8. Domain 7 — Security Operations (13%)

Security operations is where strategy becomes reality. Every governance framework, architectural design, and security control from the previous domains must be operationalized — monitored, maintained, tested, and executed under pressure when incidents occur. Domain 7 covers the day-to-day and crisis-time execution of the security program.

At 13% weight, Domain 7 is the broadest domain in scope. It spans incident response, disaster recovery, physical security operations, evidence handling, configuration management, and operational security techniques. The CISSP tests whether you understand not just what these processes are, but how they interact — how a malware incident triggers the IR plan, which also invokes BCP/DR procedures, which depend on asset inventories maintained through configuration management.

⚠️ Domain Trap: Domain 7 is operationally focused — exam questions are scenario-heavy. "The SOC analyst observes X — what should they do NEXT?" The key word is NEXT, not EVENTUALLY. The incident response lifecycle has a defined sequence; jumping ahead (e.g., going straight to eradication before containment, or preserving evidence before ensuring life safety) is a common trap answer.