Objective 7.1 · high
Investigations
Support evidence collection, handling, reporting, forensics, eDiscovery, and investigation requirements with appropriate authority.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s08
CISSP · D7 · 13%
Security Operations
Operate investigations, monitoring, configuration, change, incidents, vulnerability management, recovery, continuity, physical security, and personnel safety.
Provider facts checked 2026-08-03
Objective coverage
Objective 7.2 · high
Logging and monitoring
Design and operate logging, event management, threat intelligence, behavior analytics, ingress/egress monitoring, and continuous control monitoring.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s08
Objective 7.3 · normal
Configuration management
Establish baselines, inventories, hardening, versioning, drift control, approved exceptions, and configuration evidence.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s08
Objective 7.4 · foundation
Security operations concepts
Apply need-to-know, least privilege, separation, job rotation, service levels, privileged operations, and resource lifecycle controls.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s08
Objective 7.5 · normal
Resource protection
Protect media, systems, facilities, data, keys, credentials, hardware, and operational resources through their lifecycle.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s08
Objective 7.6 · high
Incident management
Prepare, detect, respond, mitigate, report, recover, remediate, learn, and coordinate communications for incidents.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s08
Objective 7.7 · normal
Detective and preventive measures
Operate firewalls, intrusion systems, whitelisting/blacklisting, sandboxing, antimalware, machine learning, and related controls.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s08
Objective 7.8 · high
Patch and vulnerability management
Discover, assess, prioritize, test, remediate, verify, accept, and monitor vulnerabilities and patches based on risk.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s08
Objective 7.9 · high
Change management
Assess, authorize, test, schedule, communicate, implement, validate, document, and roll back operational changes.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s08
Objective 7.10 · high
Recovery strategies
Select alternate sites, backups, resilience, restoration, communications, suppliers, and recovery approaches from business requirements.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s09
Objective 7.11 · high
Disaster recovery processes
Execute response, personnel, communications, assessment, restoration, salvage, failback, and return-to-normal activities.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s09
Objective 7.12 · high
Disaster recovery testing
Use tabletop, walkthrough, simulation, parallel, and full-interruption methods with safe objectives and corrective action.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s09
Objective 7.13 · high
Business continuity planning and exercises
Maintain business continuity plans, dependencies, alternate processes, communication, exercises, measures, and improvement.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s02
Objective 7.14 · normal
Physical security
Operate facility access, monitoring, environmental, visitor, asset, restricted-area, and emergency physical controls.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s09
Objective 7.15 · high
Personnel safety
Protect people through travel, lone-worker, duress, emergency, evacuation, communications, and safety procedures.
- Lesson
- d7-lesson
- Practice pool
- d7-questions
- Application
- cissp-s09
title: "Security Operations" summary: "Operational decisions for investigations, incident management, recovery, resilience, monitoring, and controlled change."
Operate with authority and evidence
Security operations joins logging, investigations, configuration, privileged work, resource protection, incidents, detection, vulnerability management, change, recovery, continuity, physical security, and personnel safety.
Prepare investigation authority and evidence handling before events. Build time-consistent logging, monitoring, intelligence, behavior, ingress/egress, and control-health visibility. Protect baselines, inventories, configuration, media, keys, credentials, systems, and facilities through their lifecycle.
Incident management prepares, detects, analyzes, contains, eradicates, recovers, communicates, reports, and improves. Preserve safety, evidence, reversibility, and business continuity. Vulnerability and patch management prioritizes exploitability, exposure, asset value, control context, testing, remediation, exceptions, verification, and monitoring. Change management authorizes, tests, schedules, communicates, implements, validates, documents, and rolls back.
Recovery strategy comes from business priorities and dependencies. Test backups, alternate sites, communications, personnel, suppliers, restoration, reconciliation, failback, and return to normal. Exercises produce corrective actions. During physical emergencies, personnel safety precedes asset protection.
Self-check
Order the first actions for a privileged-account incident during a regional facility emergency. Explain authority, safety, evidence, containment, communication, continuity, restoration, and lessons learned.