Course syllabuses and teaching coverage

CC: edition and depth

Current: effective 1 September 2026

The five current domains guide these additions. Selected objective references locate applied evidence; they do not establish complete coverage of every subtopic.

Official outline · Official supporting source

Supporting domain cases

• Choose controls for the actual security property

  Selected reference groups: 1.1, 1.2, 1.3, 1.4, 1.5. Two supporting scenario questions; one worked evidence case.

• Measure resilience and report usable evidence

  Selected reference groups: 2.1, 2.2, 2.3, 2.4. Two supporting scenario questions; one worked evidence case.

• Control the whole identity lifecycle

  Selected reference groups: 3.1, 3.2. Two supporting scenario questions; one worked evidence case.

• Follow a connection across trust boundaries

  Selected reference groups: 4.1, 4.2, 4.3. Two supporting scenario questions; one worked evidence case.

• Triage evidence and protect recovery options

  Selected reference groups: 5.1, 5.2, 5.3, 5.4, 5.5. Two supporting scenario questions; one worked evidence case.

Further study and verification

• More detailed networking, physical access, cryptographic migration and security-testing study is still needed.
• Hands-on skills, independent content review and exam-equivalent difficulty are not established.

CEH: edition and depth

Knowledge-exam reference: EC-Council blueprint v5.0; course marketing versions and practical exams are separate

Nine blueprint domain groups are connected to six academy topic lessons. This is a conceptual assessment course, not a substitute for the full training modules, authorized lab practice or the separate practical examination.

Official outline

Supporting domain cases

• Turn permission into a testable rules-of-engagement plan

  Selected reference groups: CEH-v5-D1. Two supporting scenario questions; one worked evidence case.

• Validate exposure without inflating confidence

  Selected reference groups: CEH-v5-D2, CEH-v5-D3. Two supporting scenario questions; one worked evidence case.

• Assess host compromise with evidence and containment boundaries

  Selected reference groups: CEH-v5-D3. Two supporting scenario questions; one worked evidence case.

• Evaluate network and human controls without harming production

  Selected reference groups: CEH-v5-D4, CEH-v5-D6. Two supporting scenario questions; one worked evidence case.

• Distinguish authorization, injection and session failures

  Selected reference groups: CEH-v5-D5. Two supporting scenario questions; one worked evidence case.

• Review identity, device safety and cryptographic trust together

  Selected reference groups: CEH-v5-D7, CEH-v5-D8, CEH-v5-D9. Two supporting scenario questions; one worked evidence case.

Further study and verification

• Detailed tool use, protocol enumeration, exploitation proficiency, evasion and controlled malware analysis require separate authorized labs.
• Coverage of a domain group does not imply every technique in that group has been taught or tested.

CISM: edition and depth

Transition: current public detailed baseline remains the earlier outline; revised exam starts 3 November 2026

The accessible candidate guide still labels its CISM appendix effective 2022. References prefixed earlier use that baseline; strategy and architecture emphasis is linked to the official 2026 announcement. Exact revised topic/task mapping is still unverified.

Official outline · Official supporting source · Official revision announcement

Supporting domain cases

• Defend a security roadmap through business outcomes

  Selected reference groups: earlier-1B1, earlier-1B2, 2026-strategy-emphasis. Two supporting scenario questions; one worked evidence case.

• Keep risk authority separate from control operation

  Selected reference groups: earlier-1A3, earlier-1B3. Two supporting scenario questions; one worked evidence case.

• Translate obligations into behavior and evidence

  Selected reference groups: earlier-1A1, earlier-1A2. Two supporting scenario questions; one worked evidence case.

• Oversee architecture through business dependencies

  Selected reference groups: 2026-architecture-emphasis, earlier-1B1. Two supporting scenario questions; one worked evidence case.

• Use estimates without disguising uncertainty

  Selected reference groups: earlier-2A1, earlier-2A2, earlier-2A3. Two supporting scenario questions; one worked evidence case.

• Distinguish transfer, mitigation and residual acceptance

  Selected reference groups: earlier-2B1, earlier-2B2. Two supporting scenario questions; one worked evidence case.

• Make risk reporting trigger a decision

  Selected reference groups: earlier-2B3. Two supporting scenario questions; one worked evidence case.

• Build operating capacity and data ownership

  Selected reference groups: earlier-3A1, earlier-3A2, earlier-3A3. Two supporting scenario questions; one worked evidence case.

• Assess a control across supplier boundaries

  Selected reference groups: earlier-3A4, earlier-3A5, earlier-3B2, earlier-3B3, earlier-3B4. Two supporting scenario questions; one worked evidence case.

• Use sampling and findings to improve capability

  Selected reference groups: earlier-3B1, earlier-3B5, earlier-3B6. Two supporting scenario questions; one worked evidence case.

• Align response authority with recoverable business services

  Selected reference groups: earlier-4A1, earlier-4A2, earlier-4A3, earlier-4A4, earlier-4A5, earlier-4A6. Two supporting scenario questions; one worked evidence case.

