Domain 7 Master Cheat Sheet

Security Operations Fundamentals (13%)

Why Domain 7 Matters

Domain 7 is where cybersecurity becomes operational.

Security architecture, policies, access controls, and assessments have little value unless they are effectively operated, monitored, maintained, and improved.

A mature Security Operations program ensures that:

• Security controls remain effective.

• Threats are detected quickly.

• Incidents are handled consistently.

• Critical business services remain available.

• Organizational resilience improves over time.

The CISSP Manager's Mindset

The CISSP exam expects you to think like a Security Manager, CISO, or Risk Executive, not a system administrator.

When answering Domain 7 questions, always ask:

• Does this reduce organizational risk?

• Is business continuity maintained?

• Is the process documented?

• Does the solution support governance?

• Is the response proportional to the risk?

• Is there evidence for management decisions?

Never choose the answer that is merely the most technical.

Domain 7 Overview

Domain 7 consists of several interconnected operational disciplines.

Security Operations

Security Operations refers to the continuous activities required to protect organizational assets.

These include:

• Monitoring

• Detection

• Response

• Recovery

• Maintenance

• Reporting

• Improvement

Unlike projects,

Security Operations never ends.

Security Operations Objectives

A mature operational security program aims to:

✔ Maintain Confidentiality

✔ Maintain Integrity

✔ Maintain Availability

✔ Detect attacks rapidly

✔ Minimize business disruption

✔ Support regulatory compliance

✔ Reduce operational risk

✔ Improve resilience

Operational Security Principles

Effective security operations are built upon several fundamental principles.

Least Privilege

Users receive only the minimum permissions required to perform their job functions.

Benefits

• Reduces attack surface

• Limits insider threats

• Reduces privilege escalation

• Simplifies auditing

Example

A payroll clerk should not have domain administrator privileges.

Need-to-Know

Access is granted only when information is necessary to perform assigned responsibilities.

Example

A network administrator does not automatically require access to HR records.

Separation of Duties (SoD)

Critical responsibilities should be divided among multiple individuals.

Purpose

Prevent fraud and abuse.

Example

The same employee should not:

• Approve payments

• Process payments

• Audit payments

Dual Control

Two authorized individuals perform sensitive operations together.

Examples

• Nuclear launch procedures

• HSM key ceremonies

• Financial transfers

Split Knowledge

No single person possesses complete knowledge of sensitive information.

Example

Cryptographic key components distributed among multiple custodians.

Job Rotation

Employees periodically change responsibilities.

Benefits

• Detects fraud

• Cross-trains personnel

• Reduces dependency

• Improves resilience

Mandatory Vacation

Employees are required to take uninterrupted leave.

Purpose

Fraud often becomes visible when the responsible individual is absent.

Commonly tested on the CISSP exam.

Privileged Access Management (PAM)

Privileged accounts present the highest operational risk.

Examples include:

• Domain Administrators

• Enterprise Administrators

• Database Administrators

• Cloud Root Accounts

• Service Accounts

PAM Objectives

• Secure privileged credentials

• Limit administrative access

• Monitor privileged sessions

• Record administrative activities

• Rotate passwords automatically

• Enforce MFA

Principle of Just-In-Time (JIT) Access

Administrative privileges are granted:

Only

When needed

For a limited duration.

Benefits

• Smaller attack surface

• Reduced credential theft

• Better accountability

Operational Resilience

Operational resilience is the organization's ability to continue delivering critical services despite disruptions.

Threats include:

• Cyberattacks

• Natural disasters

• Power failures

• Insider threats

• Hardware failures

• Supply chain disruptions

Characteristics of Resilient Organizations

• Redundant systems

• Tested recovery plans

• Continuous monitoring

• Incident response capability

• Strong governance

• Executive support

Security Operations Lifecycle

Plan
      ↓
Protect
      ↓
Monitor
      ↓
Detect
      ↓
Analyze
      ↓
Respond
      ↓
Recover
      ↓
Improve

This continuous cycle is one of the most important operational concepts in Domain 7.

Operational Procedures

Well-defined procedures ensure consistency.

Examples include:

• Incident response procedures

• Backup procedures

• Patch procedures

• Account provisioning

• Change approval

• Disaster recovery procedures

• Evidence handling

Good procedures are:

• Repeatable

• Documented

• Tested

• Reviewed

• Updated

Security Operations Center (SOC)

The SOC serves as the organization's operational cybersecurity command center.

Primary responsibilities include:

• Monitor alerts

• Investigate threats

• Respond to incidents

• Threat hunting

• Vulnerability monitoring

• Security reporting

• Escalation

SOC Objectives

Detect

Investigate

Contain

Recover

Improve

SOC Roles

Tier 1 Analyst

• Monitor alerts

• Initial triage

• Ticket creation

• Escalation

Tier 2 Analyst

• Investigation

• Malware analysis

• Incident response

• Containment

Tier 3 Analyst

• Threat hunting

• Advanced investigations

• Detection engineering

• Root cause analysis

SOC Manager

• Operations oversight

• Metrics

• Staffing

• Executive reporting

• Process improvement

Operational Documentation

Good documentation is essential.

