An event is noise until you prove harm. An incident is a confirmed adverse event. FIRST on a SIEM fire is validate and assess scope. Mitigation in the official 7.6 list is containment — stop the bleed — not a rebuild. Capture volatile evidence first, hash it, and keep a chain of custody. Need-to-know is which information. Least privilege is which rights. Job rotation (and mandatory vacation) is the detective control for one-person fraud. BIA first, then RPO/RTO, then a site and a test. People safety outranks the server.
I do not wipe first. I confirm it is an incident, contain the blast radius, preserve what I will need in court, then recover to the BIA numbers — and I write the lesson so the next one is cheaper.
1. Why IMMEDIATELY is not “wipe it”
Interview, 35 minutes in. “Ransomware alert on a file server. What does the security professional do first?” The engineer answers “reimage from last night’s backup.” That is recovery. It is not first. It also destroys the only copy of the attacker’s foothold.
ISC2 Domain 7 — Security Operations — is 13% of the official April 2024 exam outline. The outline is not asking you to click Rebuild in vCenter. It is asking whether you can run investigations, logging, incident management, and continuity so the business survives and the evidence still stands up.
Three reasons this domain fails strong operators:
- FIRST / IMMEDIATELY are sequencing words. They pull you to the current IR phase — usually validate or contain — not to the most satisfying technical fix.
- Evidence is perishable. Power-off, AV full-scan, and “just restore” all change or destroy live artifacts. Once contaminated, you cannot decontaminate.
- Continuity is a BIA number, not a brand of DR site. A hot site that nobody tested is a hope. A cold site that cannot meet RTO is a budget line, not a plan.
Event — any observable occurrence. Most are noise. NIST SP 800-61 Rev. 2 uses this split.
Incident — a violation or imminent threat of violation of security policy, or an event that jeopardizes CIA. Outline 7.6 starts once you have one.
Mitigation (7.6) — containment. Stop further damage. Not the same as eradication or a rebuild.
Need-to-know — access to specific information required for the job. Content.
Least privilege — the minimum rights needed to perform the function. Actions.
RPO — how much data you can lose (backup frequency). RTO — how fast IT must return to a defined service level. MTD / MAO — how long the business can stand the outage. Typically RTO + WRT ≤ MTD.
2. Mental model · detect, decide, preserve, restore
Hold four parts. Interviews fail when people treat SIEM as “the answer,” treat IR as “wipe and patch,” or shop for a hot site before the BIA.
Part 1 · two official IR lists, one sequence
Objective 7.6 names seven activities in this order: detection, response, mitigation, reporting, recovery, remediation, lessons learned. That is the list to recite on the exam.
NIST SP 800-61 Rev. 2 (the CBK workhorse, August 2012) uses four phases: Preparation → Detection and Analysis → Containment, Eradication, and Recovery → Post-Incident Activity. Mitigation in 7.6 is the containment bucket. Remediation plus lessons learned is post-incident.
NIST SP 800-61 Rev. 3 (April 2025) remaps the same work onto CSF 2.0. Govern, Identify, and Protect are preparation — they are not the incident itself. The incident is Detect, Respond, Recover. Improvement is continuous, not a meeting you skip. Know r3 exists; the stem will still reward the 7.6 verbs and “contain before eradicate.”
Part 2 · logging is how detection earns its keep
Objective 7.2 is not “buy a SIEM.” It is IDPS, SIEM, continuous monitoring and tuning, egress monitoring, log management, threat intelligence (feeds and hunting), and UEBA. A SIEM that is not tuned is an alarm clock nobody believes. The official Domain 7 AI note is the same idea: use ML to cut alert fatigue and raise fidelity — then a human still validates.
Logs only correlate if clocks agree. Protect log integrity (append-only, separate store) or the investigation is hearsay with a timestamp.
Part 3 · people controls are operations, not IAM trivia
Objective 7.4 lists need-to-know / least privilege, SoD, privileged account management, job rotation, and SLAs. These are how you run the shop every day. Domain 5 designs the access model. Domain 7 is whether the SOC, the admin team, and the finance clerk actually live it.
Read left → right. If the stem is about seeing a file, it is need-to-know. If it is about being able to do a thing, it is least privilege. If one person can complete a crime alone, it is SoD. If you need to catch ongoing fraud or remove a single point of failure, it is rotation.
