Self-study notes for CPE

Ask the Standard · Q4 2026 edition · by Edward Casteloes CISSP, CISA

Each quarter: four questions practitioners ask, answered from the text of the standard with the clause cited, then an eight-question check and a completion record. About one hour. Free, no sign-in.

Q4 2026: Four scoping questions practitioners get wrong

PCI DSS v4.0.1: SAQ A with an embedded payment iframe, and the ASV scans that remain
EU AI Act: high-risk application dates after the Digital Omnibus, and the Article 111(2) grace period
HIPAA: why a vendor storing encrypted ePHI is still a business associate
CMMC: SIEM and MFA providers as Security Protection Assets and External Service Providers

Download the Q4 2026 notes (PDF, 8 pages) →

About CPE credit

The notes are designed as about one hour of self-study. Whether they count toward your continuing professional education, and how many hours you may claim, is set by your certifying body, such as ISC2 or ISACA. Check its current CPE policy before you report the hours, and keep the PDF and your completed record as evidence. The completion record is self-attested; it is not an accredited course certificate.

How Compliance Colleague made this

Each module started as a question asked in Compliance Colleague. The product answered from the text of the standard and cited the clause or article behind each point.
Those answers are published in full in the answer archive. The notes rewrite them as teaching points and quiz questions; no new facts were added.
Every teaching point and quiz answer was checked against the archive answer it comes from before publication.

Compliance Colleague checks an information security policy, a procedure or a network diagram against PCI DSS, the EU AI Act, ISO 42001 and 30+ more, and cites the clause behind every finding. Try it free, no card required →

A research aid, not legal advice. Drafted with AI (Compliance Colleague), approved for publication by Edward Casteloes CISSP, CISA.