Domain 1 · Security Incident Response Overview and Data Visualization
15% of the exam- Introducing Security Incident Response
- Data Visualization
- Security Incident Response - Components
CIS-SIR exam blueprint, explained
Certified Implementation Specialist - Security Incident Response
ServiceNow's blueprint lists what the exam tests and how much each area counts. This page restates it in plain language, with the domains ordered as published and every objective as a checklist.
Official source: KB0011559, updated January 2026. Open the official CIS-SIR blueprint
The original is a ServiceNow University knowledge article and may ask you to sign in to Now Learning. If anything here disagrees with it, the official blueprint wins.
At a glance
- Domains
- 6
- Heaviest domain
- Automation and Standard Processes (30%)
- Top two domains
- 45% of the exam
- Objectives listed
- 21
Where the marks are
Each domain's share of the exam, and what that means for every 10 hours you study.
| Domain | Weight | Of every 10 study hours |
|---|---|---|
| 1. Security Incident Response Overview and Data Visualization | 15% | 1 h 30 min |
| 2. Security Incident Creation and Threat Intelligence | 14% | 1 h 30 min |
| 3. Security Incident and Threat Intelligence Integrations | 14% | 1 h 30 min |
| 4. Security Incident Response Management | 15% | 1 h 30 min |
| 5. Risk Calculations and Post Incident Response | 12% | 1 h 15 min |
| 6. Automation and Standard Processes | 30% | 3 h |
Weights as published in KB0011559. The study-time column only applies the weight; spend more on domains you're weaker in.
What each domain covers
The blueprint's objectives for each domain. Tick them off as you can explain and do each one in a Personal Developer Instance.
Domain 2 · Security Incident Creation and Threat Intelligence
14% of the exam- Explore How to Create Security Incidents
- Major Security Incident Management
- Understanding Threat Intelligence
- MITRE ATT&CK Framework
Domain 3 · Security Incident and Threat Intelligence Integrations
14% of the exam- ServiceNow Store and Share
- Managing Pre-Built Integrations
- Creating Custom Integrations
- Threat Intelligence Service Center
Domain 4 · Security Incident Response Management
15% of the exam- Security Incident Response Workspace
- Standard Automated Assignment Options and Escalation Paths
- Security Tags
- Process Definitions and Selection
Domain 5 · Risk Calculations and Post Incident Response
12% of the exam- Security Incident Calculator Groups and Risk Scores
- Post Incident Reviews
- Event Management
Domain 6 · Automation and Standard Processes
30% of the exam- Automate Security Incident Response Overview
- Security Incident Process Automation Using Playbooks and Runbooks
- User Reported Phishing
Before you book
- Prerequisites: CIS – Data Foundations (CMDB and CSDM) is a mandatory prerequisite for CIS-SIR.
- Exam fee: $450.
- Passing score: ServiceNow does not publish the cut score, and the official exam blueprint says it is not always 70%.
- Booking, retake waits and exam format are covered on the CIS-SIR page.
Courses the blueprint points to
Recommended on the blueprint
The blueprint lists these as recommended preparation.
- Welcome to ServiceNow
- ServiceNow Administration Fundamentals
- ServiceNow Platform Implementation
- Automated Test Framework Fundamentals
- Workflow Studio Fundamentals
- Flow Designer Fundamentals
- IntegrationHub Fundamentals
- Mobile Development Essentials
- Service Portal Fundamentals
- Common Service Data Model Fundamentals
- Configuration Management Database Fundamentals
- Now Experience UI Builder Fundamentals
- Configuration Compliance Essentials
- What’s New in the Store for Security Operations
- Now Assist for SIR Bootcamp
- Security Operations Fundamentals
- Security Incident Response Implementation
Additional resources on the blueprint
Listed as further reading, not core preparation.
- Zurich Security Operations Documentation
- Zurich Security Incident Response Documentation
- Security Operations Community Forum
Also on the Now Learning credential path
Optional practice listed on the credential path, not in the blueprint.
Courses without a link are named in the blueprint but we haven't recorded a course URL for them; search for them in Now Learning.
How to use this blueprint
- Go through the objectives above and mark each one: done for real, only read about, or new.
- Start where heavy weight meets the most “new” marks. Automation and Standard Processes alone is 30% of the exam.
- Build each objective in a Personal Developer Instance rather than only reading about it.
- Use practice questions to find weak domains, then go back to those objectives and their documentation.