Examples

• Standard Operating Procedures (SOPs)

• Playbooks

• Runbooks

• Network diagrams

• Asset inventories

• Incident reports

• Recovery procedures

Playbooks vs Runbooks

Configuration Management

Configuration management maintains secure and consistent systems.

Objectives

• Standardization

• Baseline enforcement

• Drift detection

• Compliance

• Change tracking

Secure Baselines

Every production system should have:

• Approved configuration

• Hardened settings

• Approved software

• Standard patch level

• Approved services

Examples

• CIS Benchmarks

• DISA STIGs

• Microsoft Security Baselines

Asset Management

Organizations cannot protect assets they do not know exist.

Maintain inventories of:

• Hardware

• Software

• Cloud resources

• Mobile devices

• Service accounts

• Data repositories

Operational Security Metrics

Examples include:

• Mean Time to Detect (MTTD)

• Mean Time to Respond (MTTR)

• Patch compliance rate

• Backup success rate

• Critical vulnerability count

• Incident closure time

• False positive rate

• Security awareness completion

Good metrics should be:

• Measurable

• Actionable

• Repeatable

• Business focused

Human Factors in Security Operations

People remain one of the largest operational risks.

Operational programs should address:

• Security awareness

• Insider threats

• Social engineering

• Privilege misuse

• Human error

• Fatigue

• Staffing shortages

Security Culture

A mature security culture promotes:

• Accountability

• Reporting without fear

• Continuous learning

• Executive support

• Policy compliance

• Shared responsibility

Security is everyone's responsibility—not just the security team's.

Operational Best Practices

✔ Follow the principle of least privilege.

✔ Enforce separation of duties.

✔ Protect privileged accounts with PAM and MFA.

✔ Maintain accurate asset inventories.

✔ Continuously monitor security controls.

✔ Test operational procedures regularly.

✔ Keep documentation current.

✔ Measure operational performance with meaningful metrics.

✔ Learn from every incident.

✔ Continuously improve.

Common CISSP Exam Traps

Trap 1

Security Operations equals Incident Response.

Incorrect.

Incident Response is only one component of Security Operations.

Trap 2

More administrators improve security.

Incorrect.

Excessive privilege increases organizational risk.

Trap 3

Mandatory vacation is an HR policy only.

Incorrect.

It is also a valuable fraud detection control.

Trap 4

Least Privilege and Need-to-Know are identical.

Incorrect.

Least Privilege limits permissions.

Need-to-Know limits information access.

Trap 5

Playbooks and Runbooks are interchangeable.

Incorrect.

Playbooks guide decisions; runbooks document detailed execution steps.

Manager's Decision Framework

Before implementing any operational control, ask:

1. Does it reduce business risk?

2. Does it improve resilience?

3. Is it documented?

4. Is it repeatable?

5. Can it be measured?

6. Does it support business continuity?

7. Can it be audited?

Domain 7 Memory Sheet

Least Privilege

• Minimum permissions

Need-to-Know

• Minimum information

Separation of Duties

• Divide responsibilities

Dual Control

• Two people required

Split Knowledge

• No single person knows everything

Mandatory Vacation

• Detect fraud

Job Rotation

• Cross-training and fraud detection

PAM

• Protect privileged accounts

SOC

• Monitor, Detect, Respond

Playbook

• Decision guidance

Runbook

• Step-by-step tasks

Configuration Management

• Maintain secure baselines

CISSP Exam Tips

• Security Operations is continuous—it is not a one-time project.

• Least privilege and separation of duties are foundational operational controls and appear frequently in CISSP questions.

• Privileged accounts require enhanced protection, including MFA, monitoring, session recording, and just-in-time access where possible.

• Documentation is a control. Well-maintained procedures, playbooks, and runbooks improve consistency, auditability, and incident response.

• Think beyond technology. Successful security operations depend equally on people, processes, governance, and continuous improvement.

Quick Knowledge Check

1. Why is Domain 7 considered an operational domain rather than a technical domain?

2. How does least privilege differ from need-to-know?

3. Why are mandatory vacations an effective security control?

4. What is the purpose of Privileged Access Management (PAM)?

5. How does separation of duties reduce organizational risk?

6. What distinguishes a playbook from a runbook?

7. Why are secure configuration baselines important?

8. What characteristics make a security metric valuable?

9. What are the primary responsibilities of a Security Operations Center (SOC)?

10. Why is operational resilience a key objective for executive leadership?

Key Takeaways

• Security Operations is the continuous practice of protecting organizational assets through monitoring, maintenance, governance, and improvement.

• Operational controls—such as least privilege, separation of duties, job rotation, mandatory vacation, and PAM—reduce fraud, misuse, and insider risk.

• A mature SOC provides centralized monitoring, investigation, escalation, and operational visibility across the enterprise.

• Documentation, configuration management, and meaningful metrics are essential for consistent and auditable security operations.

• The CISSP manager's mindset focuses on reducing business risk, maintaining resilience, and ensuring that operational security supports organizational objectives rather than simply deploying technical controls.

Incident Response, Digital Forensics & Disaster Recovery

Why Incident Response Matters

No organization can prevent every cyberattack.

The objective is to:

• Detect attacks quickly

• Minimize business impact

• Preserve evidence

• Recover operations rapidly

• Prevent recurrence

A mature Incident Response (IR) capability significantly reduces financial loss, operational downtime, and reputational damage.