Need-to-know is the file. Least privilege is the button. SoD splits the process. Job rotation finds the fraud the SIEM never saw.
3. Decision flow · the IR path
Read top → bottom on the right. Diamond = decision. Green = you can leave the incident path. Reporting in 7.6 runs throughout — legal, leadership, regulators — not only at the end.
800-61 Rev. 2 is explicit: document containment strategies before you need them, and preserve evidence while you contain. Eradication without a picture of scope leaves a second foothold. Recovery without a clean image puts the same malware back.
4. How to choose people controls, sites, tests
Use the tables. Qualitative judgment is enough for most FIRST questions. Numbers (RPO hours, RTO hours) show up when the stem hands them to you.
| If the ticket looks like… | Control | Why not the cousin |
|---|---|---|
| Analyst can open only their queue, not payroll files. | Need-to-know | Least privilege is about the action (reset vs export), not the file set. |
| Helpdesk can reset passwords but cannot create domain admins. | Least privilege (+ PAM for the admin path) | Need-to-know would hide a document. This hides a capability. |
| One clerk requests, approves, and reconciles the same payment. | Separation of duties | Rotation might later detect the fraud. SoD tries to make the fraud impossible. |
| Long-tenured operator, no backup, auditor suspects silent fraud. | Job rotation or mandatory vacation | A new SIEM does not watch a paper process. Rotation is detective + resilience. |
| Vendor must restore email in four hours or pay. | SLA | An SLA is a contract metric. It is not a substitute for your own BIA. |
| BIA number | What it measures | What you buy |
|---|---|---|
| RPO | Maximum acceptable data loss (time). | Backup frequency, replication, journal. Hourly RPO is not a weekly tape. |
| RTO | Maximum time to restore a defined service level. | Hot / warm / cold / cloud / reciprocal site, HA, spare capacity agreements (outline 7.10). |
| WRT | Time to verify integrity and resume the business after IT is up. | Runbooks, people, comms. A restored database that finance cannot trust is not recovered. |
| MTD / MAO | How long the process can be down before irrecoverable harm. | If RTO + WRT > MTD, the strategy fails the BIA. Declare disaster when MTD is at risk. |
Read left → right on the clock, then pick heat. Outline 7.10 says “cold vs. hot” and resource capacity agreements. Cloud and reciprocal sites are valid strategies if they hit the BIA. Geographic separation so one flood does not take both sites.
| Official 7.12 test | What you actually do | Hits production? |
|---|---|---|
| Read-through / tabletop | Sit with the plan. Talk the scenario. Find missing names and phone trees. | No |
| Walkthrough | Role-owners walk their own steps and correct the document. | No |
| Simulation | Act the disaster. Stop before you touch live systems or data. | No |
| Parallel | Bring the recovery site up while production stays up. Compare results. | No (recovery side only) |
| Full interruption | Take production down and run the real fail-over. | Yes — highest proof, highest risk |
| Communications | Stakeholders, test status, regulators — named in 7.12 on purpose. | Depends on the exercise |
Objective 7.11 is Disaster Recovery (IT, facilities, comms, restoration). Objective 7.13 is Business Continuity (the business process keeps running). Domain 1.7 already told you the BIA comes first. Domain 7 is where you implement and test. People safety (7.15 — travel, 2FA fatigue, emergency, duress) outranks the server every time.
5. Runbook · Side A log, B IR/forensics, C BCP/DR
This is not a vendor console path. It is the Domain 7 operating path you walk on an alert, a laptop seizure, or a declared disaster. Each side cites one primary source.
Side A · logging and detection (due diligence of the SOC)
Primary source: ISC2 outline 7.2 and NIST SP 800-92, Guide to Computer Security Log Management.
-
Collect the right sources, not every syslog on earth
IDPS, firewalls, endpoints, identity, cloud control plane, egress. 7.2 names egress monitoring on purpose — exfil is how you find the quiet incident.
-
Normalize, correlate, tune
SIEM aggregates and correlates. UEBA watches user and entity baselines. Threat intel (feeds + hunting) tells you what “interesting” looks like this week. Untuned rules are alert fatigue — the official Domain 7 AI paragraph is about raising fidelity, not auto-closing tickets.
