RMFInsider

CISSP Domain 7, Security Operations, is the largest domain on the exam at roughly 13 percent of the questions as of the 2024 outline, and it covers the day-to-day running of a security program: investigations and forensics, logging and monitoring (SIEM, UEBA, threat intelligence), configuration and change management, foundational operations concepts (need to know, least privilege, separation of duties, job rotation), resource protection, incident management, detective and preventive measures, patch and vulnerability management, recovery strategies, disaster recovery and business continuity, physical security, and personnel safety. If you are a DoD ISSO, this domain is your job description with the acronyms swapped out.

The trap is the same one that catches practitioners in every operational domain: you know how it is done at your command, and the exam wants how it should be done in the ISC2 universe, from the perspective of a manager who owns the process rather than the analyst who runs the tool.

The Domain 7 outline at a glance

• 7.1 Understand and comply with investigations (evidence handling, reporting, investigative techniques, digital forensics tools and artifacts).
• 7.2 Conduct logging and monitoring (intrusion detection and prevention, SIEM, SOAR, continuous monitoring, egress monitoring, log management, threat intelligence, UEBA).
• 7.3 Perform configuration management (provisioning, baselining, automation).
• 7.4 Apply foundational security operations concepts (need to know, least privilege, separation of duties, privileged account management, job rotation, service level agreements).
• 7.5 Apply resource protection. 7.6 Conduct incident management (the seven-step lifecycle). 7.7 Operate and maintain detective and preventive measures.
• 7.8 Patch and vulnerability management. 7.9 Change management. 7.10 Recovery strategies (backup, sites, resilience). 7.11 Disaster recovery processes. 7.12 Test DR plans. 7.13 Business continuity.
• 7.14 Physical security. 7.15 Personnel safety and security.

For the map of how Domain 7 sits among the other seven, the full CISSP domains overview is worth a reread before you start here.

Incident management: the ISC2 lifecycle vs DoD reporting

The exam uses a seven-step incident management lifecycle: detection, response, mitigation, reporting, recovery, remediation, lessons learned. Memorize the order and what each step contains. Response is the initial triage and containment decision. Mitigation is containing the damage. Remediation is the root-cause fix so it does not recur. Lessons learned closes the loop into policy and controls. NIST SP 800-61 uses a four-phase model (preparation, detection and analysis, containment/eradication/recovery, post-incident activity), and the exam may reference either; know that they describe the same work.

In DoD, the reporting step has teeth the exam will not test but you should not forget: incidents are reported to your Cybersecurity Service Provider (CSSP) and up through the Component to JFHQ-DODIN and, for defense contractors handling CUI, the DFARS 252.204-7012 requirement to report cyber incidents to DoD within 72 hours via the DIBNet portal. The exam-relevant lesson from that world is one it does agree with: reporting is a defined step with defined timelines and defined recipients, not an afterthought once the fire is out.

The exam pattern that catches DoD people: a scenario asks what to do first when an incident is detected. The analyst instinct is to start containing. The exam answer is frequently to follow the incident response plan, notify the response team, and preserve evidence before taking action that destroys it. Domain 7 wants a process manager, not a hero on a keyboard.

Investigations and forensics: chain of custody or nothing

Objective 7.1 covers evidence collection and handling, and the exam takes it seriously. Know the order of volatility (CPU registers and cache, then RAM, then network state and running processes, then disk, then remote logs and archival media). Know that you image drives and work on the copy, hash the original and the copy, and document every hand-off in a chain of custody log. Know the four investigation types (administrative, criminal, civil, regulatory) and that criminal investigations demand the highest evidence standard (beyond a reasonable doubt) while civil use preponderance of the evidence.

The DoD tie-in is that your incident response plan (IR-8) and your IR-4 handling procedures should already specify when to stop touching a system and call the CSSP or law enforcement (DC3, NCIS, OSI, Army CID, depending on your Component). If they do not, you have found a gap to fix regardless of the exam.

Logging, monitoring, and SIEM: Domain 7 meets ConMon

Objective 7.2 is where the exam covers the machinery of continuous monitoring, and if you run a ConMon program for a DoD system you already own every concept in it. The vocabulary to lock down:

• SIEM aggregates, normalizes, and correlates logs; SOAR automates response playbooks on top of the SIEM output; UEBA baselines user and entity behavior to flag anomalies.
• IDS vs IPS: detection alerts, prevention blocks inline. Network-based vs host-based. Signature-based vs anomaly-based (and the false-positive trade-off each brings).
• Egress monitoring for data exfiltration: DLP, watching outbound traffic, not just inbound.
• Log management: centralized collection, time synchronization, retention per policy, protection from tampering, and a defined review cadence (AU-6 in NIST terms).
• Threat intelligence: strategic, operational, tactical; indicators of compromise; sharing communities.

The DoD flavor: HBSS or its successor endpoint agents, ACAS for vulnerability data, log forwarding to the CSSP, and the Continuous Monitoring strategy that tells the AO how the system stays authorized. The exam concept underneath all of it is that monitoring is a control only when someone acts on the output. A SIEM that generates 40,000 alerts nobody reads is an expensive log archive with a dashboard.

