CISSP Domain 7 study guide
What Security Operations tests
Domain 7 turns policy and architecture into dependable daily operations. It tests incident handling, investigations, monitoring, change, vulnerability management, recovery, continuity, and the protection of people.
Domain 7 objectives
Use these official objective areas as a coverage checklist, then combine them in scenario practice.
Investigations
Support administrative, criminal, civil, regulatory, and industry investigations with appropriate evidence handling.
Logging and monitoring
Design monitoring, event management, threat intelligence, and continuous-control processes.
Configuration management
Maintain secure baselines, inventories, configuration control, and approved states.
Operational principles
Apply need-to-know, least privilege, separation of duties, job rotation, service levels, and capacity management.
Resource protection
Protect media, systems, assets, and supporting operational resources throughout use and disposition.
Incident management
Prepare, detect, analyze, contain, eradicate, recover, and learn from incidents.
Preventive measures
Operate firewalls, intrusion prevention, antimalware, allowlists, sandboxing, and related safeguards.
Vulnerability and patch management
Discover, prioritize, test, deploy, verify, and report remediation.
Change management
Assess, authorize, test, implement, document, and review changes.
Recovery strategies
Select resilient processing, storage, communications, facilities, and cloud recovery options.
Disaster recovery
Execute response, personnel, communications, assessment, restoration, and lessons-learned processes.
Test recovery plans
Use checklists, walkthroughs, simulations, parallel tests, and full interruption where appropriate.
Business continuity
Operate continuity plans and restore prioritized business services.
Personnel safety
Prioritize life safety, travel, duress, emergency management, and security concerns.
High-yield distinctions
Event
An observable occurrence in a system or network.
Incident
An event that threatens policy, operations, or security objectives and requires response.
RTO
Maximum targeted time to restore a service.
RPO
Maximum targeted data-loss interval measured backward from disruption.
Containment
Limits spread and damage while preserving response options.
Eradication
Removes the cause and affected artifacts after sufficient analysis.
Common exam trap
Life safety comes first. During incidents, follow the lifecycle and preserve evidence; do not jump straight to eradication or make an unauthorized change.
How to study Domain 7
Step 1: Learn incident and investigation lifecycles.
Step 2: Compare monitoring and preventive controls.
Step 3: Practice change, configuration, and patch decisions.
Step 4: Master RTO, RPO, and recovery options.
Step 5: Finish with safety and continuity scenarios.