snready

CIS-VR exam blueprint, explained

Certified Implementation Specialist - Vulnerability Response

ServiceNow's blueprint lists what the exam tests and how much each area counts. This page restates it in plain language, with the domains ordered as published and every objective as a checklist.

Official source: KB0011555, updated November 2025. Open the official CIS-VR blueprint

The original is a ServiceNow University knowledge article and may ask you to sign in to Now Learning. If anything here disagrees with it, the official blueprint wins.

At a glance

Domains
5
Heaviest domains
Vulnerability Response Applications and Modules and Getting Data into Vulnerability Response (25% each)
Top two domains
50% of the exam
Objectives listed
17

Where the marks are

Each domain's share of the exam, and what that means for every 10 hours you study.

DomainWeightOf every 10 study hours
1. Vulnerability Response Applications and Modules
25%
2 h 30 min
2. Getting Data into Vulnerability Response
25%
2 h 30 min
3. Tools to Manage Vulnerability Response
23%
2 h 15 min
4. Automating Vulnerability Response
20%
2 h
5. Vulnerability Response Dashboards and Reports
7%
45 min

Weights as published in KB0011555. The study-time column only applies the weight; spend more on domains you're weaker in.

What each domain covers

The blueprint's objectives for each domain. Tick them off as you can explain and do each one in a Personal Developer Instance.

Domain 2 · Getting Data into Vulnerability Response

25% of the exam
  • Definition of Vulnerabilities and Vulnerable Items
  • Integrating with Vulnerability Scanners and Other Data Sources
  • Application and Container VR integrations
  • Vulnerability Solution and Enrichment management
Practice 21 Getting Data into Vulnerability Response questions →

Before you book

  • Prerequisites: CIS – Data Foundations (CMDB and CSDM) is a mandatory prerequisite for CIS-VR.
  • Exam fee: $450.
  • Passing score: ServiceNow does not publish the cut score, and the official exam blueprint says it is not always 70%.
  • Booking, retake waits and exam format are covered on the CIS-VR page.

Courses the blueprint points to

Recommended on the blueprint

The blueprint lists these as recommended preparation.

Additional resources on the blueprint

Listed as further reading, not core preparation.

Also on the Now Learning credential path

Optional practice listed on the credential path, not in the blueprint.

Courses without a link are named in the blueprint but we haven't recorded a course URL for them; search for them in Now Learning.

How to use this blueprint

  1. Go through the objectives above and mark each one: done for real, only read about, or new.
  2. Start where heavy weight meets the most “new” marks. Vulnerability Response Applications and Modules and Getting Data into Vulnerability Response are 25% each.
  3. Build each objective in a Personal Developer Instance rather than only reading about it.
  4. Use practice questions to find weak domains, then go back to those objectives and their documentation.

Keep going