundary are excluded. Removing PowerShell without checking operational dependencies is not a universal recommendation. Currency: Live page checked 29 October 2026; version 1.6, last modified 18 September 2026 as displayed. Definitions/detection content may change.

Current T1046 Network Service Discovery
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Opening definition, ID, Discovery tactic, no-sub-techniques statement and version metadata. Compare the reported attempt to enumerate remote services with the definition. Record its current title rather than silently copying the training's older Network Service Scanning name. Practice/feedback status: No question key. Definition supports the CC08 editorial mapping and its exclusion of unsupported follow-on activity.

Excluded or limited: Procedure examples, tools and live scanning are unassigned. An isolated network connection is not enough to establish service discovery, and this label does not prove later exploitation. Currency: Live page checked 29 October 2026; version 3.2, last modified 12 May 2026 as displayed. Current title Network Service Discovery differs from the older training's Network Service Scanning.

NIST AI RMF Playbook: risk tolerance and accountable roles
Bounded primary or first-party teaching/practice reference; exact assigned scope only

GOVERN 1.3: About, Suggested Actions and Transparency and Documentation; GOVERN 2.1: About and Suggested Actions; GOVERN 2.3 outcome sentence only. Practice/feedback status: Documentation/reflection questions and suggested actions; no scored learner answer key or individual marking in the selected passages.

Excluded or limited: Not a mandatory checklist, full AI RMF course, legal compliance determination or assessment. Do not assign all linked third-party publications. Historical laws and examples are outside this selection. Currency: Live passages checked 2026-10-29. The site says AI RMF 1.0 is being updated and the Playbook will follow its revision. Recheck subcategory identifiers after an update.

NIST AI RMF Playbook: purpose, alternatives and go/no-go boundaries
Bounded primary or first-party teaching/practice reference; exact assigned scope only

MAP 1.1: About and Suggested Actions; MAP 1.5: About and Suggested Actions, especially maximum acceptable risk and documented trade-offs. Practice/feedback status: Reflection/documentation prompts only; no scored answer key or independent learner feedback.

Excluded or limited: No whole-function assignment or legal advice. The case's organizational appetite and release conditions are fictional, not NIST requirements. Currency: Live text checked 2026-10-29; update-in-progress banner noted.

NIST AI RMF Playbook: production monitoring and drift investigation
Bounded primary or first-party teaching/practice reference; exact assigned scope only

MEASURE 2.4: outcome, About and Suggested Actions. Stop before the resource bibliography. Practice/feedback status: Monitoring and documentation guidance; no keyed calculation or individual marking.

Excluded or limited: No complete statistical drift-detection course, software installation, guarantee of detection or inference that a metric change proves compromise. Currency: Live text checked 2026-10-29; update-in-progress banner noted.

NIST AI RMF Playbook: recovery, bypass and redeployment decisions
Bounded primary or first-party teaching/practice reference; exact assigned scope only

MANAGE 2.3 and 2.4: About and Suggested Actions; MANAGE 4.1 outcome sentence only. Practice/feedback status: Suggested procedures/documentation questions, not scored practice or learner marking.

Excluded or limited: Not a technical restoration procedure, mandatory RTO/RPO or production readiness assurance. Linked tools and older incident-handling documents are unassigned. Currency: Live text checked 2026-10-29; update-in-progress banner noted.

NCSC secure AI design: assess the need, data and control trade-offs
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Model the threats to your system; Design your system for security as well as functionality and performance; first paragraph of Consider security benefits and trade-offs when selecting your AI model. Practice/feedback status: Guidance only; no publisher-scored practice.

Excluded or limited: Do not follow exploit links or treat controls as guarantees. Detailed model engineering and the complete collection are outside this beginner reading. Currency: Version 1.0, published/reviewed 2023-11-27; assigned concepts read 2026-10-29. Provider controls and current products require separate verification.

NCSC secure AI development: assets, versions and a known-good state
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Secure your supply chain; Identify, track and protect your assets; Document your data, models and prompts. Stop before Manage your technical debt. Practice/feedback status: Guidance only; no publisher answer key or learner marking.

Excluded or limited: Not a backup product guide or proof that a backup can restore. No model download, model execution, API use or installation is assigned. Currency: Version 1.0, published/reviewed 2023-11-27; selected concepts read 2026-10-29.

NCSC secure AI deployment: incident plans and release evaluation
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Develop incident management procedures; Release AI responsibly; Make it easy for users to do the right things. Practice/feedback status: Guidance only; no scored assessment or individualized feedback.