Configuration and change management: the CCB is a Domain 7 topic

Objectives 7.3 and 7.9 cover configuration management and change management. The exam expects you to know that configuration management establishes and maintains a baseline (provisioning, baselining, automation), and that change management is the process for modifying that baseline in a controlled way: request, impact analysis, approval by a change control board, testing, implementation, documentation, and rollback planning. Emergency changes get a fast track but are still documented and reviewed after the fact.

For DoD readers, this is CM-2 (baseline), CM-3 (change control), CM-4 (security impact analysis), CM-6 (configuration settings, meaning STIGs), and CM-9 (the CM plan). If you have sat on a CCB and written a security impact analysis, you have the practical knowledge; the exam simply wants the sequence and the principle that unapproved changes are a security incident in slow motion.

Foundational concepts and privileged account management

Objective 7.4 is short and it is a reliable source of easy points. Need to know limits access to what a role requires. Least privilege limits rights to the minimum needed. Separation of duties prevents one person from controlling a whole sensitive process. Two-person control (or dual control) requires two people to act together. Job rotation and mandatory vacations detect fraud by forcing another person into the role. Privileged account management adds monitoring, approval, and session recording for admin accounts. Service level agreements define expectations for availability and response with third parties.

Patch and vulnerability management (7.8)

The exam wants the lifecycle: identify (scan and monitor advisories), evaluate and prioritize (CVSS plus asset criticality plus exploitability), test in a non-production environment, deploy through change management, verify with a rescan, and document. It also expects you to know that unpatched known vulnerabilities are the leading avenue of compromise and that risk acceptance for an unpatchable system requires documented compensating controls. In DoD terms: IAVM compliance, ACAS rescans to close POA&M items, and CAT I remediation timelines. The exam does not care about IAVA numbers but it does care that you verify remediation rather than assuming the patch job succeeded.

Business continuity and disaster recovery: BIA, RTO, RPO, and the test types

Objectives 7.10 through 7.13 are heavily tested and full of terms that are easy to confuse under pressure. The essentials:

• Business impact analysis (BIA) identifies critical business functions and the impact of losing them over time. It produces the recovery priorities. Everything else in BCP follows from the BIA.
• RTO (recovery time objective): how long the function can be down before unacceptable impact. RPO (recovery point objective): how much data loss, measured in time, is tolerable; it drives backup frequency. MTD (maximum tolerable downtime): the outer limit; RTO must be shorter than MTD. WRT (work recovery time): time to verify and resume after systems are back.
• Site types: hot (ready in hours, most expensive), warm (hardware in place, data restored on activation), cold (space and power, days to weeks), plus mobile sites, cloud recovery, and reciprocal agreements.
• Backup strategies: full, incremental (changes since the last backup of any type, fastest to write, slowest to restore), differential (changes since the last full, the reverse trade-off). Electronic vaulting, remote journaling, and database shadowing for continuous protection.
• Test types, ordered by disruption: read-through/checklist, structured walk-through (tabletop), simulation, parallel test, full interruption. The exam frequently asks which test is appropriate for a given constraint.

The DoD equivalents are the contingency plan (CP-2), the BIA that should sit behind it, the CP-4 exercise requirement, and the Component COOP program. If your CP-4 evidence is a tabletop every year, the exam would call that a structured walk-through, and it would also point out that you have never tested whether recovery actually works. Which the SCA may point out too.

Physical security and personnel safety (7.14, 7.15)

The tail of Domain 7 covers perimeter and facility controls (fences, lighting, CCTV, mantraps, guards, badge systems), environmental controls (HVAC, fire detection and suppression classes, water detection), and personnel safety (duress codes, travel security, emergency management). Know that human safety is always the first priority in any scenario, above data, above equipment. If a question offers a choice between protecting people and protecting the server room, the people win every time, and the exam is testing whether you will hesitate.

How Domain 7 connects to Domains 3 and 4

Several Domain 7 topics rest on architecture you covered earlier. Resilience and redundancy strategies in 7.10 draw on the high-availability design concepts from Domain 3 (Security Architecture and Engineering). Network monitoring, IDS and IPS placement, and egress filtering in 7.2 assume you understand the segmentation and protocol material from Domain 4 (Communication and Network Security).

Studying Domain 7 as a DoD practitioner

• Write the seven-step incident lifecycle, the five DR test types, and the RTO/RPO/MTD/WRT definitions from memory until you can do it without thinking. These are the points the domain hands you.
• For every scenario question you miss, ask whether you answered as the analyst or as the manager. Domain 7 is where the “think like a manager” advice earns its keep.
• Map your own system’s CP, IR, and CM plans to the exam vocabulary. Translating your evidence into ISC2 terms is the best retention exercise there is.
• Do not skip physical security because it feels beneath you. It is on the test and the questions are easy if you read the chapter once.

When the vocabulary is solid, test it against a timed Domain 7 set in the CISSP Command Center and watch for the questions where you reached for the technical fix; those are the ones telling you the manager mindset has not fully taken hold yet.