Domains 6 and 7: security assessment, testing and operations

Designing controls is only the beginning. Organizations must check that controls work as intended and operate them day after day, detecting and responding to incidents and recovering from disruptions. This lesson tours two domains concerned with that work. Domain 6, Security Assessment and Testing, carries 12 % of the exam and covers how security is assessed, tested and audited. Domain 7, Security Operations, carries 13 % and covers investigations, monitoring, incident management, change and patch management, recovery and physical safety. Domain 7 has the most subdomains of any domain in the 2024 outline, which reflects the breadth of operational security work.

Domain 6 at a glance

Domain 6 asks candidates to design and validate assessment, test and audit strategies; conduct security control testing; collect security process data; analyze test output and generate reports; and conduct or facilitate security audits. In plain terms, it is about answering the question 'How do we know our security works?' with evidence rather than hope. Its ideas link directly to due diligence in Domain 1: an organization that never tests its controls cannot show that it is managing risk responsibly.

Assessment strategies and audits

Assessments can be performed by internal staff, by external assessors hired by the organization or by third parties acting for someone else, such as a regulator or a customer. Internal assessments are cheaper and more frequent but less independent. External and third-party assessments are more independent and often required for compliance. An audit is a formal, systematic examination against defined criteria, such as a standard, a regulation or the organization's own policies, conducted by people independent of the area being audited.

Service organizations often provide independent assurance reports to their customers so that each customer does not need to audit them separately. These reports describe the provider's controls and an auditor's opinion on them. SOC 1 reports address controls relevant to customers' financial reporting. SOC 2 reports address controls relevant to security, availability, processing integrity, confidentiality and privacy. SOC 3 reports are shorter, general-use versions of SOC 2. A Type I report evaluates the design of controls at a point in time; a Type II report also tests their operating effectiveness over a period, typically six to twelve months, and is therefore more valuable.

In the United States, SOC reports are issued by CPA firms under the AICPA's attestation standards: SOC 1 reports under SSAE 18 (AT-C 320), and SOC 2 and SOC 3 reports using the AICPA trust services criteria. Federal cloud services are assessed by accredited third-party assessment organizations under FedRAMP, and defense contractors increasingly face CMMC assessments. Organizations may also pursue ISO/IEC 27001 certification of their information security management system.

Testing techniques

Vulnerability assessment uses automated scanners and manual checks to identify known weaknesses, such as missing patches and misconfigurations, and rates them by severity, often using the Common Vulnerability Scoring System (CVSS). Penetration testing goes further: authorized testers try to exploit vulnerabilities to show what an attacker could actually achieve. Tests can be black box (testers have no prior knowledge), white box (full knowledge, including source code and diagrams) or gray box (partial knowledge). Every penetration test needs written authorization and rules of engagement covering scope, timing, methods, communication and handling of sensitive data.

Other techniques include log reviews, which examine records for signs of problems; synthetic transactions, which run scripted transactions to check that a system responds correctly and within time limits; real user monitoring, which measures actual users' experience; code review and testing, both static (examining code without running it) and dynamic (testing running software); misuse case testing, which deliberately tries to abuse functions; fuzzing, which feeds unexpected input to find crashes; interface testing; and breach and attack simulation. Test coverage analysis measures how much of a system has been tested.

Measuring and reporting

Assessments produce data that must be turned into decisions. Security process data includes account management records, management review and approval, backup verification results, training and awareness completion, and disaster recovery and business continuity test results. Key performance indicators (KPIs) measure how well security processes are working, such as the percentage of critical patches applied within the target time. Key risk indicators (KRIs) warn of rising risk, such as a growing number of unpatched internet-facing systems. Reports must suit their audience: technical detail for those who fix problems, risk and business impact for executives. Exceptions and findings need owners, deadlines and tracking until they are remediated or formally accepted.