• Contain with an explicit evidence and business tradeoff

  Selected reference groups: earlier-4B1, earlier-4B2, earlier-4B3, earlier-4B4, earlier-4B5. Two supporting scenario questions; one worked evidence case.

• Turn lessons into tested improvements

  Selected reference groups: earlier-4B6, earlier-4A4. Two supporting scenario questions; one worked evidence case.

Further study and verification

• The exact revised detailed topic and supporting-task map must be verified against the authoritative revised outline when accessible.
• Scenario difficulty and decision quality have not been calibrated against official exam items or independent learner results.

CISSP: edition and depth

Current: 15 April 2024 outline; announced replacement effective 15 April 2027

Selected references use the current outline. The announced 2027 edition is not silently substituted for the current exam. AI and supply-chain examples are professional context, not a claim of completed 2027 mapping.

Official outline

Supporting domain cases

• Model a threat and make the treatment decision traceable

  Selected reference groups: 1.9, 1.10, 1.11. Two supporting scenario questions; one worked evidence case.

• Protect data beyond its primary database

  Selected reference groups: 2.1, 2.2, 2.3, 2.4, 2.5, 2.6. Two supporting scenario questions; one worked evidence case.

• Design for failure, mediation and trustworthy cryptography

  Selected reference groups: 3.1, 3.3, 3.5, 3.6, 3.7. Two supporting scenario questions; one worked evidence case.

• Control communication across layers and shared dependencies

  Selected reference groups: 4.1, 4.2, 4.3. Two supporting scenario questions; one worked evidence case.

• Evaluate federation and privilege as effective access

  Selected reference groups: 5.1, 5.2, 5.3, 5.4, 5.5, 5.6. Two supporting scenario questions; one worked evidence case.

• Choose assurance methods that answer the question

  Selected reference groups: 6.1, 6.2, 6.3, 6.4, 6.5. Two supporting scenario questions; one worked evidence case.

• Recover service while preserving accountable evidence

  Selected reference groups: 7.1, 7.3, 7.6, 7.7, 7.10, 7.11, 7.12. Two supporting scenario questions; one worked evidence case.

• Build verifiable security gates into delivery

  Selected reference groups: 8.1, 8.2, 8.3, 8.4, 8.5. Two supporting scenario questions; one worked evidence case.

Further study and verification

• Formal security models, cryptographic mechanisms, physical engineering, protocol detail and specialist operations need further study and practical experience.
• The 2027 outline needs its own objective-level mapping before claiming alignment to that edition.

ISO/IEC 27001: edition and depth

ISO/IEC 27001:2022 with Amd 1:2024 context

Eight independent foundation modules with 16 original questions, visual explanations and fictional scenarios. Module references are academy numbering, not ISO clause identifiers. This is introductory study, not a licensed clause-by-clause course, an official exam simulator or an accredited qualification. Includes introductory audit planning, evidence, reporting and follow-up extensions informed by an uploaded provider syllabus; this does not confer lead-auditor competence or accreditation.

Official standard overview

Foundation examples

Each foundation chapter includes an original fictional scenario, a worked explanation and academy-numbered visual anchors. These are not reproduced standard clauses.

Further study and verification

• The full licensed standard and its exact requirements must be consulted for implementation or conformity assessment.
• Independent subject-matter review and comprehensive clause/control and provider-exam mapping remain pending.
• Provider-specific foundation, implementer and auditor examination schemes are not mapped; no certificate or professional eligibility is conferred.

ISO/IEC 27090: edition and depth

ISO/IEC 27090:2026 · Published AI-security guidance

Eight independent foundation modules with 16 original questions, visual explanations and fictional scenarios. Module references are academy numbering, not ISO clause identifiers. This is introductory study, not a licensed clause-by-clause course, an official exam simulator or an accredited qualification.

Official standard overview

Foundation examples

Each foundation chapter includes an original fictional scenario, a worked explanation and academy-numbered visual anchors. These are not reproduced standard clauses.

Further study and verification

• The full licensed standard and its exact requirements must be consulted for implementation or conformity assessment.
• Independent subject-matter review and comprehensive clause/control mapping remain pending.
• Provider-specific foundation, implementer and auditor examination schemes are not mapped; no certificate or professional eligibility is conferred.

ISO/IEC 42001: edition and depth

ISO/IEC 42001:2023

Eight independent foundation modules with 16 original questions, visual explanations and fictional scenarios. Module references are academy numbering, not ISO clause identifiers. This is introductory study, not a licensed clause-by-clause course, an official exam simulator or an accredited qualification. Includes introductory audit planning, evidence, reporting and follow-up extensions informed by an uploaded provider syllabus; this does not confer lead-auditor competence or accreditation.

Official standard overview

Foundation examples

Each foundation chapter includes an original fictional scenario, a worked explanation and academy-numbered visual anchors. These are not reproduced standard clauses.

Further study and verification

• The full licensed standard and its exact requirements must be consulted for implementation or conformity assessment.
• Independent subject-matter review and comprehensive clause/control and provider-exam mapping remain pending.
• Provider-specific foundation, implementer and auditor examination schemes are not mapped; no certificate or professional eligibility is conferred.