What is a Security Incident?

A security event becomes an incident when it threatens the Confidentiality, Integrity, or Availability (CIA) of information or systems.

Examples of Security Incidents

• Ransomware infection

• Data breach

• Unauthorized access

• Malware outbreak

• Insider threat

• Privilege escalation

• Denial-of-Service (DoS)

• Business Email Compromise (BEC)

• Cloud account compromise

Security Event vs Security Incident

Incident Response Goals

A successful IR program should:

✔ Minimize business disruption

✔ Protect organizational assets

✔ Preserve evidence

✔ Reduce recovery time

✔ Meet legal obligations

✔ Improve future defenses

NIST Incident Response Lifecycle

The CISSP exam closely aligns with the NIST framework.

Preparation
      ↓
Detection & Analysis
      ↓
Containment
      ↓
Eradication
      ↓
Recovery
      ↓
Lessons Learned

This lifecycle is one of the highest-value concepts in Domain 7.

Phase 1 – Preparation

Preparation determines how effectively an organization responds.

Activities

• Incident Response Plan

• Incident Response Team

• Communication procedures

• Contact lists

• Playbooks

• Runbooks

• Security tools

• SIEM

• EDR

• SOAR

• Backups

• Cyber insurance

• Training

• Tabletop exercises

Organizations that prepare well recover significantly faster.

Incident Response Team (IRT)

The Incident Response Team may include:

• Security Analysts

• SOC Analysts

• Incident Commander

• System Administrators

• Network Engineers

• Legal Counsel

• HR

• Public Relations

• Executive Management

Large organizations often designate an Incident Commander to coordinate technical, legal, and business activities.

Phase 2 – Detection & Analysis

Objectives

• Confirm the incident

• Determine scope

• Assess impact

• Classify severity

• Prioritize response

Sources of Detection

• SIEM alerts

• IDS/IPS

• EDR/XDR

• User reports

• Threat intelligence

• Antivirus

• Firewall logs

• Cloud monitoring

• UEBA

• Threat hunting

Incident Classification

Common severity levels:

Critical

High

Medium

Low

Classification considers:

• Business impact

• Data sensitivity

• Systems affected

• Regulatory implications

• Recovery complexity

Phase 3 – Containment

Containment limits further damage.

Short-Term Containment

Examples

• Isolate infected systems

• Disable compromised accounts

• Block malicious IP addresses

• Disconnect affected servers

• Disable vulnerable services

Long-Term Containment

Examples

• Temporary network segmentation

• Rebuild systems

• Enhanced monitoring

• Patch vulnerable systems

Phase 4 – Eradication

Objectives

Remove the root cause.

Examples

• Remove malware

• Patch vulnerabilities

• Reset passwords

• Delete malicious accounts

• Reimage compromised systems

• Remove persistence mechanisms

Do not proceed to recovery until eradication is complete.

Phase 5 – Recovery

Recovery restores normal business operations.

Activities include:

• Restore from backups

• Validate system integrity

• Resume services

• Increase monitoring

• Confirm security controls

• Obtain management approval

Recovery should be controlled, not rushed.

Phase 6 – Lessons Learned

Often neglected—but heavily emphasized in CISSP.

Discuss:

• What happened?

• Why did it happen?

• What worked?

• What failed?

• How can processes improve?

• What policies require revision?

Update:

• Playbooks

• Procedures

• Detection rules

• Security awareness

• Risk assessments

Incident Response Documentation

Every incident should produce:

• Executive summary

• Timeline

• Scope

• Systems affected

• Root cause

• Evidence collected

• Actions taken

• Business impact

• Recommendations

Good documentation supports audits, litigation, and continuous improvement.

Incident Prioritization

Consider:

• Critical business systems

• Customer impact

• Regulatory reporting

• Financial impact

• Reputation

• Operational disruption

Business impact—not technical complexity—drives prioritization.

Escalation Procedures

Escalate incidents when they involve:

• Executive leadership

• Legal obligations

• Law enforcement

• Regulatory reporting

• Public disclosure

• Third-party notification

Clear escalation paths reduce confusion during high-pressure situations.

Digital Forensics

Digital forensics involves collecting, preserving, analyzing, and presenting digital evidence.

Objectives

• Determine what happened

• Identify attackers

• Preserve evidence

• Support legal proceedings

• Improve security controls

Forensic Process

Identification
      ↓
Collection
      ↓
Preservation
      ↓
Examination
      ↓
Analysis
      ↓
Reporting

Order of Volatility

Collect the most volatile evidence first.

Typical order:

1. CPU registers

2. Memory (RAM)

3. Running processes

4. Network connections

5. Temporary files

6. Disk storage

7. Backups

8. Archived media

Memory contents disappear when a system powers off.

Chain of Custody

Documents the handling of evidence from collection through presentation.

Includes:

• Who collected it

• Date/time

• Location

• Transfers

• Storage

• Integrity verification

Maintaining chain of custody preserves evidentiary value.

Forensic Imaging

Always analyze a forensic copy, not the original media.

Advantages

• Preserves original evidence

• Supports repeatable analysis

• Prevents accidental modification

Evidence Types

Volatile

• RAM

• Active network connections

• Running processes

Non-Volatile

• Hard drives

• SSDs

• USB devices

• Logs

• Cloud storage

Disaster Recovery (DR)

Disaster Recovery focuses on restoring IT services after a disruption.

