CISSP Domain 7 Security Operations: SOC, IR & Forensics — SOC, IR & Forensics

Security Operations is where cybersecurity stops being a diagram and becomes a 2 a.m. phone call. Domain 7 carries 13% of the CISSP exam — tied for the heaviest — and ISC2 tests it almost entirely through scenarios: a SIEM alert fires, a server is compromised, evidence must hold up in court, and the business needs to be running again by morning. This deep-dive covers the four pillars the way a manager actually lives them — Monitoring, SIEM & threat intel; Incident response; Digital forensics; and Resilience operations — plus how AI-native SOCs and SOAR are reshaping the work. Get the order right (contain before eradicate, RAM before disk, BIA before RTO) and this domain becomes points; treat it as "common sense" and it quietly drains your score.

Domain 7 at a glance

Flip each card for the one-line essence of each area before you dive in.

Monitoring, SIEM & threat intel

Think of a SOC as a hospital ICU for your network: monitors beep on the SIEM, nurses (analysts) triage, and a crash-cart playbook (SOAR) fires the instant a patient codes. The Security Operations Center is the people-process-technology hub that watches your estate 24x7. Under the ISC2 2024 outline, Domain 7 folds logging, monitoring, intrusion detection, SIEM, continuous monitoring, threat intelligence, threat hunting, and UEBA into one tested objective.

Logging is the raw fuel. You collect from firewalls, endpoints, identity providers, and apps, then ship them to a central, time-synced (NTP) store so timelines line up. The SIEM ingests, normalizes, and correlates these events to surface what a single log never shows: a failed-login burst followed by a successful login and a privilege change. SIEM detects and alerts; it does not act. SOAR is the next layer that orchestrates and automates the response via playbooks, isolating a host or disabling an account in seconds. The 2024 outline explicitly tests this SIEM-versus-SOAR distinction.

Continuous monitoring means the SIEM is never "set and forget" - you tune rules, retire noisy alerts, and update detections as the estate changes. Threat intelligence feeds this loop with context. IOCs are the easy-to-change bottom of David Bianco's Pyramid of Pain; TTPs (mapped in MITRE ATT&CK) sit at the painful top because attackers cannot easily change their behavior. Threat hunting is the proactive, hypothesis-driven search for adversaries who slipped past alerts - assume breach, then go look.

Incident response

Think of incident response like a hospital's emergency ward: you don't invent the protocol when the patient arrives — you drilled it for months. NIST's updated SP 800-61 Revision 3 (2025) reframes incident response around the six CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, Recover. The first three (Govern, Identify, Protect) are the preparation wrapper — broader risk-management work that makes response possible, but not the response itself. Actual incident handling lives in Detect, Respond, Recover.

For the exam, ISC2 still tests its classic seven-step sequence, so map the two cleanly: (1) Detect & Analyze — confirm an event is truly an incident, scope it, and classify severity. (2) Respond / Contain — limit blast radius (short-term isolation, then long-term containment) while preserving evidence. (3) Mitigate — minimize active damage. (4) Report — runs throughout; one dedicated liaison briefs management, regulators, and customers so responders stay focused. (5) Recover — restore systems to known-good production. (6) Remediate — root-cause analysis to stop recurrence (begins in parallel with mitigation). (7) Lessons Learned — the post-incident review that feeds improvements back into Preparation.

Severity drives speed: rate incidents by impact (data sensitivity, systems affected) and urgency, then assign P1–P4 so a ransomware hit pages people at 2 AM while a single phishing click waits for business hours. The CSIRT has defined roles (incident commander, analysts, comms lead, legal), and playbooks codify exact steps per incident type so nobody improvises mid-crisis.

Digital forensics

Think of a crime scene where the murder weapon is melting ice — wait too long and your evidence literally evaporates. Digital evidence behaves the same way, which is why forensics is a race against decay. Digital forensics follows a strict pipeline: identify, preserve, collect, analyse, and present — and every step must protect the evidence's integrity.

