topic Re: The Candidate Information Bulletin (CIB), where can I find it? in Exam Preparation

The Candidate Information Bulletin (CIB), where can I find it?

clementdupuis — Fri, 12 Oct 2018 12:08:46 GMT

Good day,

I was trying to find the latest Candidate Information Bulleting (CIB) document for the latest CBK.

Where can I find this document? Is it still available from ISC2?

I could not find it on the ISC2 website.

Best regards

Clement

Re: The Candidate Information Bulletin (CIB), where can I find it?

amandavanceISC2 — Fri, 12 Oct 2018 14:56:58 GMT

@clementdupuis Which CIB are you looking for? We are now referring to the CIB's as Exam Outlines. I can send you the link to download the one you are looking for, just need to know which certification.

Best Regards,

Amanda Vance

Re: The Candidate Information Bulletin (CIB), where can I find it?

clementdupuis — Fri, 12 Oct 2018 15:48:00 GMT

Good day, Amanda,

There used to be the exam outline and a document with hundreds of
references in it. The whole list of references used for the exam. This is
what I was looking for.

It is for the CISSP.

Best regards

Clement

*---------------------------------------------------------------------------------------------*

*Clement Dupuis, CD*CCCure Owner and Founder
Chief Learning Officer (CLO) and Security Evangelist
Owner and Founder of the CCCure Family of Portals
GCFW, GCIA, Security+ 301, CEH V7, CCSA, CCSE, + 12 others

*For support or queries send an email to: Support@CCCure.Com*

----------------------------------------------------------------------------------------------
Maintainer of :

The CCCure Learning Portal - Find the best Security Tutorials

The **NEW** CCCure Quiz Engine

Knowledge sharing and giving back to the community

*DO YOU WANT VIDEO RECORDING FROM WITHIN YOUR CHROME BROWSER?*

Use LOOM a great video recording tool that is easy to use and integrated
within Chrome:

Get your own copy of LOOM, click HERE now.

Re: The Candidate Information Bulletin (CIB), where can I find it?

amandavanceISC2 — Fri, 12 Oct 2018 15:52:24 GMT

Hello Clement,

Here is a link to download the CISSP Exam Outline, and also the CISSP Ultimate Guide, which is a newer document created and may have extra info you are looking for.

Let me know if you have any questions.

Best,

Amanda

avance@isc2.org

Re: The Candidate Information Bulletin (CIB), where can I find it?

rslade — Fri, 12 Oct 2018 18:48:00 GMT

> amandavanceISC2 (Moderator) posted a new reply in Certifications on 10-12-2018 11:52 AM in the (ISC)Â² Community :

> Hello Clement, Here is a link to download the CISSP Exam Outline, and also
> the CISSP Ultimate Guide, which is a newer document created and may have
> extra info you are looking for.

No, Amanda. Clement is referring to the list of reference books that the exam
committee uses to verify questions for the exam. (It used to be that all questions
had to be supported by at least two references in the source literature.) In a sense,
it was the "approved" list of source literature.

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
And there's always the time-honored tradition of pulling a gun
and shouting `Give me all your pancakes.' - Bruce Schneier
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: The Candidate Information Bulletin (CIB), where can I find it?

amandavanceISC2 — Fri, 12 Oct 2018 18:50:41 GMT

Hello Robert,

I understand, unfortunately, we no longer have the CIB and instead provide the Exam Outlines and Ultimate Guides instead.

Best Regards,

Amanda Vane

Re: The Candidate Information Bulletin (CIB), where can I find it?

CraginS — Fri, 12 Oct 2018 19:23:50 GMT

@amandavanceISC2 wrote:

I understand, unfortunately, we no longer have the CIB and instead provide the Exam Outlines and Ultimate Guides instead.

Amanda, does this mean there is no longer a definitive set of references the exam committees use to verify every question. If so, I think there is a major problem in the exam process. If the list still exists and is current, then I think we all need access to it.

I bring this up because of a bothersome answer on another thread saying that both versions 4 and 5 of COBIT are used for the CISSP-ISSEP exam prep. Every question on any of the exams should be verified ONLY against the current available versions of each document, and never with superseded versions or cancelled documents.

Clement @clementdupuis and Grandpa Rob @rslade both are quite experienced in using these references and they are right to ask for the list.

Best regards,

Re: The Candidate Information Bulletin (CIB), where can I find it?

dcontesti — Fri, 12 Oct 2018 19:43:33 GMT

Can you also forward the link to me? I was trying to point someone to it, but cannot find it.

