CCSP deep review — September 29, 2026

The CCSP guide now maps all 38 numbered objectives, provides 48 original answered prompts and includes 24 executed local encryption/policy checks. This is a same-context AI review; independent human review remains pending.

The August 1, 2026 outline remains active. The monitored change only removes “VUE” from the testing-center label. Prior objective/status bytes and the September 2 historical review were preserved before explicit acceptance; the follow-up monitor reports no further change. The actual 15-page outline PDF was read, with pages 3, 6 and 14 visually inspected for CAT/weights and column layout. It retains Pearson VUE and has minor wording differences from the canonical web outline. An impossible April 31 date in the web booking notice was not copied as a valid appointment date. AI/ML objectives 1.6 and 2.9 remain explicit in the map.

The actual 29-page September 2026 AI guidance was fetched; the introduction and complete CCSP section on printed pages 12–14 were read. Current primary sources were checked for key ownership, encryption context, rotation, authenticated encryption, selected NIST response/Zero Trust/sanitization guidance, CSA framework transition and cryptographic-module validation. This was not a complete audit of all referenced standards, regulations, CCM controls or provider implementations.

The guide preserves the outline's FIPS 140-2 example while explaining the NIST active-list transition from September 22, 2026. Historical and revoked status are distinct; module/version/environment evidence is required instead of a whole-product or whole-tenant assurance claim. No local cryptographic implementation is represented as FIPS validated. CSA's overview still says 197 controls under a v4.1 banner; its versioned release specifies 207 across 17 domains. The transition article describes later submission and withdrawal dates, not a completed withdrawal today. The artifact is dated January 27 while the blog describes a January 28 release; this review does not infer an additional release from that one-day metadata difference.

The original workbook was executed with Python 3.13.14 and cryptography 50.0.1. All 24 checks passed. It performs real AES-GCM encryption, wrapping/decryption and rejection of changed context, nonces, keys or ciphertext. Rewrapping preserves the data ciphertext; retained old keys can still decrypt old copies. Wrapper authorization and an independent trusted version fixture distinguish access revocation and rollback rejection from cryptographic validity. The fixture intentionally retains synthetic DEKs to demonstrate why a copied DEK is not recalled by policy revocation or rotation.

All operations are in memory. There are no file or network operations, cloud/API calls, system trust changes, real credentials, installations or production key operations. The example is not a cloud KMS wire format, identity service, persistent storage protocol or production security boundary. It does not zeroize Python memory, establish secure deletion, enforce hardware custody, coordinate nonces/versions across processes, or test concurrency/crash recovery. Eight infrastructure activities and three reasoning scenarios remain proposed.

There are 26 source receipts: 24 healthy and two commercial HTTP 403 blocks. Public LinkedIn metadata lists 94 clips totaling 10h02m39s against a 10h02m header and a July 3, 2025 date. Pluralsight has five 2025 cards totaling 4h54m against a 5h header; it is a generic cloud-security supplement. Earlier O'Reilly/Udemy durations and revisions remain unverified. The official adaptive course uses a 75% completion threshold, English content and purchase-based 90/180-day access; the earlier 20–40h “official range” was not reverified. Paid interiors, practice questions, enrollment, checkout and course quality were not assessed.

Experience alternatives, course completion, CAT scoring and maintenance categories are separated. The five reserved GitHub guides and disabled notification pilot remain unchanged. No external messages or service/authentication/logging configuration changes were made. The source receipts, objective mapping, actual execution output and final validation gates are recorded in ADLC_Docs/operations/2026-09-29-ccsp-deep-review.json.