The order of volatility tells you what to grab first. Capture the most perishable data before it vanishes. The standard sequence (RFC 3227): CPU registers and cache, then RAM and running processes, then network state and ARP cache, then temporary files and swap, then disk, then remote logs, and finally archival media. RAM dies the instant you pull power, so you image live memory before you ever shut the box down.

The chain of custody is your courtroom lifeline. Document who collected each item, the exact time and location, and every transfer or access afterwards. One undocumented gap and a defence lawyer gets the whole exhibit thrown out.

For admissibility, courts demand evidence that is authentic, accurate, complete, and reliable. Matching hashes prove the copy was not altered. A clean chain of custody proves nobody tampered with it. Skipping either makes even a perfect investigation legally worthless.

Resilience operations

Think of resilience operations like maintaining a Mumbai local train: you swap parts on a schedule (change management), you keep spare coaches ready (backups), and you have a plan to reroute when a track floods (DR). The goal is simple — survive disruption without losing data or trust.

Change, configuration, and patch management form the first layer. Configuration management maintains a secure baseline — a documented standard for every server, firewall, and endpoint. Change management is the governance gate: every modification goes through request, review by a Change Advisory Board, testing, approval, scheduled deployment, and rollback planning. Patch management is a specialised slice of change management. The key exam nuance: patches are externally driven (a vendor releases a fix), while configuration changes are internally initiated. The patch cycle is monitor, acquire, test, prioritise by risk, schedule, deploy, verify, and update the baseline. Never patch production without testing first.

Backup strategies protect the data itself. A full backup copies everything — slowest, most storage, fastest restore. An incremental copies only what changed since the last backup (any type) — fast backups, but restore needs the full plus every increment in order. A differential copies everything changed since the last full — middle ground, restore needs only full plus the latest differential. The 3-2-1 rule eliminates single points of failure; the modern 3-2-1-1-0 extension adds one immutable/air-gapped copy and zero verification errors for ransomware resilience.

Executing BCP/DR turns plans into action. RTO sets how fast a process must return; RPO sets how much data loss is acceptable. A four-hour RTO and one-hour RPO together drive your design: hot site plus hourly replication, not weekly tape. Failover shifts production to a standby site; failback returns to primary once stable. Both RTO and RPO come from the Business Impact Analysis, and you must test failover regularly — an untested DR plan is just hopeful paperwork.

Domain 7 in the AI era (2026)

SOC 2.0 is the "agentic SOC." The old promise was SIEM-plus-SOAR: a SIEM correlates logs into alerts, a SOAR runs a fixed playbook. The 2025–2026 shift is AI agents that reason through an alert instead of following a rigid script. Gartner named "AI SOC agents" a representative category for the first time in its 2025 Innovation Insight report, placing it at the early "Technology Trigger" stage — real, but immature.

The driver is brutal math: large SOCs see 100,000+ daily alerts where only 1–5% are true positives. AI agents now auto-triage Tier-1 alerts — gathering evidence, enriching IOCs, correlating signals across tools, and suppressing false positives. Google Cloud's Alert Triage and Investigation Agent and Microsoft Security Copilot's agents are shipping examples; vendors report AI cutting MTTR by 45–55% and automating ~70% of investigations. The maturity ladder is crawl (summarise/enrich) → walk (judge alerts) → run (auto-contain on high confidence).

"Run" is where governance bites. Letting an agent isolate a host or disable an account is consequential — and risky. OWASP's Top 10 for Agentic Applications (released December 2025) catalogues goal hijacking and rogue-agent risk; the NIST AI RMF (Map/Measure/Manage/Govern) is the steering frame. The accepted model is human-on-the-loop: agents handle volume, humans own consequential judgment, and high-impact actions require deterministic escalation — not the agent deciding when to ask a human. A WEF-cited survey found 88% of enterprises investing in security AI agents, yet flagged governance gaps as the top concern.

Strengths tip: if you're analytical, build the escalation policy — deciding which actions an agent may take alone vs. must defer is the highest-value SOC 2.0 skill.

The AI-era angle, in four cards

What 2026 adds to this domain — flip to see why each matters.