topic Re: The (ISC)² Common Body of Knowledge (CBK) Survey in Member Support

The (ISC)² Common Body of Knowledge (CBK) Survey

wentzwu — Tue, 17 Sep 2019 07:32:00 GMT

I received the email notification of the (ISC)² Common Body of Knowledge (CBK) Survey.

It's a nice move for ISC2 to invite feedback about the CBK from members, but I was wondering how I can get access to the "(ISC)² Common Body of Knowledge (CBK)" itself. I've bought a couple of the so-called the official guide to the CBK, say, The Official ISC2 Guide to The CISSP, ISSMP, ISSEP, ISSMP, CSSLP, CCSP CBK.

I am expecting that the ISC2 can publish the InfoSec CBK as the PMI published the PMBOK for project management.

Last but not least, I come from Taiwan, but I can't submit my survey because Taiwan is not listed in the list as the last survey question required the responder to answer.

I'd love to see Taiwan enlisted so that I can complete and submit my responses to the survey.

Thanks for your attention!

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

CraginS — Tue, 17 Sep 2019 17:29:50 GMT

@wentzwu wrote:
I received the email notification of the (ISC)² Common Body of Knowledge (CBK) Survey.

It's a nice move for ISC2 to invite feedback about the CBK from members, but I was wondering how I can get access to the "(ISC)² Common Body of Knowledge (CBK)" itself.

You cannot get access. None of us can. To the great frustration of many of us old-timers, (ISC)2 stopped publishing the CBK itself several years ago. The last copy I had was back in the 10-domain era, predating the current 8 domain construct. Grandpa Rob @rslade had a collection of several versions over the years, but he also discovered that the actual CBK is now hidden internal document. Apparently, it is used only to license ($$$) to authors and publishers for the many books you listed.

There have been several threads in the Community fora on this very topic, with the recalcitrant (ISC)2 staff answer being consistently to imply, without ever saying so directly, that they have no plans to return to the days of publishing the CBK for the members.

If my tone indicates frustration and annoyance at the situation, then I have written this note as I intended. Failure to make the CBK, which used to be an outline of topics, not a book about them, is, in my opinion, a severe disservice to the membership.

Hey! Let's make it a push to the Board to return to the practice of releasing the CBK upon each revision! Grandpa Rob, Wim @wimremes , Diana @dcontesti , what do you think?

Craig

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

Steve-Wilme — Tue, 17 Sep 2019 13:09:31 GMT

It's a strange Common Body of Knowledge if it's not published or available to the members. It really is security through obscurity!

I would have thought that since the CBK construct is based on work that isn't necessarily proprietary that publishing the CBKs as an outline would not cause harm to ISC2. Not publishing them when existing members took their CISSP under a previous set of CBKs rather obviously make submitting CPEs a bit of a hit and miss affair.

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

wentzwu — Thu, 19 Sep 2019 07:45:01 GMT

Thank you very much, Dr. Shelton.

Since ISC2 is inviting feedback about the CBK, it's a good time to identify the issue of differentiating the CBK Guide from the CBK itself.

I'd love to join you to urge the Board to return to the practice of releasing the CBK upon each revision!

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

emb021 — Tue, 17 Sep 2019 14:59:08 GMT

Interesting discussion.

When I did self-studying for the CISSP, I got the then CISSP CBK book to read thru.

With PMI, they have their PMBOK, which they treat as kind of the 'bible' for the PMP cert. You pretty much study it (and other materials) to prepare. I know I did when I was working on that cert.

Then there is my parliamentarian org (NAP). They have certifications for parliamentarians, and when they recently decided to seek ANSI certification for their certs (not sure where they are in that process), one of the first things they did create a Body of Knowledge document which they sent printed copies to all members and still have available as a PDF on their website.

So I really don't understand why the CISSP CBK is not readily available either in some form.

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

rslade — Tue, 17 Sep 2019 16:25:14 GMT

> CraginS (Advocate II) mentioned you in a post! Join the conversation below:

> Grandpa Rob, Wim @wimremes ,
> Diana @dcontesti , what do you think?

Oh, I'm definitely onside for giving the members access to the CBK.