Domain 7 at a glance

Domain 7, Security Operations, covers understanding and complying with investigations; conducting logging and monitoring activities; performing configuration management; applying foundational security operations concepts; applying resource protection; conducting incident management; operating and maintaining detection and preventive measures; implementing and supporting patch and vulnerability management; understanding and participating in change management processes; implementing recovery strategies and disaster recovery processes; testing disaster recovery plans; participating in business continuity planning and exercises; implementing and managing physical security; and addressing personnel safety and security concerns.

Investigations and evidence

Investigations may be administrative (internal matters such as policy breaches), criminal (violations of criminal law, requiring proof beyond a reasonable doubt), civil (disputes between parties, decided on a balance of probabilities) or regulatory (by or for a regulator). Evidence must be collected and handled so that it remains admissible and reliable. That means following a documented process, preserving original evidence, working on forensic copies verified by hashes, and maintaining a chain of custody that records every person who handled the evidence and when. Volatile evidence, such as the contents of memory, should be captured first, following the order of volatility.

Monitoring and incident management

Logging and monitoring give organizations visibility. Security information and event management (SIEM) systems collect and correlate logs; security orchestration, automation and response (SOAR) tools automate responses; intrusion detection and prevention systems and endpoint detection and response tools watch for malicious activity; threat intelligence and user and entity behavior analytics help spot unusual patterns. Monitoring is only useful if someone reviews alerts and acts on them, and if clocks are synchronized so that events can be correlated.

The CISSP describes incident management in steps: detection, response, mitigation, reporting, recovery, remediation and lessons learned. Other frameworks, such as NIST SP 800-61, group these differently, but the logic is the same. Detect and verify the incident; activate the response team; contain the damage; report to management and, where required, to regulators, law enforcement and affected individuals; restore normal operations; fix the root cause; and review what happened to improve.

Recovery and continuity

Recovery planning is driven by objectives set in the business impact analysis. The maximum tolerable downtime (MTD) is the longest a function can be unavailable before the organization suffers unacceptable harm. The recovery time objective (RTO) is the target time to restore the function, which must be less than the MTD. The recovery point objective (RPO) is the maximum acceptable data loss measured in time, which determines how often backups or replication must occur. Recovery sites range from hot sites (fully equipped and ready within hours) through warm sites (partly equipped) to cold sites (space and utilities only), with cloud-based recovery increasingly common.

Plans must be tested. Test types range from least to most disruptive: read-through or checklist reviews, structured walkthroughs or tabletop exercises, simulations, parallel tests (running recovery systems alongside production) and full interruption tests (shutting down production and running on recovery systems). Full interruption tests give the most assurance but carry the most risk and need senior approval.

Domain 7 also covers foundational operations concepts such as need to know, least privilege, separation of duties, job rotation and service level agreements; configuration management and secure baselines; patch and vulnerability management; change management; protection of media and other resources; physical security operations; and personnel safety, including travel security, emergency management and duress procedures. As always, the safety of people comes first.

Patch, change and configuration management

Three related processes keep systems in a known, secure state. Configuration management establishes secure baselines for each type of system and detects drift from them. Change management ensures that changes are requested, assessed for risk, approved, tested, scheduled, communicated and documented, with a way to roll back if something goes wrong; emergency changes follow an expedited path but are still reviewed afterwards. Patch management identifies, prioritizes, tests and deploys updates, using severity, exploitability and asset criticality to decide what to patch first. Together they reduce the chance that systems are vulnerable or unstable and make investigations easier, because records show what changed and when.

Domain 7 also includes resource protection: managing media such as backup tapes, removable drives and paper records throughout their life, from labeling and secure storage to transport and destruction. Media that leaves a controlled area should be tracked, encrypted where possible and logged, and its destruction should be documented. Many real breaches have come not from sophisticated attacks but from lost backup media or old equipment sold without being wiped.

Foundational concepts such as need to know, least privilege, separation of duties and job rotation appear in Domain 7 because they are applied every day in operations. Job rotation and mandatory vacations, for example, help detect fraud, because another person takes over the work and may notice irregularities.