Typical disasters include:

• Cyberattacks

• Fire

• Flood

• Power outage

• Hardware failure

• Cloud outage

Disaster Recovery Objectives

Restore:

• Systems

• Applications

• Data

• Network connectivity

• Business services

As quickly and safely as possible.

Recovery Metrics

Recovery Time Objective (RTO)

Maximum acceptable downtime.

Example

Critical payroll system:

RTO = 4 hours

Recovery Point Objective (RPO)

Maximum acceptable data loss.

Example

RPO = 15 minutes

Backups must support this objective.

Mean Time Metrics

MTTD

Detect incident.

MTTR

Respond or Recover.

MTTC

Contain incident.

Executives frequently monitor these metrics.

Crisis Management

A crisis extends beyond technology.

It may involve:

• Executive leadership

• Legal counsel

• Media

• Customers

• Regulators

• Law enforcement

Good communication is essential.

Communication During Incidents

Communicate:

• Internally

• Externally

• Consistently

• Factually

Avoid speculation.

Only authorized spokespersons should communicate with the media.

Business Continuity vs Disaster Recovery

Remember:

Business Continuity is broader than Disaster Recovery.

Common CISSP Exam Traps

Trap 1

Immediately power off compromised systems.

Incorrect.

Consider preserving volatile evidence first.

Trap 2

Containment equals eradication.

Incorrect.

Containment limits damage.

Eradication removes the root cause.

Trap 3

Recovery starts immediately after containment.

Incorrect.

Eradication should occur first.

Trap 4

Disaster Recovery and Business Continuity are identical.

Incorrect.

BC ensures business operations; DR restores technology.

Trap 5

Technical recovery ends the incident.

Incorrect.

Lessons learned complete the incident lifecycle.

Manager's Decision Framework

When responding to an incident, ask:

1. What is the business impact?

2. Has the incident been confirmed?

3. What evidence must be preserved?

4. How can damage be contained?

5. What is the safest recovery approach?

6. What stakeholders must be informed?

7. What improvements should be implemented afterward?

Domain 7 Memory Sheet

Incident Response

• Prepare

• Detect

• Contain

• Eradicate

• Recover

• Learn

Containment

• Stop the spread

Eradication

• Remove the cause

Recovery

• Restore operations

Lessons Learned

• Improve processes

RTO

• Maximum downtime

RPO

• Maximum data loss

Chain of Custody

• Preserve evidence

Forensic Imaging

• Analyze copies, not originals

Order of Volatility

• RAM before disk

CISSP Exam Tips

• Preparation is the most important phase because it enables every subsequent response activity.

• Containment limits damage; eradication removes the threat; recovery restores business operations.

• Always consider evidence preservation before taking destructive actions.

• Business impact drives incident prioritization and executive decision-making.

• Every incident should conclude with lessons learned to strengthen future resilience.

Quick Knowledge Check

1. What distinguishes a security event from a security incident?

2. Why is preparation considered the most important phase of incident response?

3. What is the difference between containment and eradication?

4. Why is the order of volatility important during forensic investigations?

5. What information should be documented in the chain of custody?

6. How do RTO and RPO influence disaster recovery planning?

7. Why should organizations analyze forensic copies instead of original evidence?

8. When should incidents be escalated to executive leadership or legal counsel?

9. How does Business Continuity differ from Disaster Recovery?

10. Why are lessons learned essential to a mature incident response program?

Key Takeaways

• Incident Response is a structured lifecycle that minimizes business impact while preserving evidence and restoring operations.

• Preparation, documentation, and communication are just as important as technical response activities.

• Digital forensics provides defensible evidence and supports root cause analysis, legal proceedings, and future improvements.

• Disaster Recovery focuses on restoring IT capabilities, while Business Continuity ensures the organization can continue delivering critical business services.

• The CISSP manager's mindset prioritizes business resilience, risk reduction, and evidence-based decision-making throughout every stage of the incident lifecycle.

Security Monitoring, Logging, Change Management & Operational Security

Why Continuous Monitoring Matters

Organizations are under constant attack.

Annual audits and quarterly assessments are no longer sufficient.

Continuous monitoring enables organizations to:

• Detect attacks quickly

• Reduce dwell time

• Improve incident response

• Maintain compliance

• Verify security controls

• Improve operational resilience

Security Monitoring Objectives

An effective monitoring program should:

✔ Detect unauthorized activity

✔ Identify system failures

✔ Monitor privileged users

✔ Detect insider threats

✔ Validate security controls

✔ Support incident response

✔ Provide forensic evidence

✔ Support executive decision-making

Security Monitoring Lifecycle

Collect
      ↓
Normalize
      ↓
Correlate
      ↓
Analyze
      ↓
Alert
      ↓
Investigate
      ↓
Respond
      ↓
Recover
      ↓
Improve Detection

Unlike vulnerability assessments, monitoring never stops.

Security Information and Event Management (SIEM)

SIEM centralizes security monitoring.