With thanks

Diana

Re: The Candidate Information Bulletin (CIB), where can I find it?

AlecTrevelyan — Fri, 12 Oct 2018 19:47:40 GMT

The link to the list of references for all exams is contained in each exam outline document:

https://www.isc2.org/Certifications/References

Re: The Candidate Information Bulletin (CIB), where can I find it?

clementdupuis — Fri, 12 Oct 2018 20:33:24 GMT

Good day my friend,

It seems they created a new list at: https://www.isc2.org/certifications/References

I will let you look at the list and at the date of publication as well.

The list used to be more than 200 references. It has shrunk drastically and now has less than sixty books on the list.

To your query, it seems the same problem exist with the CISSP as it does for the concentration. For example:

Official (ISC)2 Guide to the CISSP CBK / Edition 2
by Steven Hernandez, CISSP Publisher: Auerbach Publications; 2 edition (December 22, 2009) ISBN-13: 9781439809594

Official (ISC)2 Guide to the CISSP CBK, Fourth Edition ((ISC)2 Press) 4th Edition
by Adam Gordon (Editor) Publisher: Auerbach Publications; 4 edition (March 11, 2015) ISBN-13: 978-1482262759

The old and the new editions are listed as a reference. Is there something in the old book that is not in the new book? If it is not in the new book was the topic removed or the topic still on the exam but not on the exam outline?

Looking at the references list, one has to wonder. There is one dated 1999. There are many that are older than 10 years.

For example, there is the Applied Cryptography: Protocols, Algorithms, and Source Code in C book from Bruce Schneier dated November 1st, 1995. There are a few revisions of that book that exists, the latest version is from (March 30, 2015).

Best regards

Clement

Re: CraginS mentioned you in (ISC)Â² Community

rslade — Sat, 13 Oct 2018 01:33:00 GMT

> CraginS (Contributor III) mentioned you in a post! Join the conversation below:

> Clement @clementdupuis and Grandpa Rob @rslade both are quite
> experienced in using these references

Hey, I used to have two books *in* the CIB ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Nothing in this world can take the place of persistence. Talent
will not; nothing is more common than unsuccessful people with
talent. Genius will not; unrewarded genius is almost a proverb.
Education will not; the world is full of educated derelicts.
Persistence and determination alone are omnipotent. The slogan
`press on' has solved and always will solve the problems of the
human race. - Calvin Coolidge
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: The Candidate Information Bulletin (CIB), where can I find it?

rslade — Sat, 13 Oct 2018 07:29:00 GMT

> dcontesti (Newcomer III) posted a new reply in Certifications on 10-12-2018

> Can
> you also forward the link to me? I was trying to point someone to it, but
> cannot find it.

Amanda was telling us it is no more. It is an ex-document. It has joined the
archive invisible. All statements to the effect that this text is still a going
concern are, from now on, inoperative ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
I'm getting so absent-minded that sometimes in the middle of
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: CraginS mentioned you in (ISC)Â² Community

clementdupuis — Sat, 13 Oct 2018 11:54:01 GMT

Good morning, Rob,

None of the two are left in the latest list of references at https://www.isc2.org/certifications/References

Best regards my friend

Clement

Re: CIB

rslade — Sat, 13 Oct 2018 18:10:00 GMT

> clementdupuis (Newcomer II) posted a new reply in Certifications on 10-13-2018 07:54 AM in the (ISC)Â² Community :

> Good morning, Rob, None of the two are left in the latest list of references

(in best "South Park" voice): Those bastards! They've killed "Viruses Revealed"!

(Actually, by this point I wondered if someone would have included the dictionary,
which I would have considered much more important.)

Oh, that's pathetic. I mean, they seemingly haven't even noticed that Pfleeger's
in there twice. (I mean, he was good, but ...) And having the "Official Guides" in
there? Study guides were (specifically) *never* considered "source" literature. (At
least I'm still incuded in several editions of ISMH.) But, Bidgoli? I mean, that's
just sloppy. (Even though I've got an article in there, too.) I'm glad they've got
Toigo for BC/DR (although the 3rd edition was possibly the worst). They've got
some good stuff in there, but why "Agile Development in the Real World"?

