CISSP Domain 7: Security Operations
A full tour of Domain 7 of the CISSP exam - Security Operations - worth 13% of the exam under ISC2's exam outline effective 15 April 2024, tied with three other domains for the largest single weighting, and the domain that absorbed three whole domains from the old, ten-domain CBK when ISC2 restructured it in April 2015.
This video works through every one of Domain 7's fifteen sub-domains in order: investigations (chain of custody, order of volatility, and the four kinds of investigation an organisation might be building evidence for); logging and monitoring (IDS/IPS, SIEM correlation, continuous monitoring and tuning, egress monitoring, log management, threat intelligence and hunting, and UEBA); configuration management (provisioning, baselining, automation); foundational concepts (need-to-know, least privilege, separation of duties, privileged account management, job rotation, service-level agreements); resource protection (media management and protection, data at rest and in transit, and NIST's three media-sanitisation levels); incident management (NIST's four-phase lifecycle and ISC2's seven named activities); detective and preventive measures (firewalls, IDS/IPS, allow/deny lists, third-party security services, sandboxing, honeypots/honeynets, anti-malware, and machine-learning detection); patch and vulnerability management; change management and the change advisory board; recovery strategies (backup storage, hot/warm/cold recovery sites, multiple processing sites, resilience, high availability, quality of service, fault tolerance); disaster recovery processes; testing disaster recovery plans (tabletop through full-interruption testing); business continuity operations; physical security operations (perimeter and internal controls); and personnel safety and security (travel security, insider-threat and social-media-impact training, two-factor authentication fatigue, emergency management, and duress procedures).
It closes with a full recap, fifteen exam-style questions with their answers explained, and how Domain 7 connects to the other seven CISSP domains.
Every figure is on screen with its source and date.
Educational documentary. Not financial or investment advice.
In these topics
Chapters
- Domain 7: Learning Objectives and Exam Weighting
- Investigations
- Logging and Monitoring
- Configuration Management
- Foundational Operations Concepts
- Resource Protection
- Incident Management
- Detective and Preventive Measures
- Patch and Vulnerability Management
- Change Management
- Recovery Strategies
- Disaster Recovery Processes
- Testing Disaster Recovery Plans
- Business Continuity Operations
- Physical Security Operations
- Personnel Safety and Security
- Recap of Domain 7
- Review Questions, Part One
- Review Questions, Part Two, and Domain Links
Sources and credits
Photo credits (Wikimedia Commons)
- US Army CID special agents at a NATO military police crime investigation forum - real investigators handling a criminal case, 2013: U.S. Army Army-CID by Thomas B. Hamilton III, Public domain - https://commons.wikimedia.org/wiki/File%3AArmy_CID_Special_Agents_Attend_NATO_Military_Police_Crime_Investigation_Forum_%288236192%29.jpg
- NSA National Security Operations Center, photographed in 2001 with Gen. Michael Hayden - a real security operations/monitoring centre: Daderot, CC0 - https://commons.wikimedia.org/wiki/File%3ANational_Security_Operations_Center_photograph%2C_2001%2C_with_Gen._Michael_Hayden_-_National_Cryptologic_Museum_-_DSC07662.JPG
- Gas fire-suppression system discharging in a real computer/server room - resource and media protection in practice: Keith4048, Public domain - https://commons.wikimedia.org/wiki/File%3ACOMPUTER_ROOM_DISCHARGE.JPG
- FEMA operations command centre, Weslaco, Texas - a real incident-management command centre, interior: Patsy Lynch, Public domain - https://commons.wikimedia.org/wiki/File%3AFEMA_-_37322_-_Texas_operations_command_center_in_Weslaco%2C_interior.jpg
- FEMA Disaster Recovery Center, Texas - a real disaster-recovery operations site: Greg Henshall, Public domain - https://commons.wikimedia.org/wiki/File%3AFEMA_-_39057_-_Disaster_Recovery_Center_in_Texas.jpg
- US Army Garrison Okinawa leaders taking part in gate security operations - real perimeter/access-control security: U.S. Army USAG-O by Kazue Hayakawa, Public domain - https://commons.wikimedia.org/wiki/File%3AUSAG_Okinawa_leaders_participate_in_gate_security_operations_%289936241%29.jpg
Primary sources
- ISC2, 'CISSP Certification Exam Outline', effective 15 April 2024 (isc2.org) - fetched directly 11 October 2026 - Domain 7 weighted 13%; pass mark 700/1000; the exact topic list for sub-domains 7.1 through 7.15.
- ISC2, 'Changes to CISSP Exam Weighting' (isc2.org/Insights/2023/11), announced November 2023 - Domain 7 held steady at 13% through the 2024 reweighting.
- cm-alliance.com, 'Comparison of the old and new CISSP syllabus', April 2016 - the April 2015 CBK restructure from ten domains to eight; Operations Security, the recovery half of BCP/DRP, and the operational half of Physical Security folded into today's Domain 7.
- NIST SP 800-86, 'Guide to Integrating Forensic Techniques into Incident Response', August 2006, and IETF RFC 3227, 'Guidelines for Evidence Collection and Archiving', February 2002 - order of volatility.
- NIST SP 800-61 Rev. 2, 'Computer Security Incident Handling Guide', August 2012 - the four-phase incident response lifecycle.
- NIST SP 800-92, 'Guide to Computer Security Log Management', September 2006 - SIEM correlation and log management.
- NIST SP 800-137, 'Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations', September 2011.
- NIST SP 800-128, 'Guide for Security-Focused Configuration Management of Information Systems', August 2011, updated 10 October 2019.
- NIST SP 800-88 Rev. 2, 'Guidelines for Media Sanitization', finalised 26 September 2025 (csrc.nist.gov/pubs/sp/800/88/r2/final), superseding Revision 1 (December 2014). Re-checked by web search 11 October 2026.
- NIST SP 800-40 Rev. 4, 'Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology', April 2022, superseding Revision 3 (2013).
- NIST SP 800-34 Rev. 1, 'Contingency Planning Guide for Federal Information Systems', May 2010 - recovery site types, the disaster recovery process, and the standard DR test types.
Not regulated financial advice.