Primary functions include:

• Log collection

• Event normalization

• Event correlation

• Alert generation

• Dashboard reporting

• Compliance reporting

• Threat detection

SIEM Workflow

Log Collection
      ↓
Normalization
      ↓
Correlation
      ↓
Threat Detection
      ↓
Alert Generation
      ↓
Analyst Investigation

Common SIEM Data Sources

Network

• Firewalls

• Routers

• Switches

• VPN

Operating Systems

• Windows Event Logs

• Linux Syslog

• Authentication Logs

Security Tools

• IDS

• IPS

• EDR

• Antivirus

• DLP

• IAM

Cloud

• AWS CloudTrail

• Azure Activity Logs

• Google Cloud Logs

• Microsoft 365

Applications

• Web Servers

• Databases

• ERP

• CRM

• Email Systems

Security Orchestration, Automation & Response (SOAR)

SOAR automates repetitive security tasks.

Examples

• Alert enrichment

• Threat intelligence lookup

• Ticket creation

• User notification

• Host isolation

• Malware quarantine

• Password reset

SIEM vs SOAR

Exam Tip

SIEM identifies problems.

SOAR accelerates response.

Endpoint Detection & Response (EDR)

EDR continuously monitors endpoints.

Capabilities include:

• Process monitoring

• Behavioral analysis

• Malware detection

• Memory analysis

• File integrity monitoring

• Endpoint isolation

• Rollback

Extended Detection & Response (XDR)

XDR extends detection across:

• Endpoints

• Network

• Email

• Cloud

• Identity

• Applications

Advantages

• Better visibility

• Faster investigations

• Unified analytics

User and Entity Behavior Analytics (UEBA)

UEBA detects abnormal behavior.

Examples

• Impossible travel

• Midnight administrator activity

• Excessive downloads

• Privilege abuse

• Insider threats

Rather than signatures,

UEBA focuses on behavioral anomalies.

Security Dashboards

Executives require concise operational visibility.

Good dashboards display:

• Incident trends

• Patch compliance

• Vulnerability backlog

• MTTD

• MTTR

• Failed logins

• Phishing success rate

• Risk score

• Compliance status

Avoid overwhelming executives with raw technical data.

Security Logging

Logs provide evidence.

Without logs:

• Detection suffers

• Investigations become difficult

• Compliance weakens

• Forensics becomes unreliable

Essential Log Elements

Each log should include:

• Timestamp

• User

• Source IP

• Destination

• Event type

• Severity

• Outcome

• Device

• Session ID

Time Synchronization

Critical for investigations.

Organizations should synchronize clocks using:

• NTP

• Secure NTP

• Authenticated time services

Unsynchronized logs create inaccurate timelines.

Log Retention

Retention depends upon:

• Regulations

• Business needs

• Legal requirements

• Storage capacity

Examples

• PCI DSS

• HIPAA

• SOX

• Organizational policies

Change Management

One of the most tested operational topics.

Unauthorized changes create significant risk.

Objectives of Change Management

• Reduce outages

• Reduce security risks

• Maintain availability

• Improve documentation

• Improve accountability

Change Management Process

Request
      ↓
Risk Assessment
      ↓
Approval
      ↓
Testing
      ↓
Implementation
      ↓
Validation
      ↓
Documentation
      ↓
Review

Types of Changes

Standard Change

Low risk.

Pre-approved.

Example

Routine operating system patch.

Normal Change

Requires formal approval.

Example

Firewall rule modification.

Emergency Change

Immediate implementation.

Example

Critical zero-day vulnerability.

Emergency changes should still be documented afterward.

Configuration Management

Configuration management maintains secure baselines.

Objectives

• Standardization

• Drift detection

• Compliance

• Security

Configuration Baselines

Examples

• CIS Benchmarks

• DISA STIG

• Microsoft Baselines

Systems should be continuously compared against approved baselines.

Configuration Drift

Occurs when systems deviate from approved configurations.

Common causes

• Unauthorized changes

• Emergency fixes

• Human error

• Software updates

Configuration drift increases operational risk.

Patch Management

Patching reduces known vulnerabilities.

Typical lifecycle

Identify
      ↓
Test
      ↓
Approve
      ↓
Deploy
      ↓
Verify
      ↓
Document

Patch Prioritization

Priority depends on:

• Business impact

• Asset criticality

• Internet exposure

• Active exploitation

• Compliance requirements

Business risk—not patch count—determines priority.

Vulnerability Management

Operational vulnerability management is continuous.

Lifecycle

Discover
      ↓
Assess
      ↓
Prioritize
      ↓
Remediate
      ↓
Validate
      ↓
Monitor

Threat Intelligence

Threat intelligence improves operational decisions.

Sources

• Government advisories

• Vendor intelligence

• ISACs

• Commercial feeds

• Open-source intelligence

Threat Hunting

Threat hunting proactively searches for hidden attackers.

Unlike monitoring,

Threat hunting assumes compromise may already exist.

Typical process

Hypothesis
      ↓
Collect Data
      ↓
Analyze
      ↓
Investigate
      ↓
Contain
      ↓
Improve Detection

Operational Metrics

Examples

MTTD

Mean Time to Detect

MTTR

Mean Time to Respond

MTTC

Mean Time to Contain

Patch Compliance

Percentage of systems meeting patch policy.

False Positive Rate

Lower is better.

Backup Success Rate

Measures operational reliability.

