CISA deep review — September 29, 2026

The guide maps 60 subtopics and 43 supporting tasks, answers 40 original prompts and adds three worked scenarios, eight proposed activities and 47 executed Python/SQLite checks. A disposable database backup/restore was executed; organizational audit and human review remain pending.

Scope and lifecycle

The complete live outline remains at 18/18/12/26/26 percent. Subtopics distribute 10/11/8/16/15 across the five domains, followed by 43 cross-domain tasks. Objective and status snapshots are unchanged. The candidate PDF's CISA appendix identifies August 2024 and adds minor wording clarifiers for functions, audit algorithms, asset policies and monitoring logs; the guide covers these while retaining the canonical HTML baseline.

Selected pages of the genuine 43-page candidate guide, version 1.26, confirm 150 questions/four hours, the 200–800 scale and 450 passing threshold. The scaled score is not a raw percentage. Exam eligibility, retake windows and the designation application are distinct; up to three years of waivers does not establish any individual's eligibility. No booking or application occurred.

The complete 2027 announcement and all nine pages of its linked policy were read. The January transition preserves 120 total hours with at least 90 aligned and up to 30 other qualifying development hours. All 120 may align. A confusing table heading is resolved using its preceding explicit rule. The existing maintenance page's evidence-retention wording differs from the new policy; personal cycle applicability remains unverified. No CPE or account state changed.

Technical content and execution

ISACA's February ITAF launch establishes a fifth edition and updated sampling companion. The full package requires checkout/MyISACA and was not consumed. The guide avoids claiming full current-standard conformity from a public description.

Selected NIST SP 800-53A pages distinguish criteria, assessment objects, methods, depth and breadth. Potential catalog methods are neither a mandatory exhaustive checklist nor a substitute for judgment. The 800-53 control catalog and 800-53A assessment publication have separate purposes; their 5.2.0 release notes do not replace the CISA blueprint.

Original exercises show how matching row counts and totals can hide a substituted payment; qualified tenant/user joins prevent duplicated and misattributed events. A missing identity remains a scope gap. Release checks distinguish self-approval, wrong artifact and late approval under a deliberately chosen prior-approval rule. Real control authority and emergency-change requirements still need investigation.

For a fictional population of 100 containing 10 defects, 20 random draws without replacement can miss every defect with approximately 9.51% probability. This uses a known fixture defect count, not an inferred rate or sample-size prescription. Unequal stratum sampling changes a pooled 10% to a weighted 4% point estimate; neither value is a confidence bound.

SQLite actually backed up three payments totaling 600 cents, restored them after a simulated deletion, verified integrity, performed a post-restore update and rejected a duplicate key. Separate modeled dependencies produce minute 50 application readiness and minute 60 business validation. Hypothetical technology and business targets therefore lead to different outcomes. These durations were not measured during the database restore. Selected NIST SP 800-34 BIA/recovery material supports the distinction; its old technology examples and federal specifics are not current universal requirements.

June evidence-authenticity commentary and September agentic-audit procedures inform practical depth. Hashes do not prove truthful provenance; runtime evidence must connect requester, data, actions and policy version. Distribution analysis complements sampling rather than universally replacing it. Blog legal/ISO claims were not independently verified or adopted, and no AI system was tested.

Resource and reading boundaries

Twenty-three direct receipts contain 20 HTTP successes, two blocks and one missing historical URL. HTTP success at both current ISACA store listings initially returned only shells. A fresh unsigned Chrome context rendered their full public descriptions without account, cart or checkout action. The current QAE listing confirms 1070 items, three timed practices and six-month access; no paid items were read. The old URL's failed receipt is preserved.

Public training metadata identifies the official 40-plus-module course with one-year access, Pluralsight's 11 courses totaling 19 hours 32 minutes beneath a 20-hour headline, and LinkedIn/Cybrary's June 2026 seven-hour-ten-minute course. O'Reilly and Udemy prior durations were not reverified. No paid lessons or videos were consumed. A bounded free-quiz preview exposed the first item/explanation and start of a second; no full quiz, submission, score or copied item wording appears in the guide.

Four genuine PDFs were captured with hashes: 43-page candidate guide, nine-page CPE policy, 733-page 800-53A and 149-page 800-34. Capturing is not full reading. Exact pages read and two visual table inspections are recorded in the operation at ADLC_Docs/operations/2026-09-29-cisa-deep-review.json, alongside original records, mapping, exact workbook/output and repository gates. ITAF interiors, personal eligibility, broader exercises and human review remain pending. The five reserved GitHub guides and disabled notification pilot remain untouched.