Skip to content

Sources

All sources used to compile the vendor-neutral foundations and reference pages, grouped by topic. Compiled 2026-06-17. Each study page also carries its own ## Sources section with the exact documents it cites; this page is the consolidated index.

Standards, regulations & frameworks

  • NIST SP 800-53 Rev. 5 (AC-2, AC-5, AC-6, AU, IA families): https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
  • NIST SP 800-63B Digital Identity Guidelines (authenticators): https://pages.nist.gov/800-63-3/sp800-63b.html
  • NIST SP 800-82 Rev. 3 (OT security): https://csrc.nist.gov/pubs/sp/800/82/r3/final
  • NIST SP 800-171 Rev. 3 (protecting CUI): https://csrc.nist.gov/pubs/sp/800/171/r3/final
  • NIST SP 800-207 Zero Trust Architecture: https://csrc.nist.gov/pubs/sp/800/207/final
  • NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework
  • NIST NCCoE — Implementing a Zero Trust Architecture (SP 1800-35): https://www.nccoe.nist.gov/projects/implementing-zero-trust-architecture
  • ISO/IEC 27001:2022: https://www.iso.org/standard/27001 · ISO/IEC 27002:2022: https://www.iso.org/standard/75652.html
  • ISA/IEC 62443 series overview: https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
  • EU NIS2 Directive (EU) 2022/2555: https://eur-lex.europa.eu/eli/dir/2022/2555/oj · ENISA NIS2 resources: https://www.enisa.europa.eu/topics/nis-directive
  • EU DORA Regulation (EU) 2022/2554: https://eur-lex.europa.eu/eli/reg/2022/2554/oj
  • EU GDPR Regulation (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj
  • PCI DSS v4.0.1 document library: https://www.pcisecuritystandards.org/document_library/
  • Sarbanes-Oxley Act of 2002: https://www.govinfo.gov/app/details/PLAW-107publ204
  • HIPAA Security Rule (HHS): https://www.hhs.gov/hipaa/for-professionals/security/index.html
  • NERC CIP standards: https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx
  • ANSSI — CSPN: https://cyber.gouv.fr/la-certification-de-securite-de-premier-niveau-cspn
  • BSI — BSZ: https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Zertifizierung-und-Anerkennung/

Protocols & cryptography (IETF / standards bodies)

  • IETF — TOTP (RFC 6238): https://www.rfc-editor.org/rfc/rfc6238 · HOTP (RFC 4226): https://www.rfc-editor.org/rfc/rfc4226
  • FIDO Alliance — FIDO2 / WebAuthn / CTAP: https://fidoalliance.org/fido2/
  • Per-protocol RFC lists (SSH, TLS, Kerberos, LDAP, RADIUS, SAML, OIDC/OAuth 2.0) live in the protocols pages.

Threat intelligence

  • MITRE ATT&CK — Enterprise matrix: https://attack.mitre.org/matrices/enterprise/
  • MITRE ATT&CK — Valid Accounts (T1078): https://attack.mitre.org/techniques/T1078/
  • MITRE ATT&CK — OS Credential Dumping (T1003): https://attack.mitre.org/techniques/T1003/
  • MITRE ATT&CK — Pass-the-Hash / Pass-the-Ticket (T1550): https://attack.mitre.org/techniques/T1550/
  • MITRE ATT&CK — Steal or Forge Kerberos Tickets (T1558): https://attack.mitre.org/techniques/T1558/
  • MITRE ATT&CK — Phishing (T1566): https://attack.mitre.org/techniques/T1566/
  • Lockheed Martin — Cyber Kill Chain: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
  • Verizon Data Breach Investigations Report (DBIR): https://www.verizon.com/business/resources/reports/dbir/
  • ENISA Threat Landscape: https://www.enisa.europa.eu/topics/cyber-threats/threats-and-trends
  • CISA — Identity & Access Management guidance: https://www.cisa.gov/topics/cybersecurity-best-practices/identity-and-access-management

Analyst frameworks & PAM market

  • Gartner — PAM glossary: https://www.gartner.com/en/information-technology/glossary/privileged-access-management-pam
  • Gartner — IGA glossary: https://www.gartner.com/en/information-technology/glossary/iga-identity-governance-and-administration
  • Gartner — IDaaS glossary: https://www.gartner.com/en/information-technology/glossary/idaas-identity-as-a-service
  • Gartner — CIEM glossary: https://www.gartner.com/en/information-technology/glossary/cloud-infrastructure-entitlement-management-ciem
  • Gartner — Magic Quadrant methodology: https://www.gartner.com/en/research/methodologies/magic-quadrants-research
  • Gartner — Magic Quadrant for PAM (2025 landing): https://www.gartner.com/en/documents/7051198
  • KuppingerCole — Leadership Compass: Privileged Access Management: https://www.kuppingercole.com/research/lc80830/privileged-access-management
  • Vendor press releases on 2025 MQ placement — CyberArk: https://www.cyberark.com/press/cyberark-named-a-leader-in-the-2025-gartner-magic-quadrant-for-privileged-access-management/ · BeyondTrust: https://www.beyondtrust.com/blog/entry/gartner-pam-magic-quadrant · Delinea: https://delinea.com/news/delinea-named-a-leader-in-2025-gartner-magic-quadrant-for-pam-for-seventh-consecutive-time · One Identity: https://www.oneidentity.com/analyst-report/one-identity-is-named-a-visionary-in-the-2025-gartner-magic-quadrant-for-pam/ · WALLIX: https://www.wallix.com/press/wallix-recognized-as-a-visionary-for-the-third-consecutive-year-in-the-2025-gartner-magic-quadrant-for-pam-solutions/
  • Vendor product pages cited on the market page — CyberArk PAM: https://www.cyberark.com/products/privileged-access-manager/ · BeyondTrust Password Safe: https://www.beyondtrust.com/products/password-safe · Delinea (ThycoticCentrify rebrand): https://delinea.com/news/thycoticcentrify-is-now-delinea · One Identity Safeguard: https://www.oneidentity.com/one-identity-safeguard/ · Broadcom Symantec PAM: https://www.broadcom.com/products/identity/pam · Microsoft Entra PIM: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure
  • Full list, including the WALLIX CSPN/BSZ certification releases: see the ## Sources section of pam-market-landscape.md.

Learning science (the preparation method)

  • Dunlosky, J., Rawson, K. A., Marsh, E. J., Nathan, M. J. & Willingham, D. T. (2013), Improving Students' Learning With Effective Learning Techniques: Promising Directions From Cognitive and Educational Psychology, Psychological Science in the Public Interest 14(1): https://doi.org/10.1177/1529100612453266
  • Retrieval Practice — research summaries on retrieval practice, spacing and interleaving: https://www.retrievalpractice.org/
  • Used by: learning/how-to-prepare-a-cert.md and the CEH hub's exam strategy.

Notes & caveats

  • Analyst placements change every year; every placement cited in this repo is tagged with the report year it comes from.
  • Vendor certification-program details (exam length, validity period) are not tracked here — see adjacent certs for the vendor ladders.