Sources
18 sources: 10 verified (S016 only for its stated version), 8 partly verified, unverified or not verifiable. Verification status is recorded per source and is stated wherever a case study relies on it.
| S001 | The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29) | NIST | nvlpubs.nist.gov | 2024-02-26 | verified | P2 crosswalk; P3 supply chain (GV); P4 context; dashboard domains | PDF text extracted and read locally 2026-10-15. Subcategory-level IDs not yet verified (needed for M3 crosswalk). Voluntary guidance. 2026-10-16: all 106 subcategory IDs and outcome statements extracted from the PDF text (research/csf2-core-subcategories.csv, scripts/extract_csf_core.py). |
|---|---|---|---|---|---|---|---|
| S002 | NIST Cybersecurity Framework (CSF) 2.0 publication page | NIST | www.nist.gov | 2024-02-26 | verified | Citation details | Page does not list the six functions; S001 does. |
| S003 | NIST AI Risk Management Framework (AI RMF 1.0) landing page | NIST | www.nist.gov | 2023-01-26 | partially verified | P4 governance lifecycle (Govern/Map/Measure/Manage); P5 boundaries | Function names confirmed only from graphic alt text on the page. Function/subcategory descriptions and counts NOT verified against NIST AI 100-1 itself; fetch the primary PDF before M4. Revision pending: re-check before publishing. 2026-10-16: the AI RMF 1.0 core (4 functions, 72 subcategories) was read from S018; subcategory refs may be cited. |
| S004 | AI RMF: Generative AI Profile (NIST AI 600-1) | NIST | www.nist.gov | 2024-07-26 | partially verified | P4 optional generative-AI considerations | Existence and date confirmed from S003 only; document not read. |
| S005 | Just Published: PCI DSS v4.0.1 | PCI Security Standards Council | blog.pcisecuritystandards.org | 2024-06-11 | verified | P2 PCI scoping; P3 service provider relationships | Announcement only; the standard itself is S006 (requires document-library access). |
| S006 | PCI DSS v4.0.1 (PCI SSC Document Library) | PCI Security Standards Council | www.pcisecuritystandards.org | not shown on page | partially verified | P2 mappings (requirement titles only) | Listing confirmed; document text not read; page does not state cost/registration. Do not quote requirement text. Requirement numbers must be verified from the PDF before mapping in M3. 2026-10-16: the v4.0.1 PDF itself is click-through gated; requirement-level data read from S016 (v4.0) instead. |
| S007 | ISO/IEC 27001:2022 Information security management systems - Requirements | IEC Webstore (ISO/IEC) | webstore.iec.ch | 2022-10-25 | verified | P2 ISMS mapping; scoping statements | Catalogue abstract only; standard text is paywalled and will not be reproduced. iso.org returned HTTP 403. Annex A control titles need a legitimate public source before use (open item). |
| S008 | ISO/IEC 42001:2023 Artificial intelligence - Management system | IEC Webstore (ISO/IEC) | webstore.iec.ch | 2023-12-18 | verified | P4 management-system relationship statement | Catalogue abstract only; standard text paywalled. |
| S009 | SOC suite of services | AICPA & CIMA | www.aicpa-cima.com | not shown | partially verified | P2/P3 SOC 2 use; P3 vendor reports | Page names the five categories but does not mention Trust Services Criteria or define SOC 2. The page does not call SOC 2 a certification, which is consistent with the project rule. |
| S010 | 2017 Trust Services Criteria (with revised points of focus 2022) | AICPA | www.aicpa-cima.com | 2022 revision (per secondary sources) | not verifiable (account-gated) | P2 TSC mapping | Landing page excerpt only; the criteria PDF requires a free AICPA account. CC-series criterion IDs are therefore NOT used. SOC 2 mappings are made to the five categories named on S009 only. |
| S011 | PIPEDA fair information principles | Office of the Privacy Commissioner of Canada | www.priv.gc.ca | last modified 2025-05-29 | verified | P2 privacy controls; P4 data categories | Page does not itself state Schedule 1 status. Not legal advice; do not make blanket applicability claims for the fictional company. Ontario sources not yet researched. |
