Security Program Management and Operations
Domain 3 (Security Program Management and Operations) tests how the program runs day to day: operating model, risk-based prioritization, metrics the board can use, incident response, and resilience testing. The exam favors answers that reduce risk measurably over answers that add activity.
Building the operating model
- Derive the roadmap from the risk register and the business calendar, not from vendor pitches. Fund in tranches with named owners.
- Maturity models (C2M2, CMMI-style scales) show progression; use them to justify the next investment rather than to score the team.
- Separate KPIs (did we do the work? percentage of critical patches within SLA) from KRIs (how much risk remains? number of internet-facing critical vulnerabilities open longer than 30 days). Boards act on KRIs and trends.
Vulnerability and patch operations
- Asset inventory is the precondition; you cannot patch what you cannot see.
- Set SLAs by severity and exposure, for example critical internet-facing in 7 days, critical internal in 30, high in 90. Exceptions need compensating controls and an expiry date.
- Measure outcome: exposure reduced, not scans executed.
Incident response and resilience
- NIST SP 800-61 lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.
- Define incident declaration criteria in advance; late declaration is the most common program failure. Maintain playbooks, an escalation matrix, and a communications plan that includes legal and corporate communications.
- Business continuity and disaster recovery distinguish RTO (time to restore a service), RPO (acceptable data loss, set by backup frequency), MTPD (maximum tolerable downtime), and MTTR (historical repair time).
- Test progressively: checklist, tabletop, simulation, parallel processing, full failover.
Worked example
Ransomware encrypts a finance file server at 02:10. The on-call analyst isolates the subnet, disables the compromised account, and captures a forensic image before remediation. Rebuild takes 6 hours and restore from immutable backup another 12, meeting the 24-hour RTO; the hourly backup means 1 hour of data loss against a 4-hour RPO. Legal confirms personal data exposure and notifies the regulator within 72 hours. The post-incident review changes backup immutability settings and adds endpoint detection, and the changes are tracked to closure.
Traps that cost marks
- Swapping RTO and RPO, or quoting MTTR as if it were a target.
- Reporting activity metrics such as number of scans to the board.
- Declaring a tabletop exercise proof of recoverability.
- Skipping the post-incident review or leaving lessons learned without assigned owners.