What changed after syllabus comparison
Compared on 2026-10-24. The CISSP syllabus and two lead-auditor training brochures supplied by the academy owner were checked against the existing chapters. Twenty-five CISSP chapters gained subtopic explanations, and all eight modules in each of the ISO 27001 and ISO 42001 paths gained auditor-study extensions.
Uploaded provider brochures inform introductory audit extensions; they are not official ISO requirements or evidence of accreditation. CISSP is mapped to the current April 2024 outline, not the April 2027 revision. Detailed clause mapping and assessed lead-auditor competence remain outside this coverage record. The original documents are not hosted or redistributed here. Their module labels are provider numbering, not ISO clause identifiers. A topic link identifies introductory teaching, not a claim of exhaustive coverage.
New audit material explains independence, audit programmes and plans, sampling, evidence quality, test procedures, findings, reporting, certification stages, corrective action and continuing assessment. Existing questions, score-bank versions and progress identifiers are unchanged. Original visual models remain available in the linked chapters.
The CISSP reference contains duplicated or misplaced bullets; the official objective structure takes precedence. One ISO 42001 brochure page repeats a test-plan heading over closure-related bullets; these are taught as audit closure. Provider delivery promises and exam preparation claims are not adopted by the academy.
ISO 27001 Lead Auditor Course
User-supplied training-provider brochure.
| Reference | Topic | Teaching |
|---|---|---|
| 1 | Management-system purpose and compatibility | Open chapter Introductory teaching added; qualification coverage not established |
| 2 | Assets, security properties and threat context | Open chapter Introductory teaching added; qualification coverage not established |
| 3 | Context and service boundaries | Open chapter Introductory teaching added; qualification coverage not established |
| 4 | Leadership and authority | Open chapter Introductory teaching added; qualification coverage not established |
| 5 | Risk objectives and change planning | Open chapter Introductory teaching added; qualification coverage not established |
| 6 | Resources, competence and controlled documents | Open chapter Introductory teaching added; qualification coverage not established |
| 7 | Operational risk and treatment evidence | Open chapter Introductory teaching added; qualification coverage not established |
| 8 | Measurement, audit and management review | Open chapter Introductory teaching added; qualification coverage not established |
| 9 | Nonconformity and improvement | Open chapter Introductory teaching added; qualification coverage not established |
| 10 | Audit mandate, principles and audit types | Open chapter Introductory teaching added; qualification coverage not established |
| 11 | Evidence-backed reports and findings | Open chapter Introductory teaching added; qualification coverage not established |
| 12 | Internal auditor communication and meetings | Open chapter Introductory teaching added; qualification coverage not established |
| 13 | ISMS processes and continual improvement | Open chapter Introductory teaching added; qualification coverage not established |
| 14 | Risk guidance and impact assessment | Open chapter Introductory teaching added; qualification coverage not established |
| 15 | Implementation and audit responsibilities | Open chapter Introductory teaching added; qualification coverage not established |
| 16 | Implementation programme and employee roles | Open chapter Introductory teaching added; qualification coverage not established |
| 17 | Risk analysis and treatment choices | Open chapter Introductory teaching added; qualification coverage not established |
| 18 | Risk assessment records and applicability | Open chapter Introductory teaching added; qualification coverage not established |
| 19 | Lead auditor competence and independence | Open chapter Introductory teaching added; qualification coverage not established |
| 20 | Audit objectives, schedule, team and scope | Open chapter Introductory teaching added; qualification coverage not established |
| 21 | Observation, evidence and follow-up | Open chapter Introductory teaching added; qualification coverage not established |
| 22 | Certification stages and continuing assessment | Open chapter Introductory teaching added; qualification coverage not established |
| 23 | Fraud indicators and evidential limits | Open chapter Introductory teaching added; qualification coverage not established |
| 24 | Remote and onsite audit methods | Open chapter Introductory teaching added; qualification coverage not established |
| 25 | Audit meetings, reporting and authorized testing boundaries | Open chapter Introductory teaching added; qualification coverage not established |
ISO 42001 Lead Auditor Training
User-supplied training-provider brochure.