And I agree that it's particularly stupid to send out a "survey" on the CBK when
nobody can read it ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Acknowledge and take to heart this day that the Lord is God in
heaven above and on the earth below. There is no other. Deut. 4:39
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

dcontesti — Tue, 17 Sep 2019 18:59:20 GMT

@rslade wrote:
> CraginS (Advocate II) mentioned you in a post! Join the conversation below:

> Grandpa Rob, Wim @wimremes ,
> Diana @dcontesti , what do you think?

Oh, I'm definitely onside for giving the members access to the CBK.

And I agree that it's particularly stupid to send out a "survey" on the CBK when
nobody can read it ...

So, I got the same email.....unfortunately I ignored it but I believe it was a survey to assist in a Job Task Analysis (I will go back and see if I can find it to verify or if someone can send the link). Years ago, the survey was used to gain insight into things that may be missing from the CBK and helped the exam developers with the DCO (Domain Content Outline....which could go down to three or four levels) but as I have been excluded from test development, I may we working with old knowledge.

Typically the survey asked questions on things that you did in your day to day operations (using the CBK as an outline) and asked if there were things missing.

As to the CBK being available to the members, I see no reason why the CBK in it's original format should not be available. The last conversation that I was involved in, around the CBK, etc. was the fact that they were going to begin to publish the domain breakdowns (that is the percentage of the test applicable to a given section).

I know that management are actively reviewing the Community and would ask that one of them ( @Kaity maybe you can pass along) to provide a much better explanation that I can on this.

So, yes I agree it should be available.

And to @wentzwu on behalf of the membership, I apologize for the fact that Taiwan was not listed on the survey, another ooooops on the part of the management team.

PS: sorry to have been off-line but I came back from Russia with a very nasty bug and will try to be more active .

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

Kaity — Tue, 17 Sep 2019 19:13:16 GMT

Hello @wentzwu! Taiwan has been added now – it was just an oversight, not intentional. You should be able to use the same link and re-access the survey where you left off!

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

wentzwu — Wed, 18 Sep 2019 05:17:26 GMT

That'd be nice! I will submit my responses soon.

Thank you very much for your immediate support, @Kaity !

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

wentzwu — Wed, 18 Sep 2019 05:23:34 GMT

I am looking forward to the ISC2's return to the good practice of publishing CBK periodically as one of the member benefits.

@dcontesti , thank you very much for your attention on the technical issue adding Taiwan back. I appreciate the effective and efficient support from the ISC2 member support team.

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

wimremes — Wed, 18 Sep 2019 07:26:38 GMT

Hey! Let's make it a push to the Board to return to the practice of releasing the CBK upon each revision! Grandpa Rob, Wim @wimremes , Diana @dcontesti , what do you think?

I don't see any proper justification for NOT making the CBK public. If we claim to certify professionals, it is elementary that we also make public on what those professionals are evaluated. It's not only a disservice to the membership but also to our principals and society at large.

Note that we as members can bring topics to BoD meetings using the same petition process as described for elections (500 signatures). Absent the committment of management of the board to address this topic and communicate back to the membership, I am more than happy to give that a try.

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

Kaity — Wed, 18 Sep 2019 14:56:56 GMT

Hello all! I hope to be able to shed some light on this issue regarding the CISSP CBK. The book that is out right now (available on Amazon, Wiley, Kindle, Google Play) is actually the CBK itself. The book title is the Official (ISC)² CISSP CBK Reference, but it is the CBK in its entirety.

I understand the confusion, since the book is not called simply “The Official (ISC)² CISSP CBK.” When working with our publisher, it was recommended that we add the word “reference” to the title as a way to make clear to those purchasing it that it was not intended to be a study tool, but instead a reference guide. In past editions the book has been called the “Official Guide to the CBK” – but even then, it was still the CBK. (ISC)² did not stop publishing the CBK, but I can see where the title of past editions would cause confusion. Honestly, it confused me at first and I work here!

