CISSP Domain 7: Security Operations explained

Domain 7 at a glance

The subdomains in plain words

1. 7.1 Investigations: evidence, admissibility, forensic procedure and eDiscovery.
2. 7.2 Logging and monitoring: log sources, SIEM, threat intelligence and protecting the logs themselves.
3. 7.3 Configuration management: baselines, hardening, imaging and automation.
4. 7.4 Foundational concepts: need to know, least privilege, separation of duties, job rotation and privileged accounts.
5. 7.5 Resource protection: media handling, backups and disposal.
6. 7.6 Incident management: detection, response, mitigation, reporting, recovery, remediation and lessons learned.
7. 7.7 Detective and preventive controls: firewalls, IDS and IPS, anti-malware, sandboxing, honeypots and allow lists.
8. 7.8 Patch and vulnerability management: finding, testing, deploying and verifying fixes.
9. 7.9 Change management: request, review, approve, test, schedule, document, including emergency changes.
10. 7.10 Recovery strategies: backups, RAID, recovery sites and resilience.
11. 7.11 Disaster recovery processes: teams, communications, assessment and restoration.
12. 7.12 Testing DR plans: from read-through to full interruption.
13. 7.13 Business continuity in practice: taking part in planning and exercises.
14. 7.14 Physical security operations: perimeter, internal controls and alarms.
15. 7.15 Personnel safety: duress, travel, emergency management and awareness.

What the exam tends to test

• Order of operations. Incident steps, change steps, patch steps, forensic steps. Many questions simply ask what comes first or next.
• People before systems. In any disaster or physical scenario, life safety comes first.
• Containment before cure. Stop the damage spreading before you hunt for the root cause.
• Management decides. Calling law enforcement, accepting residual risk and approving changes are management calls.
• Proportionate testing. The least disruptive DR test that meets the goal.

How deep to go

This domain rewards order more than detail. Know the steps of each process and why each step comes where it does. Technical depth matters most for detection tools (signature versus behaviour, host versus network) and for backup and recovery options, where cost and recovery time trade against each other.

Common traps

• Counter-attacking. Hacking back is never the answer.
• Skipping change control in an emergency. Emergency changes are still documented and reviewed afterwards.
• Working on original evidence. Image it, hash it, and analyse the copy.
• Returning the most critical function first after a disaster. When moving back to the primary site, the least critical functions go first, so a fault there does not hit the business hardest.
• Confusing need to know with least privilege. Need to know limits which data; least privilege limits which rights.

How to study it

1. Put each process on a single card as an ordered list: incident, change, patch, forensic, DR test types. Rehearse them until the order is automatic.
2. Read Domain 1 continuity planning alongside 7.10 to 7.13; one plans, the other runs.
3. Practise "first, next, best" questions, since this domain uses them heavily. Our think like a manager guide explains the pattern.
4. Connect monitoring and testing with Domain 6.
5. From 15 April 2027 the outline names machine learning and AI-based detection tools under 7.7; see what changes in 2027.

Worked example: thinking it through

Our own illustration, not an exam item.

The situation. At 2 a.m. monitoring alerts on ransomware encrypting files on a shared file server in your Chennai office. You are the on-call security lead. What should you do first?

• Wipe the server and restore it from last night's backup.
• Disconnect the server from the network to stop the spread, and start the incident response plan.
• Trace the attacker and disrupt their command server.
• Call the press office to prepare a statement.

The reasoning. Wiping and restoring destroys evidence and may reinfect the server if the attacker is still present; recovery comes after containment. Attacking back is never acceptable, and it may be illegal. Communications matter, but they follow the plan and management's decisions, not your first move at 2 a.m. Containment, by isolating the affected system, limits the damage and preserves options, and the incident plan then brings in the right people, including management, who decide on matters such as involving law enforcement. Getting the order right is most of this domain.

Next steps

See how this domain's weight compares on the domains overview, then drill the ordered processes with our own practice questions, including drag-and-drop sequences.