The Candidate Information Bulletin (CIB), where can I find it?

[clementdupuis]

Good day, 

I was trying to find the latest Candidate Information Bulleting (CIB) document for the latest CBK.

Where can I find this document?   Is it still available from ISC2?

I could not find it on the ISC2 website.

Best regards

Clement

[rslade]

> CraginS (Contributor III) mentioned you in a post! Join the conversation below:

> Clement @clementdupuis and Grandpa Rob @rslade both are quite
> experienced in using these references

Hey, I used to have two books *in* the CIB ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Nothing in this world can take the place of persistence. Talent
will not; nothing is more common than unsuccessful people with
talent. Genius will not; unrewarded genius is almost a proverb.
Education will not; the world is full of educated derelicts.
Persistence and determination alone are omnipotent. The slogan
`press on' has solved and always will solve the problems of the
human race. - Calvin Coolidge
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

[rslade]

> dcontesti (Newcomer III) posted a new reply in Certifications on 10-12-2018

> Can
> you also forward the link to me?  I was trying to point someone to it, but
> cannot find it.

Amanda was telling us it is no more. It is an ex-document. It has joined the
archive invisible. All statements to the effect that this text is still a going
concern are, from now on, inoperative ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
I'm getting so absent-minded that sometimes in the middle of
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

[clementdupuis]

Good morning, Rob,

None of the two are left in the latest list of references at https://www.isc2.org/certifications/References 

Best regards my friend

Clement

[rslade]

> clementdupuis (Newcomer II) posted a new reply in Certifications on 10-13-2018 07:54 AM in the (ISC)² Community :

> Good morning, Rob,   None of the two are left in the latest list of references

(in best "South Park" voice): Those bastards! They've killed "Viruses Revealed"!

(Actually, by this point I wondered if someone would have included the dictionary,
which I would have considered much more important.)

Oh, that's pathetic. I mean, they seemingly haven't even noticed that Pfleeger's
in there twice. (I mean, he was good, but ...) And having the "Official Guides" in
there? Study guides were (specifically) *never* considered "source" literature. (At
least I'm still incuded in several editions of ISMH.) But, Bidgoli? I mean, that's
just sloppy. (Even though I've got an article in there, too.) I'm glad they've got
Toigo for BC/DR (although the 3rd edition was possibly the worst). They've got
some good stuff in there, but why "Agile Development in the Real World"?

Here, lemme make some suggestions:
http://victoria.tc.ca/int-grps/books/techrev/mnbksccd.htm

======================
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
"If you do buy a computer, don't turn it on." - Richards' 2nd Law
"Robert Slade's Guide to Computer Viruses" 0-387-94663-2
"Viruses Revealed" 0-07-213090-3
"Software Forensics" 0-07-142804-6
"Dictionary of Information Security" Syngress 1-59749-115-2
============= for back issues:
[Base URL] site http://victoria.tc.ca/techrev/
CISSP refs: [Base URL]mnbksccd.htm
PC Security: [Base URL]mnvrrvsc.htm
Security Dict.: [Base URL]secgloss.htm
Security Educ.: [Base URL]comseced.htm
Book reviews: [Base URL]mnbk.htm
[Base URL]review.htm
Partial/recent: http://groups.yahoo.com/group/techbooks/
http://en.wikipedia.org/wiki/Robert_Slade
http://www.infosecbc.org/links http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/

[denbesten]

---

@CraginS wrote: 

Every question on any of the exams should be verified ONLY against the current available versions of each document, and never with superseded versions or cancelled documents. 

Are you proposing that questions must reference current sources at the time the question is written, or are you proposing that each time a source is updated, testing should be suspended until the impacted questions have been re-referenced?

(ISC)²'s regular psychometric analysis already addresses the problem of outdated questions.  If the state of the art changes such that an "incorrect" answer is regularly chosen by passers, the question will be identified as "non-predictive" and discontinued.  Unless there is a sudden and giant shift, a few "questionable" questions should not be a big deal, given the generous 70% threshold for passing.

Mostly the exam is about relevant experience, strong foundational knowledge and "management perspective".  None of these expire when sources are refreshed.  The important part of question design is that it be referenced against multiple sources with different authors to avoid author bias.  As long as a given source has not been recalled or discredited, I see no compelling reason to arbitrarily banish questions that reference it.

[CraginS]

---

@denbesten wrote:

---

@CraginS wrote: 

Every question on any of the exams should be verified ONLY against the current available versions of each document, and never with superseded versions or cancelled documents. 

Are you proposing that questions must reference current sources at the time the question is written, or are you proposing that each time a source is updated, testing should be suspended until the impacted questions have been re-referenced?

(ISC)²'s regular psychometric analysis already addresses the problem of outdated questions.  If the state of the art changes such that an "incorrect" answer is regularly chosen by passers, the question will be identified as "non-predictive" and discontinued.  Unless there is a sudden and giant shift, a few "questionable" questions should not be a big deal, given the generous 70% threshold for passing.

Mostly the exam is about relevant experience, strong foundational knowledge and "management perspective".  None of these expire when sources are refreshed.  The important part of question design is that it be referenced against multiple sources with different authors to avoid author bias.  As long as a given source has not been recalled or discredited, I see no compelling reason to arbitrarily banish questions that reference it.

---

---

@denbesten wrote:

---

@CraginS wrote: 

Every question on any of the exams should be verified ONLY against the current available versions of each document, and never with superseded versions or cancelled documents. 

Are you proposing that questions must reference current sources at the time the question is written ...?

---

Yes, of course. Before a question is added to the pool it should be vetted by a current and currently available reference source. If new questions are added to the pool between major revisions, each new question should be vetted against the list of references made available to candidates as they plan their studies. Each question in the pool should always track to the current and currently available sources in the list provided to the candidates.  

"... or are you proposing that each time a source is updated, testing should be suspended until the impacted questions have been re-referenced?"

That would be an unnecessary burden on the overall test development program, and also on candidates trying to study. However, if a major change in a primary source is results in a question that is supported by the old source but not the new version, I suggest removing that question from the pool until the next major revision of the CBK and the exam. At that time the new source reference list and al questions in the pool can be keep in alignment. In truth, most questions based on any one source will continue to be supported by the next.  However, major changes in a given source may affect some questions. Recent examples include changes in NIST SP 800-30 and -37 with the implementation of the Risk Management Framework, as well as some of the changes in moving form COBIT 4 to COBIT 5. AS I have said previously, each question should be vetted only against the current, and currently available and reference-listed sources.  The fact that the CISSP-ISSEP list includes both COBIT 4 and COBIT 5 is ridiculous. It is good they finally remover IATF Chapter 3 from the list, since it has been unavailable for ten years.

I consider Clement @clementdupuis our resident expert on this test development and documentation process and again ask for his comments.