CISSP deep review — September 29, 2026¶
The CISSP guide now maps all 62 numbered objectives, adds 64 answered original prompts, three reasoning scenarios and eight proposed infrastructure activities. An actual local risk-register workbook passed 23 checks. Two commercial catalogs remain inaccessible; independent human review and infrastructure execution remain pending.
Scope and credential policy¶
The canonical web outline and complete 15-page April 2024 PDF retain eight weights of 16/10/13/13/13/12/13/10 percent and objective groups of 12/6/10/3/6/5/15/5. Pages 3, 7 and 11 were visually inspected to confirm CAT/weights and multi-column topic placement. Only the monitored Pearson VUE testing-center label shortened to Pearson. Prior September 2 objective/status bytes and historical review evidence were preserved before explicit baseline acceptance; the follow-up monitor reported unchanged. No later revision was announced on the checked outline. Historical future tense in the 2024 refresh FAQ does not announce another upcoming revision.
The May 2026 waiver announcement dates the approved-list change to April 1. Current experience policy and the list were read, including full/part-time and internship conditions. The degree-or-credential waiver is capped at one year; course completion and exam passage do not establish the full credential. Maintenance now distinguishes 90 Group A plus 30 Group A or B within the 120-CPE cycle, suggested annual totals and separate Associate obligations.
Technical and practical changes¶
Selected sections of NIST IR 8286 Rev. 1 support enterprise objectives, appetite/tolerance, analysis, response and register roll-up. The guide uses original numerical assumptions to separate probability from frequency, expected loss from maximum loss, and arithmetic from authorized treatment. It highlights horizon/currency consistency, overlapping scenarios and uncertainty without claiming an empirical risk estimate.
The unchanged public NIST risk-register JSON schema was validated with the already installed jsonschema 4.26.0. Twenty-three actual in-memory checks demonstrate required fields, numeric types and response constraints, then structurally valid but poor estimates, duplicate IDs and trusted-fixture approval decisions. The separate risk-detail schema's required/property mismatch is valid JSON Schema behavior, not a syntax error. No official schema was repaired or silently altered. The workbook performs no network requests, file writes or account operations. It is not an authentication service, durable approval system, validated control or production GRC implementation.
Selected current NIST guidance adds password scope and phishing resistance, zero-trust boundaries, post-quantum algorithm purposes, sanitization verification/validation, incident-response integration and CMVP status distinctions. The full CISSP portion of ISC2's AI guidance, printed pages 9–11, informs an original service scenario across the existing eight domains. Model output and schema conformance do not supply authorization.
Catalog comparison¶
Twenty-nine distinct sources were freshly checked: 27 reachable and two blocked. The operational record preserves the extra original CSF URL-alias receipt separately instead of counting one URL twice. Six actual PDFs were downloaded: the 15-page outline, 29-page AI guidance and NIST documents of 48, 59, 48 and 78 pages. Only the outline was read in full; other reading boundaries are recorded per source.
| Resource | Public observation | Review boundary |
|---|---|---|
| ISC2 adaptive training | English; 60% domain/final completion requirement; 90/180-day purchase-based access. | Earlier fixed 20–40-hour claim not reverified. No paid interiors or completion. |
| Pluralsight | 16 course cards total 1,627 minutes; seven labs total 555; combined 36h22m versus a 37-hour header. | Fourteen certification plus two supplemental courses; dates span 2021–2026. Public alignment claim only. |
| LinkedIn Learning | April 25, 2024; 365 clip timings total 77,220 seconds, exactly 21h27m; 51 quizzes listed. | Header, description, selected contents and all chapter headings/timings inspected. No paid lessons or questions. |
| Inside Cloud and Security | Public creator hub routes to cram, book, practice and flashcards. | No video runtime, revision or question interiors verified. |
| O'Reilly and Udemy | Both returned HTTP 403. | Earlier dates, page count, runtime and alignment remain unverified. |
Verification and remaining work¶
The public workbook's exact code and execution receipt are retained with its hash. Repository unit tests, repository validation, learning-catalog consistency, strict site build, generated-site validation and diff checks are recorded in ADLC_Docs/operations/2026-09-29-cissp-deep-review.json when completed. Proposed activities explicitly require independent infrastructure execution and evidence; none was claimed as executed here. No new packages, accounts, permissions, system services or notifications were changed. The five reserved GitHub guides remain untouched for the later workflow test.