Here, lemme make some suggestions:
http://victoria.tc.ca/int-grps/books/techrev/mnbksccd.htm

======================
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
"If you do buy a computer, don't turn it on." - Richards' 2nd Law
"Robert Slade's Guide to Computer Viruses" 0-387-94663-2
"Viruses Revealed" 0-07-213090-3
"Software Forensics" 0-07-142804-6
"Dictionary of Information Security" Syngress 1-59749-115-2
============= for back issues:
[Base URL] site http://victoria.tc.ca/techrev/
CISSP refs: [Base URL]mnbksccd.htm
PC Security: [Base URL]mnvrrvsc.htm
Security Dict.: [Base URL]secgloss.htm
Security Educ.: [Base URL]comseced.htm
Book reviews: [Base URL]mnbk.htm
[Base URL]review.htm
Partial/recent: http://groups.yahoo.com/group/techbooks/
http://en.wikipedia.org/wiki/Robert_Slade
http://www.infosecbc.org/links http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/

Re: The Candidate Information Bulletin (CIB), where can I find it?

denbesten — Sun, 14 Oct 2018 17:39:24 GMT

@CraginS wrote:
Every question on any of the exams should be verified ONLY against the current available versions of each document, and never with superseded versions or cancelled documents.

Are you proposing that questions must reference current sources at the time the question is written, or are you proposing that each time a source is updated, testing should be suspended until the impacted questions have been re-referenced?

(ISC)²'s regular psychometric analysis already addresses the problem of outdated questions. If the state of the art changes such that an "incorrect" answer is regularly chosen by passers, the question will be identified as "non-predictive" and discontinued. Unless there is a sudden and giant shift, a few "questionable" questions should not be a big deal, given the generous 70% threshold for passing.

Mostly the exam is about relevant experience, strong foundational knowledge and "management perspective". None of these expire when sources are refreshed. The important part of question design is that it be referenced against multiple sources with different authors to avoid author bias. As long as a given source has not been recalled or discredited, I see no compelling reason to arbitrarily banish questions that reference it.

Re: The Candidate Information Bulletin (CIB), where can I find it?

CraginS — Sun, 14 Oct 2018 17:59:33 GMT

@denbesten wrote:
@CraginS wrote:
Every question on any of the exams should be verified ONLY against the current available versions of each document, and never with superseded versions or cancelled documents.
Are you proposing that questions must reference current sources at the time the question is written, or are you proposing that each time a source is updated, testing should be suspended until the impacted questions have been re-referenced?

(ISC)²'s regular psychometric analysis already addresses the problem of outdated questions. If the state of the art changes such that an "incorrect" answer is regularly chosen by passers, the question will be identified as "non-predictive" and discontinued. Unless there is a sudden and giant shift, a few "questionable" questions should not be a big deal, given the generous 70% threshold for passing.

Mostly the exam is about relevant experience, strong foundational knowledge and "management perspective". None of these expire when sources are refreshed. The important part of question design is that it be referenced against multiple sources with different authors to avoid author bias. As long as a given source has not been recalled or discredited, I see no compelling reason to arbitrarily banish questions that reference it.

@denbesten wrote:
@CraginS wrote:
Every question on any of the exams should be verified ONLY against the current available versions of each document, and never with superseded versions or cancelled documents.
Are you proposing that questions must reference current sources at the time the question is written ...?

Yes, of course. Before a question is added to the pool it should be vetted by a current and currently available reference source. If new questions are added to the pool between major revisions, each new question should be vetted against the list of references made available to candidates as they plan their studies. Each question in the pool should always track to the current and currently available sources in the list provided to the candidates.

"... or are you proposing that each time a source is updated, testing should be suspended until the impacted questions have been re-referenced?"

That would be an unnecessary burden on the overall test development program, and also on candidates trying to study. However, if a major change in a primary source is results in a question that is supported by the old source but not the new version, I suggest removing that question from the pool until the next major revision of the CBK and the exam. At that time the new source reference list and al questions in the pool can be keep in alignment. In truth, most questions based on any one source will continue to be supported by the next. However, major changes in a given source may affect some questions. Recent examples include changes in NIST SP 800-30 and -37 with the implementation of the Risk Management Framework, as well as some of the changes in moving form COBIT 4 to COBIT 5. AS I have said previously, each question should be vetted only against the current, and currently available and reference-listed sources. The fact that the CISSP-ISSEP list includes both COBIT 4 and COBIT 5 is ridiculous. It is good they finally remover IATF Chapter 3 from the list, since it has been unavailable for ten years.

I consider Clement @clementdupuis our resident expert on this test development and documentation process and again ask for his comments.