Excluded or limited: No production incident-response plan is approved by this exercise. Security evaluation does not by itself establish safety, fairness or legal compliance. Currency: Version 1.0, published/reviewed 2023-11-27; selected concepts read 2026-10-29.

NCSC secure AI operation: monitor behaviour and evaluate changes
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Monitor your system's behaviour; Monitor your system's input; Follow a secure by design approach to updates; Collect and share lessons learned. Practice/feedback status: Guidance only; no keyed practice or learner marking.

Excluded or limited: No instruction to collect unlimited raw prompts or expose sensitive logs. Generic update guidance is not a command to deploy an untested candidate; exact implementation remains organization-specific. Currency: Version 1.0, published/reviewed 2023-11-27; selected concepts read 2026-10-29.

NIST SP 800-94: IDS/IPS, anomaly baselines and false positives
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer p.15, section 2 first two paragraphs (printed 2-1): detection and IDS/IPS distinction; viewer p.17 (printed 2-3), the paragraph beginning Another common attribute on false positives/negatives; viewer pp.18-19, section 2.3.2 anomaly-baseline concept and the monthly-maintenance example only; viewer p.20, section 2.4 Wireless first sentence only. Practice/feedback status: Conceptual reference; no scored exercise key.

Excluded or limited: February 2007 source used only for named stable concepts. Product capabilities, deployment locations, training-period timings, protocols, wireless standards and implementation instructions are unassigned. The 2012 revision draft never became final and was retired; it is not substituted here. Currency: 2007 final; publisher's 2022 planning note about the retired draft checked 2026-10-29. Current technology selection requires current product documentation.

Microsoft Learn: create test cases, criteria and a harm baseline
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Opening baseline paragraph; three-step measurement explanation; Manual and automatic testing heading and its two paragraphs. Practice/feedback status: Teaching text supplies a process, not answers to the new case. Separate three-question publisher assessment is publicly visible, but its returned key/rationales were not verified; it is not counted as independently marked practice.

Excluded or limited: Do not run harmful prompt examples or deploy a model. The surrounding Foundry module is intermediate; its separate lab needs an Azure subscription. A model evaluator is not assumed reliable without checking. Currency: Live redirected current module text checked 2026-10-29. Legacy responsible-generative-ai module URL now redirects to responsible-ai-studio.

Microsoft Learn: prerelease reviews, phased delivery and rollback
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Complete prerelease reviews; Release and operate the solution, including phased release, incident response, rollback, blocking harmful responses, feedback and privacy-respecting telemetry. Practice/feedback status: Teaching guidance; no scored answer key for a learner's release/rollback record.

Excluded or limited: This is instructional guidance, not evidence an actual deployment is approved or recoverable. No surrounding subscription lab, production configuration or paid service is assigned. Currency: Live module unit checked 2026-10-29; product UI and service naming may change.

From Policy to Protection: Strengthen Your Infosec Strategy
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Policy Development, Policy Enforcement and Information Security Policy Maturity sections only: direction, ownership, approval responsibility, communication, operation and review. Practice/feedback status: No assessment or publisher answer key.

Excluded or limited: Does not define the handbook's three-category taxonomy or supply its classification key. The article's [AK1] editing marker and promotional claims are not teaching. Do not treat its prose as normative clause text. Currency: No publication date identified on the article itself; retrieved 29 October 2026. It refers to current Annex A 5.1; the retrieval date is not a publication date.

IAF/ISO Joint Communiqué on the addition of Climate Change — What does it mean for you?
Bounded primary or first-party teaching/practice reference; exact assigned scope only

What should be considered and FAQ paragraphs on relevance to the particular management system and auditor consideration of clauses 4.1/4.2. Practice/feedback status: No assessment/key.

Excluded or limited: Not a separate environmental-management requirement or evidence of PECB examination scope. Confirm amendment treatment with the selected provider. Currency: Explains the communiqué issued 23 February 2024; current page checked 29 October 2026.

IAF/ISO Joint Communiqué on Climate Change considerations in Management Systems Standards
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer p.2, added clauses 4.1/4.2 statements and Intent; p.3 confirms ISO/IEC 27001:2022 among affected standards. Practice/feedback status: No assessment/key.

Excluded or limited: Not full ISO/IEC 27001 or an exam-scope update; do not transfer historical ISO 9001:2015 references in its list into present-edition claims. Currency: Dated 22 February 2024; amendments published 23 February 2024; PDF read 29 October 2026.

