How was this quiz researched, and what are its limits?

The rubric is an editorial synthesis of primary guidance and implementation documentation. Regulatory and professional sources inform governance questions; vendor documentation supplies concrete examples of technical and commercial dependencies. Supplier sources establish what those sources document, not independent proof of delivery outcomes.

The research also reviewed industry coverage, employer/job-board material and practitioner recordings to identify practical questions. Those channels were not used to invent staffing ratios, market prices, implementation timelines or success rates.

For current professional context, the IIA’s refreshed Three Lines materials were published on 8 July 2026, and NIST SP 1308 reached final publication on 23 March 2026. Older foundational sources remain identified by their own dates rather than being presented as newly published research. (theiia.org)

The quiz does not determine which laws apply to your organisation, validate an entire migration estate from a small sample, or certify any supplier. Sector-specific interpretation belongs with your legal, compliance, security and assurance specialists.