Appendix D — Source guide and edition boundaries

Reviewed 15 September 2026. These references support selected explanations; they are not a full legal or certification conformity assessment. Use current official material and the engagement’s authorised editions for real work. The fixed case’s original policies are sufficient for its exercises.

D.1 Standards and assurance

• ISO/IEC 27001 and its 2024 climate-action amendment: this book targets 27001:2022 with Amd 1:2024. The management-system criteria and necessary controls must be assessed together. Obtain authorised normative text; the book does not reproduce it.
• ISO 19011:2026: management-system audit guidance. The six-stage presentation in chapter 4 is a teaching arrangement. ISO 19011 does not itself confer certification.
• ISO quality-management vocabulary: distinguishes correction from cause-directed corrective action. The book’s 5C+R format is its own reporting template.
• NIST CSF 2.0 Core and transition FAQ: confirm categories and outcome-level mappings. PR.PS and PR.IR are different categories; governance was already represented in CSF 1.1.
• ASD Essential Eight maturity model: use strategy-specific requirements and adversary-based maturity distinctions rather than generic maturity labels.
• AICPA SOC 2 overview: explains the report’s purpose. Actual reliance needs the relevant report, scope, period, exceptions and complementary user controls.
• ISACA CISA requirements: professional certification requirements; CISA is not a universal statutory practice licence.

D.2 Risk, technical controls and recovery

• NIST SP 800-30 Rev. 1: risk-assessment method. The book’s ordinal matrix is a teaching choice, not a calibrated probability model.
• NIST SP 800-207: zero-trust architecture. Match an architectural principle to a bounded test rather than claiming universal security.
• AWS shared responsibility: service selection changes the boundary. Inspect the actual service and configuration.
• AWS KMS rotation: prior key material remains available for decryption. Rotation and access revocation are distinct.
• NIST SP 800-61 Rev. 3: April 2025 incident-response guidance integrated with CSF 2.0. Chapter 10 labels the older Rev. 2 phase model historically.

D.3 Australian privacy

• OAIC APP guidelines: establish applicability and use the relevant principle, including its exceptions. Chapter 9 links directly to APP 5, APP 6 and APP 11.
• OAIC overseas-information guidance: distinguish use from disclosure and consider effective control and exceptions.
• OAIC NDB guidance: assessment and notification are separate duties.
• Privacy Act 1988, official legislation: consult the applicable compilation and qualified advice for consequential interpretation.

D.4 Scenario and permissions boundary

SDA-2026.1 supplies original synthetic records. It is not a copy of the live Tessera library and does not inherit that site’s changing dates or targets. The editorial resource review identified scenario differences; checking public availability does not authorise reuse of third-party assets.

The author approved CC BY 4.0 International for this book and fictional framing for the unattributed audit anecdotes. Existing artwork is unchanged. Confirm any separate artwork or Tessera-brand permissions before a commercial release; this revision does not invent them.

A link that responds successfully is not proof of factual accuracy. If a source changes, report the chapter, claim and edition so the book’s wording and exercises can be reviewed together.