| S012 | ISACA launches future-ready IT audit framework update (ITAF 5th edition) | ISACA | www.isaca.org | 2026-02-26 | verified | P1 methodology; P5 audit analytics; methodology page | Press release only. ITAF text itself not read; do not cite specific standard numbers except 2208 as named in the release. Replaces the 4th-edition reference many sources still cite. |
| S013 | ISACA updates IT audit framework (ITAF) 4th edition | ISACA | www.isaca.org | 2020-10 | unverified | Historical context only | Seen in search results only, page not fetched, and superseded by S012. |
| S014 | OSFI fall risk update focused on frontier AI | OSFI via Newswire | www.newswire.ca | October 2026 (per search result) | unverified | Optional context for P3/P4 | Seen in search results only. Fetch before citing. Not required for any core claim. |
| S015 | Job posting set J001-J006 and J017-J022 (see research/job-postings.csv) | Various employers | research/job-postings.csv | 2026-09 to 2026-10 | verified | Job-market analysis | Eleven postings read in full (J017-J021 via browser); 10 further leads recorded as unverified. Slightly below the 12-20 target: see job-market-analysis.md. |
| S016 | PCI DSS v4.0 SAQ D for Merchants and Attestation of Compliance (April 2022) | PCI Security Standards Council | listings.pcisecuritystandards.org | 2022-04 | verified (v4.0 text) | P2 PCI mappings (requirement numbers and intent) | Version is v4.0, not v4.0.1. S005 states v4.0.1 added or deleted no requirements, but wording for individual rows is not re-checked. Verify against the v4.0.1 PDF before real use. |
| S017 | ISO 27001:2022 Annex A Explained and Simplified (control list) | ISMS.online | www.isms.online | undated | partially verified (secondary; internally consistent counts) | P2 ISO mappings (Annex A references and titles only) | The ISO text is paywalled and iso.org blocks automated access (Cloudflare challenge, not bypassed). Titles not checked against the standard; ISO mappings are capped at Medium confidence. |
| S018 | Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 | NIST | nvlpubs.nist.gov | 2023-01 | verified | P4 AI risk structure and control mapping; research/nist-ai-rmf-core-subcategories.csv | Extracted from PDF text by scripts/extract_airmf_core.py (72 rows). PDF line-break hyphens and a few dropped letters remain in the extracted statements, so the project paraphrases rather than quotes them. NIST notes AI RMF is being revised (see S003). |
No rows match the current filters.
Job-market research summary
Sample is thin and senior-skewed. Only 12 postings were fully read; counts apply to those 12.
Accessed 2026-10-15. Data: job-postings.csv. Sources: source-register.csv (S015).
Coverage and caveats (read first)
- 12 postings fully read (J001-J006, J017-J022). 10 further leads (J007-J016) are recorded but unverified (pages removed, blocked or unreadable); no claim below relies on them. That reaches only the low end of the 12-20 target, and the twelfth posting (J022) was supplied by the user. I'm not padding it.
- Reading method: J022 text pasted by the user (source page not opened by me); J001-J002 via fetch; J003-J006 via an aggregator's copy (apply links on Lever/Greenhouse not independently opened); J017-J021 in a real browser on the employers' own career sites (Moneris, RBC).
- RBC descriptions were truncated to about 3,300 characters when extracted, so certifications or experience requirements lower in a posting may be missing. Where a field says "not seen", that means not seen, not absent.
- The set is senior-skewed. Where years are visible: 0-1 (J022, preferred), 2-4 (J005), 3+ (J003), 3-6 (J018), 3+ SQL (J020), 5+ (J001, J002, J004), 5-7 (J017), 10+ (J006). J019 (RBC ICFR analyst) shows only a degree and "general knowledge" of control testing, so it is the most early-career-friendly role found.
- The 12 postings come from 9 employers (RBC has four), so this cannot support claims like "most Canadian employers".
- Indeed, Glassdoor and ZipRecruiter blocked or did not expose posting text. The sample is therefore biased toward employers with open career sites.
- Counts below are counts within these twelve only.