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

wentzwu — Wed, 18 Sep 2019 16:06:47 GMT

@Kaity , may I confirm the CBK you're referring to is the following book:

The Official (ISC)2 Guide to the CISSP CBK Reference 5th Edition

ISBN-13: 978-1119423348
ISBN-10: 1119423341

https://www.amazon.com/Official-ISC-Guide-CISSP-CBK/dp/1119423341

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

Kaity — Wed, 18 Sep 2019 16:21:27 GMT

@wentzwu wrote:

@Kaity , may I confirm the CBK you're referring to is the following book:

The Official (ISC)2 Guide to the CISSP CBK Reference 5th Edition

ISBN-13: 978-1119423348
ISBN-10: 1119423341

https://www.amazon.com/Official-ISC-Guide-CISSP-CBK/dp/1119423341

Yes, that is the one. I know the Amazon title is confusing - but the book itself has the correct title. I have one ...

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

emb021 — Wed, 18 Sep 2019 16:51:32 GMT

Interesting that the ISC2 Store still lists the older 4th edition.

As I have the CISSP, I hadn't kept up on new CISSP related books, so didn't know that had come out. I see it came out earlier this year and has the 8 domains while the 4th edition had the 10 domains.

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

denbesten — Wed, 18 Sep 2019 21:42:51 GMT

@Kaity, thanks for the clarification.

Removing "guide to the" from the title does indeed clear up much of the confusion. Those three words made it seem like it was not the real thing. Unfortunately, I have come across a few areas were the original title remains: Amazon's page, Wiley's page, Google's page, Safari, and the Forward (pg xxv, xxvi) for the book itself. Interestingly, all of them have a picture of the book itself with the correct title, yet the web page has the wrong title. Presumably, these all came about due to a last-minute name change that was only partially flushed through the system.

One other area of confusion for me.... The only CBKs I have ever seen are specific to a cert, such as the CISSP CBK, the SSCP CBK, etc. However, the original posting in this conversation refers to an (ISC)² CBK, as does this web this web page. What exactly is the (ISC)² CBK? Is it like the Star-Wars "trilogy", or the One-Ring to rule them all, or is it something boring, such as people being lazy when referring to the CISSP CBK? Inquiring minds want to know, especially because rslade is probably already clearing space on his bookshelf.

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

wentzwu — Thu, 19 Sep 2019 07:58:41 GMT

@Kaity , thanks for the clarification. It's much better now.

However, I agree with the argument from @denbesten that the terminology "CBK" is used inconsistently.

The (ISC)² CBK page states:

"The (ISC)² CBK is a collection of topics relevant to cybersecurity professionals around the world."
"Domains from the (ISC)² credentials are drawn from various topics within the (ISC)² CBK"

I would define ISC2 CBK as follows:

ISC2 CBK = {CISSP CBK, ISSMP CBK, ISSAP CBK, ISSEP CBK, CSSLP CBK, CCSP CBK, Other CBK}

That is, ISC2 CBK is a set of (ISC)² credential CBKs.

If my understanding is correct, it'd be a nice gesture for ISC2 to release or publish all the topics in the ISC2 CBK to members or the public.

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

Kaity — Thu, 19 Sep 2019 21:31:10 GMT

Appreciate the feedback, everyone!

We are open to changing how the CBK is accessed, which is part of the motivation behind the survey. Please, please fill out the survey if you received an invitation. This information will drive decisions!

Re: The (ISC)² Common Body of Knowledge (CBK) Survey

jimscard — Sat, 28 Sep 2019 07:10:06 GMT

I also join the others calling for the CBK to be published to the members again. (ISC)2 is the only certifying body I know of that has a CBK or similiar document for the profession, but which does not publish it. In fact, I'm surprised that ANSI doesn't require it to be published publicly, as other ANSI/ISO accredited certifications do..

For example, ISACA calls what it has for a CBK "Job Practice Areas" and they are public -- see https://www.isaca.org/Certification/CISM-Certified-Information-Security-Manager/Job-Practice-Areas/Pages/default.aspx for the CISM. I'd expect a high level of overlap with the CISSP CBK.

The IAPP, which issues ANSi/ISO accredited certifications for Information Privacy Professionals like the CIPP/US, CIPP/E, CIPP/C and CIPT, putblishes its Body of Knowledge documents for ech certification on their web site. For example, here's the CIPP/US BOK: https://iapp.org/media/pdf/certification/CIPP_US_BoK_2.2.1.pdf