Implementation guide ISO/IEC 27001:2022 — English publisher edition
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Selected passages: §3.1–3.2 viewer pp.10–12; §3.3 pp.12–13; §3.4 pp.13–14; §3.5 pp.14–15 role competence only; §3.6 pp.15–20 risk criteria/owners/treatment; §3.7 pp.20–22; §3.8 pp.22–23 narrative; §3.9 p.24 communication example; §3.12 pp.30–33 selected audit narrative; §3.14 pp.36–37 concepts; Appendix 8.1 pp.44–46 selected control references. Practice/feedback status: Publisher practical examples without a Foundation examination key; Atlas exercises below are original editorial models.

Excluded or limited: Opinion-based guidance with no completeness claim. Exclude its erroneous 10.1 corrective-action cross-references on viewer pp.23/37, older 7.4(d/e) and 9.2 letter references, universal CISO-role assertion and fixed three-year audit-cycle claim. Do not treat its documentation lists as an exact normative checklist. Use SGS and licensed current text for edition-sensitive checks. Appendix viewer p46 is misheaded “8 Organisational controls (continued)”; the 8.x rows are technological controls. Use the selected control IDs/names, not that header. Currency: Imprint: English translation team 2024; status September 2026, final after review/revision. This is not the separate third-party machine translation. Retrieved 29 October 2026.

NIS2 Technical Implementation Guidance — selected guidance and evidence examples
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Only selected GUIDANCE and EXAMPLES OF EVIDENCE: §1.1 viewer pp.14–16; §2.1 pp.22–26 (method/plan/owner/evidence); §2.3 pp.29–31; §6.4 pp.86–87; §7 pp.108–110; §8.2 pp.114–115; §11.2 pp.133–134; §13.2/13.3 pp.160–163 as relevant to one fictional control example. Practice/feedback status: Evidence examples, no PECB assessment or official key.

Excluded or limited: Written for particular entities under Commission Implementing Regulation (EU) 2024/2690, not ISO conformity or PECB certification. Do not import its SHALL text, annual/biennial frequencies, threshold examples, regulatory applicability, or compliance-risk acceptance suggestions into ISO requirements. Evidence lists inspire editorial records; they are not supplied ISO templates or exam answers. Currency: June 2025 version 1.0; source landing page dated 26 June 2025; selected pages inspected 29 October 2026.

Comparing ISO/IEC 27001:2022 to ISO/IEC 27001:2013 — What are the changes?
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Viewer p.2 new subclause table and switched 10.1/10.2 table; p.3 6.3/7.4/8.1 rows; p.4 monitoring, review-input change and Annex A distinction; p.5 6.1.3 and external-services rows. Practice/feedback status: No assessment/key.

Excluded or limited: An edition-comparison document, not full requirements; ellipses omit substantial text. Historical comparison references are not present-edition claims. 2024 climate amendment is a separate reading. Currency: ©2022; current direct publisher copy inspected 29 October 2026.

Pearson computer-based examination demonstration
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Public description and launch link for learning computer-based examination navigation. Use to reduce interface unfamiliarity only, then follow ISC2's own current examination rules. Practice/feedback status: No cybersecurity answer key; orientation only.

Excluded or limited: Not cybersecurity teaching, a CC mock, an official CC key or evidence that every generic demo tool appears in CC. Generic back/review controls must not be transferred to CC: ISC2 says finalized CAT answers cannot be reviewed or changed. Currency: Pearson public page opened 29 October 2026. The launch redirected to Pearson's test delivery endpoint, which the web reader could not load; no successful full demo run is claimed.

ISC2 announcement ending new One Million CC enrollments
Bounded primary or first-party teaching/practice reference; exact assigned scope only

Program Conclusion and Certified in Cybersecurity Availability: new program enrollments closed on 20 May 2026. Existing unexpired exam codes may be used to sit by 31 December 2026; existing course access depends on its own expiry. Official course purchase is not required to sit CC. Practice/feedback status: Not a question set.

Excluded or limited: No claim about an individual learner's code or course access. Older free-offer tutorials are excluded as instructions for new applicants. This announcement is access evidence, not teaching or a practice assessment. Currency: Official 22 April 2026 announcement directly read again on 29 October 2026.

MITRE current definitions for comparing the historical ticket
Bounded primary teaching reference; exact assigned scope only

Opening definition and ID/tactic metadata for T1059.003 Windows Command Shell and T1518.001 Security Software Discovery only. Compare with cmd.exe and security-tool discovery evidence in the old ticket, without replacing its historical key. Feedback status: Current definitions support an editorial comparison; they are not a new official ticket key.

Excluded or limited: No command execution, target probing, replacement publisher key or automatic mapping of every firewall query to one technique. Historical and current versions remain distinct. Currency: Current publisher definitions checked 29 October 2026; recheck version metadata when comparing a later ATT&CK release.