Recurring signals (within the 12 verified postings)
| # | Signal | Seen in | Count |
|---|---|---|---|
| 1 | Evidence collection, documentation and control validation | J003, J005, J006, J017, J018, J019, J022 (non-financial risk testing) | 7/12 |
| 2 | Translating several frameworks or regulations into concrete requirements/controls | J001, J003, J004, J006, J017 | 5/12 |
| 3 | Findings, deficiencies and remediation tracking to closure | J003, J004, J019, J021 | 4/12 |
| 4 | Third-party / vendor risk, including AI vendors | J001, J004, J006 | 3/12 |
| 5 | AI risk assessment and governance (inventory, risk register, NIST AI RMF, ISO/IEC 42001) | J001, J002, J004, J006 | 4/12 |
| 6 | Automation or AI-assisted control testing / continuous assurance | J004, J005, J018 | 3/12 |
| 7 | Risk metrics, KPIs/KRIs and leadership reporting | J001, J004, J020, J021, J022 | 5/12 |
| 8 | CISA named (preferred, asset, plus, or an accepted qualification) | J001, J003, J004, J005, J006, J021 | at least 6/12 |
Frameworks named: ISO/IEC 27001 (J001, J003, J006, J017), NIST CSF (J017), NIST SP 800-53 (J001, J003), NIST AI RMF (J004, J006), ISO/IEC 42001 (J004, J006), PCI DSS (J006, J017), SOC 1/2 (J006), SOX (J005, J019; J021 as nice-to-have), FDICIA (J019), COBIT (J001).
Interpretation (mine, not stated in postings): - Evidence handling and control testing are the most common signal, and they show up in audit roles (J018, J019, J005) as well as GRC roles (J003, J006, J017). Showing how a finding traces back to evidence is the strongest thing the portfolio can do for both target role families. - J018 and J005 both ask for data analytics or automation in control testing, and J020 asks for SQL-driven risk metrics with defined business rules. That supports building the dashboard from data with written KPI definitions and building project 5 as measured, human-reviewed analytics. - AI governance appears in 4 of 12 postings. It is a real signal, but not the majority one, so project 4 should not crowd out projects 1 and 2. - J022 shows that entry-level "risk and compliance" roles in Canada can sit in insurance and lean on quantitative skills (modelling, Excel, Power BI) rather than on security frameworks; the portfolio's data-driven dashboard and written KPI definitions speak to that, but its IT-audit content does not. One posting is an anecdote, not a trend. - With CISA named in at least 6 of 12, the user's CISA path is consistent with what these employers ask for. That is a statement about these postings only.
Pain point to portfolio mapping
| Pain point | Portfolio feature |
|---|---|
| Evidence-based control validation | P1 workpapers, evidence register, sample selection rationale; P5 deterministic checks |
| Multi-framework translation without overclaiming | P2 crosswalk with confidence/review status and a "mapping is not compliance" page |
| Findings to closure | P1 management action plan and retest simulation; P3 remediation tracker; dashboard aging |
| Vendor and AI-vendor risk | P3 three vendor cases; P4 AI supplier checklist |
| AI risk assessment and governance | P4 policy, inventory, two risk assessments, decision memo |
| Analytics/automation in control testing | P5 prototype with measured evaluation and explicit human review |
| Metrics and leadership reporting | Executive dashboard: every KPI has a definition, calculation, source file and as-of date |
| CISA-relevant IT audit skills | P1 follows risk assessment, planning, fieldwork, reporting; methodology page references ITAF (S012) |
Gaps
- IT-audit evidence is still thin: two roles (J018, J019) plus J005. No verified SOC-report-review or ITGC-specific entry-level posting exists in the set; the leads that mentioned ITGC (J007, J010, J013, J014) are unverified.
- Entry/mid-level postings in the set: J003, J005, and J022 (user-supplied, an insurance second-line risk and compliance role that is quantitative and actuarial-leaning rather than IT audit, and names no CISA or security framework). It is a useful entry-level data point but does not change the IT-audit gap above. More pasted postings would still improve the analysis more than further searching by me.
- If this document is shown on the public site, the caveats above must be shown with it.