Operational Reporting

Different audiences require different reports.

Executives

• Business risk

• Trends

• KPIs

• KRIs

• Budget impact

Technical Teams

• Vulnerabilities

• Detection rules

• Logs

• Alerts

• Root cause

Auditors

• Evidence

• Compliance

• Policies

• Procedures

Operational Best Practices

✔ Centralize logging

✔ Synchronize system clocks

✔ Protect log integrity

✔ Monitor privileged accounts

✔ Automate repetitive tasks

✔ Continuously validate baselines

✔ Test changes before production

✔ Measure operational performance

✔ Review alerts regularly

✔ Continuously improve

Common CISSP Exam Traps

Trap 1

SIEM blocks attacks.

Incorrect.

SIEM detects and correlates.

Trap 2

SOAR replaces analysts.

Incorrect.

Automation supports analysts.

Trap 3

Every alert is an incident.

Incorrect.

Analysts validate alerts before escalation.

Trap 4

Emergency changes require no documentation.

Incorrect.

Documentation is completed immediately after implementation.

Trap 5

More logs always improve security.

Incorrect.

Collect meaningful logs that support detection, investigations, and compliance.

Trap 6

Patch every vulnerability immediately.

Incorrect.

Prioritize based on business risk and operational impact.

Manager's Decision Framework

Ask:

1. Can we detect attacks quickly?

2. Are we monitoring the right assets?

3. Are changes controlled?

4. Are privileged accounts protected?

5. Are operational metrics improving?

6. Are alerts actionable?

7. Does monitoring support business objectives?

Domain 7 Memory Sheet

SIEM

• Collect

• Correlate

• Detect

SOAR

• Automate

• Respond

EDR

• Endpoint protection

XDR

• Enterprise-wide visibility

UEBA

• Behavior analytics

Configuration Drift

• Baseline deviation

Patch Management

• Identify → Test → Deploy → Verify

Change Management

• Request → Approve → Test → Implement

Threat Hunting

• Proactive investigation

Continuous Monitoring

• Never stops

CISSP Exam Tips

• Continuous monitoring is a core operational responsibility and supports rapid detection, compliance, and resilience.

• SIEM, SOAR, EDR, XDR, and UEBA are complementary technologies—understand each tool's role rather than viewing them as interchangeable.

• Effective change management reduces both security risk and operational outages.

• Configuration baselines and drift detection are fundamental to maintaining a secure environment.

• Always prioritize operational decisions based on business impact, not technical volume.

Quick Knowledge Check

1. What is the primary purpose of a SIEM?

2. How does SOAR differ from SIEM?

3. Why is time synchronization essential for investigations?

4. What distinguishes EDR from XDR?

5. How does UEBA help detect insider threats?

6. Why is change management critical to operational security?

7. What causes configuration drift?

8. How should emergency changes be handled?

9. Why is patch prioritization risk-based rather than severity-based?

10. What operational metrics best reflect the effectiveness of a security program?

Key Takeaways

• Continuous monitoring provides real-time visibility into security posture and is a cornerstone of mature security operations.

• SIEM, SOAR, EDR, XDR, and UEBA work together to detect, investigate, automate, and respond to threats across the enterprise.

• Effective logging and time synchronization are essential for detection, investigations, compliance, and digital forensics.

• Change management, configuration management, and patch management ensure that operational changes strengthen rather than weaken security.

• The CISSP manager's mindset emphasizes controlled processes, measurable outcomes, business-driven prioritization, and continuous operational improvement rather than isolated technical fixes.

Business Continuity, Backup & Recovery, High Availability, Physical Security & Operational Resilience

Business Continuity Management (BCM)

Business Continuity ensures that critical business functions continue during and after a disruption.

Unlike Disaster Recovery, BCM focuses on the business, not just technology.

Objectives

• Protect people

• Continue essential business functions

• Minimize downtime

• Reduce financial losses

• Protect organizational reputation

• Meet legal and regulatory obligations

Business Continuity Lifecycle

Business Impact Analysis
          ↓
Risk Assessment
          ↓
Business Continuity Strategy
          ↓
Business Continuity Plan
          ↓
Training
          ↓
Testing
          ↓
Maintenance
          ↓
Continuous Improvement

Business Impact Analysis (BIA)

The BIA identifies:

• Critical business functions

• Dependencies

• Maximum acceptable downtime

• Financial impact

• Operational impact

• Regulatory impact

• Recovery priorities

A BIA answers:

Recovery Objectives

Recovery Time Objective (RTO)

Maximum acceptable downtime.

Example

Payroll System

RTO = 4 Hours

Recovery Point Objective (RPO)

Maximum acceptable data loss.

Example

RPO = 15 Minutes

Only 15 minutes of transactions may be lost.

Mean Time Between Failures (MTBF)

Measures reliability.

Higher MTBF = Better.

Mean Time To Repair (MTTR)

Measures repair speed.

Lower MTTR = Better.

Recovery Priorities

Organizations recover:

1. Human Safety

2. Critical Business Services

3. Critical Infrastructure

4. Supporting Services

5. Non-Critical Systems

Backup Fundamentals

Backups protect data against:

• Hardware failures

• Malware

• Ransomware

• Insider threats

• Accidental deletion

• Natural disasters

Backup Types

Full Backup

Copies everything.