-
Protect the log itself
Time sync. Integrity. Retention that matches legal hold and policy. If the attacker can edit the only copy, you have no investigation.
-
Treat the first fire as an event
Validate. Deduplicate. Ask “what else is in scope?” A single host alert that is really a subnet is a different incident. This is Detection and Analysis, not Recovery.
Side B · incident, investigation, forensics
Primary source: ISC2 outline 7.1 / 7.6, NIST SP 800-61 Rev. 2 (four-phase handling) and Rev. 3 (CSF 2.0 Detect / Respond / Recover).
-
Secure the scene, then decide live vs dead
Once evidence is contaminated, you cannot decontaminate it. Live systems hold RAM, cache, and crypto keys. Power-off destroys them. A dead-box disk image is right when volatility is already gone or the box is off. Do not “just pull the plug” because a blog said so.
-
Collect in order of volatility
Well-known order (RFC 3227 / NIST SP 800-86): registers and cache → routing/ARP/process table/memory → temp file systems → disk → remote logs → physical config and topology → archives. Hash before and after the image. Use a write blocker on media. Bit-for-bit copy; work from the copy.
-
Start and keep the chain of custody
Who handled what, when, where, why. Seal it. Outline 7.1: evidence collection and handling, reporting and documentation, artifacts (data, computer, network, mobile). Five classic rules of evidence: authentic, accurate, complete, convincing, admissible. Chain of custody helps admissibility; it does not guarantee it.
-
Contain, then eradicate, then recover
Mitigation = isolate, sinkhole, disable the account, segment the VLAN. Reporting runs in parallel to legal, leadership, and any regulator the incident triggers. Recovery returns service. Remediation removes the root cause (patch, key rotate, kill the bad rule). Lessons learned is a dated meeting, not a Slack shrug.
Side C · continuity and recovery
Primary source: ISC2 outline 7.10–7.13 and NIST SP 800-34 Rev. 1, Contingency Planning Guide.
-
BIA first — then strategy
Critical processes, impact over time, RPO / RTO / WRT / MTD, resource dependencies. Shopping for a hot site before the BIA is Domain 1’s “buy the WAF first” mistake in a different jacket.
-
Pick backup and site to hit the numbers
7.10: cloud / on-site / off-site storage; cold vs hot; resource capacity agreements; multiple processing sites; HA, QoS, fault tolerance. Incremental vs differential is CBK restore-math (incremental = last full + every incremental; differential = last full + one differential). Mirror is fastest and fattest. Test a restore, not just a backup job.
-
Declare when MTD is at risk, restore in BIA order
7.11: response, personnel, communications, assessment, restoration, training, lessons learned. Most critical first on the way to the recovery site. Least critical first when you fail back, so you prove the primary site before you bet the crown jewels on it.
-
Test with the official 7.12 name
Tabletop if you have never walked it. Parallel if you must prove the site without taking production. Full interruption only when leadership accepts the risk. Communications to stakeholders and regulators is a test type, not an afterthought. 7.9 change management still wraps patches (7.8) — a Friday-night emergency change is still a change.
The event was validated. Scope is written. Containment happened before the rebuild. Evidence is hashed and chained. Recovery matches the BIA. Root cause is fixed. A lessons-learned note exists. The next tabletop uses that note.
6. Runtime path after the incident
Recovery is not the end. 800-61 Rev. 3’s whole point is that Detect / Respond / Recover feed Identify.Improvement, which retunes Govern / Protect / Detect. A closed ticket with the same detection gap is a care failure.
After IR
Indicators go into detection. Patch and vuln (7.8) close the hole through change (7.9). Configuration baselines (7.3) so the rebuilt host is not the same soft image.
After DR
Update the plan, the call tree, and the BIA if the business changed. A parallel test that failed is a gift — treat it as a finding, not a secret.
Physical + people
7.14 perimeter and internal physical controls. 7.15 travel, awareness (insider, social media, 2FA fatigue), emergency, duress. Life safety still wins over lock-down.
Media
7.5: manage and protect media at rest and in transit. Encrypt, track, sanitize at end of life. A backup tape in a rideshare is an incident, not a courier story.
