CISM deep review — September 29, 2026

The guide now maps 35 current subtopics and 37 supporting tasks, answers 40 original prompts and adds three worked scenarios, eight proposed activities and 47 executed offline checks. The main correction is date-specific: November weights are now confirmed, while complete future task mapping remains pending.

Current and scheduled scope

The complete canonical outline and pages 34–36 of the genuine candidate guide retain the 2022 baseline at 17/20/33/30 percent. Its 35 subtopics distribute 6/6/11/12 across the four domains; 37 supporting tasks span them. Both monitored snapshot hashes remain unchanged.

ISACA's September 10 central announcement confirms November 3 weights of 18/20/33/29 and new enterprise-architecture and information-security-architecture areas, with more strategy/program-development emphasis. Updated materials became available September 1. The guide's previous statement that future weights were unavailable is removed. The announcement does not enumerate every future subtopic/task, and the linked support article still times out; current mapping is not presented as complete November coverage.

The candidate guide distinguishes sitting the exam from earning the designation, scaled scoring from raw percentage, and CISM's maximum two-year waiver from CISA's three-year ceiling. No individual waiver, application or booking decision was made. The January 2027 CPE change is a separate transition. All nine policy pages were read in the same-day CISA review and reused with a matching fresh hash; current/new evidence-retention wording differs and personal-cycle applicability remains unverified.

Management teaching and actual execution

Selected pages of NIST IR 8286 Rev. 1 support risk-register/detail-record relationships, ownership, meaning and enterprise reporting. The guide defines current operating exposure separately from projected target exposure rather than treating an unimplemented response as proven risk reduction.

An original exact-fraction calculation gives a 0.25% joint-outage probability for two independent 5% outages, versus 5% under a completely shared cause. With unchanged marginal probabilities and additive losses, expected combined loss stays US$250,000; dependence changes simultaneous-loss exposure and recovery demands. It does not automatically increase the sum of expected additive losses. The model is illustrative, not an estimate of actual providers.

Another model compares US$200,000 current expected annual loss with US$80,000 projected residual loss plus US$60,000 response cost. Alternative probability assumptions produce US$90,000–310,000 total exposure plus cost. That sensitivity range is not a statistical confidence interval or permission to accept risk. Chosen authority, expiry and changed-assumption rules exercise decision records without claiming to implement a real governance policy.

Population reconciliation reveals a reporter-only 93.75% control result versus 75% across the full 100-asset population. Unmatched IDs and 20 silent assets remain visible. Scope expansion to 120 assets changes coverage to 62.5% without changing the verified controls. A separate supplier example retains stale, missing and wrong-scope evidence as distinct gaps; a current report still does not prove complete security.

Selected NIST SP 800-61 Rev. 3 material connects readiness, authority, shared responsibility, evidence and recovery. An original timeline separates an 18-minute decision wait from four minutes of action execution. Modeled dependencies produce application readiness at minute 59 but business validation at 69, missing a chosen 60-minute business RTO. A 20-minute data gap misses a 15-minute RPO. No restoration occurred and none of these durations were measured.

The exact public workbook executed 47 checks using Python's standard library. The three worked scenarios apply it to a GenAI launch, supplier ransomware and privileged-access program. Eight broader activities remain proposed; no real accounts, models, organizations or suppliers were operated or assessed.

Sources, products and limitations

Twenty-five direct receipts contain 20 HTTP successes, three blocks and two errors. HTTP success is not proof of readable content. Current QAE/manual routes and a recommendation labeled 17th edition rendered only shells in fresh unsigned Chrome. The older course route redirected to a full public description advertising approximately 16 hours, 20 CPE and six-month access, while retaining an old-material warning and showing the 17th-edition recommendation. These conflicting signals do not establish which exact product covers the November exam. The certification landing still lists 1047 QAE items; no updated pool size or paid interior was verified.

The complete LinkedIn/Cybrary public listing and table of contents confirm May 20, 2025, advanced level and 9 hours 22 minutes. O'Reilly and Udemy returned 403, so old durations and lesson contents remain unverified. No purchase, checkout, account, video playback or paid questions were accessed. The free quiz was fetched but its items were not reviewed or submitted. The Ireland course timed out; its old provisional signal is no longer needed to establish the central announcement's confirmed changes.

Genuine PDFs comprise the 43-page candidate guide, nine-page CPE policy, 78-page NIST 8286r1 and 48-page NIST 800-61r3. Only the CPE policy was read in full; exact selected page boundaries, hashes, browser receipts and workbook output are recorded in ADLC_Docs/operations/2026-09-29-cism-deep-review.json. Human review, personal eligibility/maintenance interpretation, exact future task mapping and paid product alignment remain pending. The five reserved GitHub guides and disabled notification pilot remain untouched.