Advantages

• Fast restore

• Simple recovery

Disadvantages

• Long backup time

• Large storage requirement

Incremental Backup

Copies only changes since the last backup.

Advantages

• Fast backup

• Small storage requirement

Disadvantages

• Slowest restore

Differential Backup

Copies changes since the last full backup.

Advantages

• Faster restore than incremental

• Moderate storage

Disadvantages

• Backup size grows over time

Backup Comparison

Backup Best Practices

✔ Encrypt backups

✔ Verify backup integrity

✔ Test restoration regularly

✔ Store off-site copies

✔ Protect backup credentials

✔ Maintain backup documentation

✔ Monitor backup success

✔ Follow the 3-2-1 Rule

The 3-2-1 Backup Rule

Maintain:

• 3 copies of data

• 2 different storage media

• 1 off-site or offline copy

Modern environments often extend this with immutable or air-gapped backups.

Offline & Immutable Backups

Increasingly important against ransomware.

Benefits

• Cannot be encrypted by attackers

• Protect recovery capability

• Improve resilience

Recovery Testing

Backups are useless if they cannot be restored.

Organizations should regularly test:

• Data restoration

• System restoration

• Application recovery

• Disaster recovery procedures

• Backup integrity

Disaster Recovery Sites

Cold Site

Contains:

• Facility

• Power

• Network

No equipment installed.

Advantages

• Lowest cost

Disadvantages

• Longest recovery

Warm Site

Contains

• Equipment

• Partial configuration

Requires restoration.

Moderate cost.

Moderate recovery.

Hot Site

Fully operational.

Advantages

• Fastest recovery

Disadvantages

• Highest cost

Site Comparison

High Availability (HA)

High Availability minimizes downtime.

Objectives

• Eliminate single points of failure

• Maintain continuous service

• Improve reliability

Redundancy

Redundancy duplicates critical components.

Examples

• Dual power supplies

• Multiple network links

• Redundant firewalls

• Backup generators

• Clustered servers

Fault Tolerance

Fault-tolerant systems continue operating even after component failure.

Examples

• RAID

• Server clustering

• Multiple data centers

Load Balancing

Load balancers distribute traffic across multiple systems.

Benefits

• Improved availability

• Better performance

• Scalability

• Fault tolerance

RAID

RAID improves availability and/or performance.

RAID 0

Striping

Advantages

• Performance

Disadvantages

• No redundancy

RAID 1

Mirroring

Advantages

• High availability

Disadvantages

• Higher storage cost

RAID 5

Striping with parity

Advantages

• Good balance

Disadvantages

• Slower writes

RAID 6

Double parity

Survives two disk failures.

RAID 10

Mirror + Stripe

Highest performance and redundancy.

Frequently tested.

Clustering

Clusters improve availability.

Examples

• Active-Active

• Active-Passive

Active-Active

Both nodes process requests.

Higher performance.

Active-Passive

Secondary node waits until failure.

Simpler management.

Geographic Redundancy

Organizations may deploy:

• Multiple regions

• Multiple availability zones

• Multiple cloud providers

Benefits

• Disaster resilience

• Business continuity

• Reduced regional risk

Physical Security Operations

Physical security protects:

• People

• Facilities

• Equipment

• Information

Physical Controls

Examples

• Guards

• CCTV

• Badge readers

• Biometric systems

• Fencing

• Bollards

• Lighting

• Visitor logs

• Mantraps

Environmental Controls

Protect against:

• Fire

• Flood

• Heat

• Humidity

• Power failures

Examples

• UPS

• HVAC

• Fire suppression

• Water detection

• Backup generators

Fire Suppression

Common systems

• Clean agent systems

• Inert gas

• Dry chemical

• Water sprinklers

Computer rooms generally avoid water when possible.

Visitor Management

Best practices

• Visitor badges

• Escort requirements

• Visitor logs

• Identity verification

• Badge expiration

Third-Party Operations

Organizations increasingly rely on vendors.

Operational responsibilities include

• Vendor assessments

• SLA monitoring

• Contract management

• Security reviews

• Compliance monitoring

Operational Resilience

Operational resilience combines:

• Business Continuity

• Disaster Recovery

• Incident Response

• High Availability

• Continuous Monitoring

Purpose

Maintain business services during disruptions.

Operational Best Practices

✔ Test recovery plans annually

✔ Verify backups regularly

✔ Eliminate single points of failure

✔ Protect backup infrastructure

✔ Encrypt backup media

✔ Review SLAs

✔ Maintain current documentation

✔ Regularly exercise Business Continuity Plans

✔ Monitor physical security controls

✔ Review vendor resilience

Common CISSP Exam Traps

Trap 1

Business Continuity equals Disaster Recovery.

Incorrect.

BC focuses on business.

DR focuses on IT.

Trap 2

Backups guarantee recovery.

Incorrect.

Restoration must be tested.

Trap 3

RAID replaces backups.

Incorrect.

RAID improves availability, not data protection.

Trap 4

Hot sites are always the best choice.

Incorrect.

The appropriate recovery site depends on business requirements, RTO, RPO, and cost.

Trap 5

High Availability prevents cyberattacks.

Incorrect.

