How current is it?

Frameworks, laws and exam outlines change, so the editions the site teaches are checked against their publishers' own sources, and the content is updated when they change. The last check, on 19 October 2026, covered about 60 of them. These are the ones you're most likely to meet here, and the edition each is taught at.

Security standards and frameworks

ISO/IEC 27001 and 27002Current
2022
NIST Cybersecurity FrameworkCurrent
CSF 2.0
SOC 2Current
2017 Trust Services Criteria, with the 2022 points of focus
PCI DSSCurrent
v4.0.1
v4.0 was retired on 31 December 2024.
CIS Critical Security ControlsCurrent
v8
v8.1 (June 2024) is a minor update that kept the 18 controls.
ASD EssentialsCurrent
Enterprise IT chapter (October 2026)
It replaced the Essential Eight on 15 October 2026. The Essential Eight Maturity Model (November 2023) is still taught where a regulator, contract or insurer requires it, because ASD has set no transition dates.
NIST SP 800-61 and SP 800-88Current
Revision 3 (April 2025) and Revision 2 (September 2025)
FIPS 140Current
140-3
FIPS 140-2 certificates moved to the historical list on 21 September 2026.
ISO 31000Current
2018
A revision is under way; nothing changes until it is published.
COBITSuccessor dated
COBIT 2019
COBIT 7 replaces it from 27 October 2026, and the COBIT 2019 Foundation exam can be sat until 26 April 2027. The COBIT rooms use it to label general governance principles, so their lessons hold; they and the Exam Prep entry will move once ISACA publishes the COBIT 7 material.
NCSC Cyber Assessment FrameworkOlder on purpose
v3.2, in the labs
CAF 4.0 came out in August 2025. The lab organisations are assessed against v3.2, the edition their scenarios are set under, and the reason is recorded with them.

Laws and regulation

EU AI ActCurrent
As amended by Regulation (EU) 2026/1744
In force from 27 July 2026. The content uses the new dates: Annex III high-risk obligations from 2 December 2027, Annex I from 2 August 2028.
UK GDPR and PECRCurrent
As amended by the Data (Use and Access) Act 2025
Main provisions from 5 February 2026, and the complaints duty from 19 June 2026.
EU Cyber Resilience ActCurrent
Regulation (EU) 2024/2847
Its reporting obligations have applied since 11 September 2026.
APRA CPS 234 and CPS 230Current
Current standards
CMMC and NIST SP 800-171Current
SP 800-171 Rev. 2
Rev. 2 is still the DFARS 252.204-7012 baseline. CMMC Phase 2 has been suspended since 13 July 2026, and the labs never say certification is mandatory.
FedRAMPSuccessor dated
Rev5 process, with the 2026 rules alongside
The Consolidated Rules for 2026 become mandatory on 1 January 2027. Each FedRAMP room ends with a section on them; the rooms are being rewritten around them before that date.

Certification exam outlines in Exam Prep

ISC2 Certified in Cybersecurity (CC)Current
The outline from 1 September 2026
IIA Certified Internal Auditor (CIA)Current
The three parts tested since May 2025
ISO/IEC 27701Current
2025, a standalone management system standard
ITIL FoundationCurrent
Version 5, with ITIL 4 until its modules sunset
ITIL 4 modules are planned to sunset at the end of 2027.
ISACA CISMSuccessor dated
The current outline
A new outline applies from 3 November 2026. It keeps the four domains, adds enterprise and information security architecture, and shifts one point of weighting from incident management to governance.
CompTIA Security+Successor dated
SY0-701
SY0-801 launches on 17 November 2026, and SY0-701 retires on 11 June 2027 in English. Domain 2 becomes Threats, Vulnerabilities, and Attacks.

Changes on the way

27 October 2026COBIT 7 and its Foundation certificate replace COBIT 2019. The COBIT Exam Prep entry and rooms move once ISACA publishes the COBIT 7 outline.
3 November 2026New CISM exam content outline. The CISM domain descriptions gain the architecture areas.
17 November 2026CompTIA Security+ SY0-801 launches. The Security+ entry moves to SY0-801, or covers both until SY0-701 retires.
2 December 2026New EU AI Act prohibitions apply, and the Article 50(2) grace period ends. Nothing to change: the labs already record these dates.
1 January 2027FedRAMP's Consolidated Rules for 2026 become mandatory. The six FedRAMP rooms are rewritten around the new rules.

Proposed, not law yet

The site doesn't teach these as if they were in force, and will be updated if they are adopted:

EU: The GDPR changes in the Digital Omnibus, the targeted NIS2 amendments, the Cybersecurity Act revision, and the appeal against the EU–US Data Privacy Framework.
UK: The Cyber Security and Resilience Bill.
US: The SEC's review of its cyber disclosure rules, the HIPAA Security Rule amendments, the CIRCIA final rule, and the NIST AI RMF and Privacy Framework revisions.
Elsewhere: Australia's tranche 2 Privacy Act reforms, Canada's Bill C-36, the next PCI DSS version, and the ISO 45001 and ISO 31000 revisions.

Lab organisations are set at a date of their own, and their evidence follows the rules in force then, so a lab can rightly use an edition that has since been replaced. If you spot an edition that has moved on, tell us below.

Editions checked against their sources on 19 October 2026.

Found a mistake?

Tell us. Email a link to the page, the question or field, what you think is wrong and, if you can, the source that shows it. We read every message.