7. Traps + proof checklist
| Stem pattern | What ISC2 is testing | Engineer trap | Manager move |
|---|---|---|---|
| SIEM / AI alert fires. FIRST? | Detection and analysis (7.2, 7.6). Validate. | Escalate, wipe, or page the CEO. | Validate the alert and assess scope. |
| Confirmed malware. IMMEDIATELY / BEST next? | Mitigation = contain (7.6, 800-61). | Eradicate / restore now. | Contain, preserve evidence, then eradicate. |
| Live laptop, insider theft | 7.1 forensics. Volatility. | Pull the plug or run full AV. | Capture volatile data, write-block, hash, chain of custody. |
| One person can complete a payment | 7.4 SoD vs rotation. | Buy monitoring. | Split the process (SoD). Rotation detects what SoD missed. |
| Cannot see payroll, can still admin | Need-to-know vs least privilege. | Call both “least privilege.” | Hidden files = need-to-know. Hidden buttons = least privilege. |
| RPO 4 hours, RTO 1 hour | 7.10 / 7.11 metrics. | Swap the two letters. Buy a cold site. | RPO is data loss. RTO is downtime. One-hour RTO is not a cold site. |
| Prove the DR plan without risking Friday traffic | 7.12 test types. | Full interruption because it sounds serious. | Parallel (or tabletop if the plan has never been read). |
| Fire alarm vs locked data-centre doors | 7.15 life safety. Fail-safe. | Keep doors locked for confidentiality. | People out. Fail-safe unlocks. Fail-secure is for the firewall, not the fire exit. |
Do not recite PICERL as if it were the ISC2 list. SANS PICERL is useful in a SOC. The exam outline’s 7.6 verbs are detection, response, mitigation, reporting, recovery, remediation, lessons learned. Mitigation is contain. Remediation is the lasting fix. They are not synonyms.
- I can say the seven 7.6 verbs in order and map them to 800-61 r2’s four phases.
- I can explain why r3 moved preparation into Govern / Identify / Protect.
- I can separate event from incident in one sentence.
- I can order volatile evidence without looking it up.
- I can tell need-to-know from least privilege from SoD from job rotation.
- I can assign RPO and RTO from a one-line business ask, and reject a cold site that cannot hit RTO.
- I did not invent an exam percentage. Domain 7’s official weight is 13% of the whole exam — that is the only percentage this page uses.
Weak: “Domain 7 is the SOC and backups.” Strong: “I validate before I contain, I contain before I eradicate, and I do not recover on top of a dirty image. Need-to-know is the file; least privilege is the right; rotation is how I catch the fraud the SIEM never saw. RPO is data, RTO is time, and the BIA decides the site — not the brochure.”
Knowledge check
Six judgment items. Map each one to a FIRST/BEST stem, not a definition. Check answers, then reset and retry the misses.
Sources
- ISC2 — CISSP Certification Exam Outline (effective 15 April 2024). Domain 7 weight 13%. Objectives 7.1–7.15 used as the spine of this lesson. No other exam percentages are claimed.
- NIST — SP 800-61 Rev. 2, Computer Security Incident Handling Guide (Preparation → Detection and Analysis → Containment, Eradication, and Recovery → Post-Incident Activity; event vs incident).
- NIST — SP 800-61 Rev. 3 (April 2025). CSF 2.0 community profile: Govern / Identify / Protect as preparation; incident work is Detect, Respond, Recover; continuous improvement.
- NIST — Incident Response project (life-cycle figure and r2 supersession note).
- NIST — SP 800-86, Guide to Integrating Forensic Techniques into Incident Response and IETF RFC 3227 (order of volatility).
- NIST — SP 800-92, Guide to Computer Security Log Management.
- NIST — SP 800-34 Rev. 1, Contingency Planning Guide (BIA before recovery strategy; RTO / RPO as well-known CBK metrics).
- Well-known CBK (not an ISC2 percentage claim): five rules of evidence; incremental vs differential restore math; fail-safe vs fail-secure; RTO + WRT ≤ MTD.
Related: CISSP overview (all 8 domains) · Domain 1: BIA and risk treatment · Domain 6: Assessment and Testing · Domain 8: Software Security · 8-week roadmap