HA improves availability but does not eliminate security threats.

Trap 6

Physical security is separate from cybersecurity.

Incorrect.

Physical compromise often leads to cybersecurity compromise.

Manager's Decision Framework

When selecting recovery or resilience strategies, ask:

1. Which business functions are most critical?

2. What are the RTO and RPO requirements?

3. What level of redundancy is justified?

4. What is the business impact of downtime?

5. Are backups regularly tested?

6. Does physical security adequately protect critical assets?

7. Are vendor dependencies understood and monitored?

Domain 7 Memory Sheet

Business Continuity

• Keep business running

Disaster Recovery

• Restore IT

BIA

• Identify critical business functions

RTO

• Maximum downtime

RPO

• Maximum data loss

Hot Site

• Fastest

• Most expensive

Cold Site

• Slowest

• Least expensive

RAID 0

• Performance

RAID 1

• Mirroring

RAID 5

• Parity

RAID 10

• Performance + Redundancy

3-2-1 Rule

• 3 Copies

• 2 Media

• 1 Off-site

Fault Tolerance

• Continue operating despite failures

CISSP Exam Tips

• Always prioritize human safety before technology recovery.

• Business Continuity decisions should be driven by Business Impact Analysis (BIA).

• RAID improves availability but is not a backup strategy.

• Regular backup restoration testing is just as important as creating backups.

• Recovery solutions should align with business requirements, not simply provide the highest level of technology.

Quick Knowledge Check

1. What is the primary difference between Business Continuity and Disaster Recovery?

2. Why is a Business Impact Analysis performed before developing recovery strategies?

3. How do RTO and RPO influence backup and recovery planning?

4. Why doesn't RAID replace backups?

5. What are the advantages of immutable backups?

6. When should an organization choose a hot site instead of a warm or cold site?

7. How does redundancy improve operational resilience?

8. Why is recovery testing essential?

9. What physical controls best protect a data center?

10. How do third-party vendors affect operational resilience?

Key Takeaways

• Business Continuity ensures critical business functions continue during disruptions, while Disaster Recovery restores IT services to support those functions.

• Recovery objectives (RTO and RPO) guide technology, backup, and recovery decisions based on business needs.

• High availability, redundancy, clustering, and RAID improve system resilience but must complement—not replace—effective backup strategies.

• Physical security and environmental controls are integral to operational security and often serve as the first line of defense.

• The CISSP manager's mindset emphasizes balancing resilience, availability, cost, and business impact to maintain organizational operations under adverse conditions.

Final Review • Exam Strategy • Decision Framework • CISSP Memory Sheet

Domain 7 in One Sentence

Domain 7 Operational Framework

Governance
      ↓
Security Operations
      ↓
Continuous Monitoring
      ↓
Threat Detection
      ↓
Incident Response
      ↓
Digital Forensics
      ↓
Disaster Recovery
      ↓
Business Continuity
      ↓
Lessons Learned
      ↓
Continuous Improvement

Top 100 Domain 7 CISSP Facts

Security Operations

✔ Security Operations is continuous.

✔ Security Operations supports CIA.

✔ Security Operations supports business objectives.

✔ Security Operations is risk driven.

✔ Monitoring never stops.

✔ Documentation is a security control.

✔ Metrics drive improvement.

✔ Automation supports—not replaces—analysts.

✔ Business impact determines priorities.

✔ Executive support is essential.

Operational Controls

Least Privilege

Minimum permissions.

Need-to-Know

Minimum information.

Separation of Duties

Separate critical responsibilities.

Dual Control

Two people perform sensitive tasks.

Split Knowledge

No one knows everything.

Mandatory Vacation

Helps detect fraud.

Job Rotation

Reduces insider risk.

PAM

Protect privileged accounts.

JIT Access

Temporary administrative privileges.

Incident Response

Preparation is the most important phase.

Containment limits damage.

Eradication removes the threat.

Recovery restores operations.

Lessons Learned improve future response.

Digital Forensics

Preserve evidence.

Analyze copies.

Maintain chain of custody.

Collect volatile evidence first.

Never modify original evidence.

Monitoring

SIEM collects and correlates.

SOAR automates.

EDR protects endpoints.

XDR expands visibility.

UEBA detects anomalies.

Threat Hunting is proactive.

SOC provides continuous monitoring.

Business Continuity

BC keeps business running.

DR restores IT.

BIA determines priorities.

RTO measures downtime.

RPO measures acceptable data loss.

Backup

3-2-1 Rule.

Immutable backups resist ransomware.

Backups must be tested.

RAID is not backup.

High Availability

Eliminate single points of failure.

Redundancy improves availability.

Load balancing improves resilience.

Clustering improves uptime.

Physical Security

Protect people first.

Environmental controls matter.

Visitor management matters.

Physical compromise often becomes cyber compromise.

High-Value Comparison Tables

Business Continuity vs Disaster Recovery

Event vs Incident

Containment vs Eradication

SIEM vs SOAR

EDR vs XDR

Hot vs Warm vs Cold Site

Full vs Differential vs Incremental Backup

Least Privilege vs Need-to-Know

Playbook vs Runbook

Monitoring vs Threat Hunting

CISSP Manager Decision Trees

A security incident occurs

Confirmed?

↓

Yes

↓