CC Certified in Cybersecurity deep review — September 29, 2026

The guide now distinguishes effective access, validated recovery, usable recovery points, incident evidence and current program terms. Its exact public workbook passed 34 local checks; 48 answered original prompts support eight proposed labs. Independent human review and live identity/network/cloud/security exercises remain pending.

Scope, snapshots and source reconciliation

The entire detailed September 2026 web outline and actual eight-page English PDF were read. PDF pages 3 and 5 were also rendered and visually inspected to confirm the weight table and two-column domain layout. Nineteen numbered objectives are mapped in groups of 5, 4, 2, 3 and 5. The current detailed table/PDF agree, while a stale introductory web list still uses older domain names. The published weights total 99.9% through rounding; no values were silently adjusted.

The monitor changed only the testing-center label from Pearson VUE Testing Center to Pearson Testing Center. The active PDF retains the longer wording. This is not a new scope announcement. The old objective digest e78550c6ab0a65fb1dbff89436b7e7d72dfc575393ffd439c42929acf180aea4 and lifecycle digest 8192abb837b643c15d0f80d01b3d6a288ca980d8214561439989f20ff643b596 were preserved in dated byte-identical archives. Historical review/audit conclusions remain attached to their archived source.

After explicit acceptance, current objective digest is 22b7660fa9b289c32f902cae087070762cc492978e2ce949b092fe363e279adb and lifecycle digest is b0185cf7d68ac6b24dd4fb93c4d6a2355d239155476a89840c509e2837bf7c3e; a subsequent monitor check reported both unchanged. No numbered objective or weight changed. The web page's impossible April 31 appointment date is not copied as booking guidance.

Some ISC2 pages contain substantial public content outside their main HTML element. Initial main-only fetches therefore produced short text. Full-page visible-text extractions from the same downloaded HTML were retained with separate hashes and lengths; these include the additional policy/course/outline sections actually reviewed. Reachability alone was not treated as proof that the content had been read.

Program, policy and learning evidence

The complete main August 6 refresh article explains governance, identity, cloud, operations and AI context. The actual 29-page AI guidance PDF was fetched; the introduction and CC section on printed pages 3–5 were read, not all other certifications. It supports existing domains rather than a new weighted AI domain.

The full main April 22 announcement and current One Million program FAQ confirm that new enrollments closed May 20. Previously issued codes must remain unexpired and be used to schedule and take the exam by December 31; an expired code is not revived. Existing course access also has its own expiration. The checked page lists USD 199 for the standard exam and USD 50 for the CC-only annual maintenance fee. No voucher, checkout, booking or entitlement was inspected.

Selected CAT policy sections establish item counts, pretest items, no answer review, time consumed by breaks and stopping rules; exam length is not pass/fail evidence. Member maintenance sections distinguish 45 Group A CPEs required over three years from 15 suggested annually, and the CC-only annual fee from other membership categories. No personal renewal, appeal or accommodation decision was made. The ethics code's main public text was read without submitting a complaint or contacting anyone.

The adaptive-course main description, five-domain outline, language, completion rules and access options were read. Its course completion certificate and 75% course-assessment requirement are not the CC credential or its exam scoring rule. Generic course wording about experience does not override the explicit no-experience/no-degree requirement in the exam PDF. Access starts at purchase for the listed self-paced options; the old approximately 14-hour estimate was not reverified.

Both O'Reilly and both Udemy catalog URLs returned HTTP 403. Earlier duration/revision/alignment claims now carry explicit unverified labels; no book, video, lesson or practice questions were accessed. A publisher search surfaced a UAT host and an inaccessible production category; that did not establish verified current edition metadata and was not adopted as a current book recommendation.

Technical updates and executed workbook

Selected NIST SP 800-63B-4 password-verifier and phishing-resistance guidance replaces generic password slogans with scoped requirements, including single-factor versus MFA length, compromised-password blocking, rate limiting, manager support and no calendar-only changes. Device activation PINs and universal legal obligations are not conflated with that verifier guidance.

Selected SP 800-207 abstract/tenets connect resource-specific authorization with identity/device policy; company ownership or network location alone does not supply trust. Selected SP 800-88 Revision 2 sections distinguish clear/purge/destroy, cryptographic-erase preconditions and verification from acceptance of adequate sanitization. No media operation was performed. The first post-quantum standards announcement was used for the roles of ML-KEM versus signature algorithms, not as current evidence for its historical future roadmap.

The complete main April 2025 NIST incident-response announcement and the current publication's executive summary establish Revision 3 replacing Revision 2 and aligning recommendations with all six CSF 2.0 Functions. Familiar activity names remain useful, but are not presented as the latest NIST model. The guide makes actual evidence, ongoing improvement and business recovery decisions explicit. These were selective technical readings, not full audits of every NIST document or linked standard.

The exact public Python 3.13.14 workbook ran with the standard library and 34 checks passed. Four in-memory SQLite connections exercise a real backup and restore. Two rows totaling 300 fictional cents are protected, later work and corruption alter the live copy, and a subsequent structurally valid backup fails the trusted business manifest. Restoring the protected snapshot recovers its exact earlier values; later transactions remain absent and the live source stays separate.

The IAM model demonstrates direct access surviving a group change, incompatible duties, audience/scope/expiry and a stale downstream token until explicit revocation. It trusts its token/identity fixtures and is not a real authenticator, token-signature verifier or vendor revocation implementation. The fictional 29-minute recovery meets a 30-minute RTO but the 25-minute loss window misses a 15-minute RPO. Actual SQLite runtime is not represented as those exercise times. Deduplicated synthetic labels give two true alerts, three false alerts and two missed events: precision 2/5 and recall 1/2, not production detector accuracy.

No files, credentials, network calls, encryption, media sanitization, cloud account, malware, security scan or infrastructure changes were used. The workbook does not establish crash durability, concurrency, manifest authenticity, complete forensic custody, immutable backups or recovery of external dependencies. Its code hash, stdout and final values are attached to ADLC_Docs/operations/2026-09-29-cc-deep-review.json.

Twenty-two sources are registered and cited: eighteen reachable and four access-blocked. Eight live labs and three scenarios remain proposed. Unit, repository, catalog, strict-site, generated-site and diff results are attached after completion. The five reserved GitHub guides and disabled notification pilot remain untouched.