CIS-SIR Exam Preparation
Certified Implementation Specialist - Security Incident Response
Exam Details
Exam Blueprint
ServiceNow Official Exam Blueprint| Domain | Weight |
|---|---|
Automation and Standard Processes
| 30% |
Security Incident Response Overview and Data Visualization
| 15% |
Security Incident Response Management
| 15% |
Security Incident Creation and Threat Intelligence
| 14% |
Security Incident and Threat Intelligence Integrations
| 14% |
Risk Calculations and Post Incident Response
| 12% |
Study Plan
Focus on high-weight topics first for maximum impact. Topics are ordered by exam weight.
Automation and Standard Processes
30% weightConfigure playbooks, automated responses, and standard operating procedures to accelerate incident response.
Key Concepts to Master:
Security Incident Response Overview and Data Visualization
15% weightUnderstand the Security Incident Response application architecture, data visualization capabilities, and how SIR fits within Security Operations.
Key Concepts to Master:
Security Incident Response Management
15% weightMaster the tools and processes for managing security incidents through investigation, containment, and resolution.
Key Concepts to Master:
Security Incident Creation and Threat Intelligence
14% weightLearn how security incidents are created, classified, and enriched with threat intelligence data.
Key Concepts to Master:
Security Incident and Threat Intelligence Integrations
14% weightConfigure integrations with SIEM, SOAR, and threat intelligence platforms to enhance security incident response capabilities.
Key Concepts to Master:
Risk Calculations and Post Incident Response
12% weightUnderstand how security risks are calculated, reported, and how post-incident activities improve future response.
Key Concepts to Master:
Required Courses
Official Now Learning courses that cover the exam content.
Course information coming soon. Visit the official exam page for the latest requirements.
Official Documentation
ServiceNow docs pages that map to the exam domains.
Documentation links coming soon. Visit docs.servicenow.com for the official documentation.
Prerequisites
- •ServiceNow CSA certification
- •Security Operations experience
- •Understanding of security incident response