| Reference | Topic | Teaching |
|---|---|---|
| 1 | AIMS purpose and management-system integration | Open chapter Introductory teaching added; qualification coverage not established |
| 2 | Organizational certification roles | Open chapter Introductory teaching added; qualification coverage not established |
| 3 | AI concepts and responsible lifecycle use | Open chapter Introductory teaching added; qualification coverage not established |
| 4 | Requirements overview and process integration | Open chapter Introductory teaching added; qualification coverage not established |
| 5 | Audit ethics, competence and impartiality | Open chapter Introductory teaching added; qualification coverage not established |
| 6 | Connected technology and evidence dependencies | Open chapter Introductory teaching added; qualification coverage not established |
| 7 | Objective evidence and reproducible tests | Open chapter Introductory teaching added; qualification coverage not established |
| 8 | Risk-based scope and attention | Open chapter Introductory teaching added; qualification coverage not established |
| 9 | Audit initiation, stakeholders and resources | Open chapter Introductory teaching added; qualification coverage not established |
| 10 | Readiness and documented-system review | Open chapter Introductory teaching added; qualification coverage not established |
| 11 | Planning the implementation assessment | Open chapter Introductory teaching added; qualification coverage not established |
| 12 | Implementation and effectiveness evidence | Open chapter Introductory teaching added; qualification coverage not established |
| 13 | Audit communication and disagreement handling | Open chapter Introductory teaching added; qualification coverage not established |
| 14 | Controlled audit procedures and tools | Open chapter Introductory teaching added; qualification coverage not established |
| 15 | Test design and sample limitations | Open chapter Introductory teaching added; qualification coverage not established |
| 16 | Requirements-to-evidence reasoning | Open chapter Introductory teaching added; qualification coverage not established |
| 17 | Supported findings and nonconformity reporting | Open chapter Introductory teaching added; qualification coverage not established |
| 18 | Workpaper protection and quality review | Open chapter Introductory teaching added; qualification coverage not established |
| 19 | Closing conclusions and limitations | Open chapter Introductory teaching added; qualification coverage not established |
| 20 | Corrective-action evaluation | Open chapter Introductory teaching added; qualification coverage not established |
| 21 | Surveillance and continuing assurance | Open chapter Introductory teaching added; qualification coverage not established |
| 22 | Audit programme and competence development | Open chapter Introductory teaching added; qualification coverage not established |
| 23 | Retrieval rehearsal and qualification boundaries | Open chapter Introductory teaching added; qualification coverage not established |
CISSP Syllabus
User-supplied April 2024 syllabus, cross-checked with the official ISC2 outline.
| Reference | Topic | Teaching |
|---|---|---|
| 1.1 | Professional ethics and competent practice | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.2 | Security properties and their relationships | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.3 | Governance, business alignment and assurance | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.4 | Legal, contractual, privacy and intellectual-property context | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.5 | Investigation types and evidence requirements | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.6 | Policies, standards, procedures and guidance | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.7 | Business impact analysis and continuity requirements | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.8 | Personnel security through employment and contracting | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.9 | Risk methods, treatments and uncertainty | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.10 | Threat modeling methods and trust boundaries | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.11 | Supply-chain integrity and acquired components | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 1.12 | Awareness, training, education and effectiveness | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 2.1 | Classify information and assets | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 2.2 | Set asset-handling requirements | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 2.3 | Provision assets with ownership and secure defaults | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 2.4 | Manage collection, use, retention and destruction | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 2.5 | Retain assets and manage end-of-support exposure | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 2.6 | Tailor data protection to state and requirements | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 3.1 | Engineer with explicit trust and failure assumptions | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 3.2 | Confidentiality, integrity and conflict-of-interest models | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 3.3 | Select controls from system requirements | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 3.4 | Memory protection, hardware trust and system capabilities | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 3.5 | Assess weaknesses across architecture types | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 3.6 | Select cryptography and manage a trustworthy PKI | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 3.7 | Understand cryptanalytic and implementation attack assumptions | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 3.8 | Select and design a secure site | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 3.9 | Protect facilities, media, power and the environment | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 3.10 | Manage security across the system lifecycle | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 4.1 | Design network architecture with measurable boundaries | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 4.2 | Protect network infrastructure and endpoints | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 4.3 | Secure remote, collaboration and third-party channels | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 5.1 | Control access to physical and logical assets | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 5.2 | Design identity proofing and authentication | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 5.3 | Federation with external identity services | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 5.4 | Authorization models, decisions and enforcement | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 5.5 | Provision, review, transfer and remove access | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 5.6 | Implement authentication systems without weakening trust | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 6.1 | Design an assessment, test and audit strategy | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 6.2 | Choose and execute security-control tests | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 6.3 | Collect reliable security-process evidence | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 6.4 | Analyze test output and report actionable findings | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 6.5 | Conduct and facilitate scoped security audits | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.1 | Support investigations and evidence handling | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.2 | Operate logging, monitoring and threat analysis | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.3 | Provision and maintain an approved configuration state | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.4 | Apply operational least privilege and accountability | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.5 | Protect operational resources and media | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.6 | Manage incidents from detection to improvement | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.7 | Maintain prevention, detection and controlled deception | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.8 | Prioritize, patch and verify vulnerabilities | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.9 | Govern normal and emergency changes | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.10 | Choose backup, recovery-site and resilience strategies | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.11 | Execute and validate disaster recovery | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.12 | Select and evaluate recovery tests | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.13 | Participate in business continuity planning | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.14 | Operate physical security controls | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 7.15 | Protect personnel in routine and emergency operations | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 8.1 | Integrate security into software lifecycle methods | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 8.2 | Secure repositories, builds, runtimes and testing tools | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 8.3 | Assess whether software security controls work | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 8.4 | Evaluate acquired and managed software | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
| 8.5 | Apply secure coding and API design standards | Open chapter Current objective present; selected subtopics expanded, exhaustive depth not claimed |
Source and review limits
The official ISC2 outline confirms the current CISSP baseline and distinguishes the April 2027 replacement. The ISO auditing-guidance overview provides an additional public reference for audit concepts. Licensed requirements and certification-body procedures must be consulted for conformity work. This comparison was authored and editorially reviewed by AI; independent expert approval remains pending.