CISSP Domain 7 Guide: Security Operations

What Domain 7 covers

• Investigations, evidence handling, and forensics
• Incident response lifecycle
• Logging, monitoring, SIEM, and continuous monitoring
• Configuration, change and patch management
• Operational controls: separation of duties, job rotation, mandatory vacation, least privilege
• Backup strategies and recovery
• Disaster recovery sites, plans, and testing

Incident response, in order

1. Detect — identify that something has happened.
2. Respond — activate the process and the team.
3. Mitigate / contain — stop the spread. Contain before you eradicate.
4. Report — notify management and, where required, regulators.
5. Recover — restore normal service.
6. Remediate — remove the root cause.
7. Lessons learned — feed improvements back into the process.

Evidence and forensics

• Chain of custody — who had the evidence, when, and why. Break it and the evidence is worthless.
• Order of volatility — collect CPU registers and cache, then memory, then network state, then disk, then backups and archives.
• Work on copies. Image the drive and hash it; analyse the image, never the original.
• Evidence should be accurate, complete, authentic, convincing, and admissible.

Backups and recovery sites

Backup types: full captures everything; incremental captures changes since the last backup of any type and restores slowest; differential captures changes since the last full backup and restores faster but grows larger.

DR testing, weakest to strongest

1. Read-through / checklist
2. Structured walkthrough / tabletop
3. Simulation
4. Parallel test — recovery systems run alongside production
5. Full interruption — production is actually stopped; highest risk and highest assurance

Exam traps in Domain 7

• Mandatory vacation and job rotation are detective controls — they surface fraud that requires continuous presence.
• Separation of duties is preventive; dual control requires two people for a single action.
• Patching production without change management is wrong unless the scenario establishes an authorised emergency change process.
• A backup that has never been restored is not a backup. Testing is the control.

Frequently asked questions