Security Operations and Incident Response
What this domain covers
Security Operations and Incident Response tests how alarms are received, verified, escalated, dispatched, documented, and handed over. It rewards candidates who can separate an alarm from a trouble signal and who can write a factual record that survives review.
Core rules
- Signal types: alarm (intrusion, hold-up, duress), trouble (AC fail, low battery, communication path), supervisory (valve tamper, low air), and bypass. Only an alarm indicates a probable security event.
- Verification reduces false dispatches. Two-call verification contacts the premises and then a second number, or uses video verification. CP-01 panels add abort windows, entry delays, cross-zoning, and swinger shutdown.
- Priority order is life safety, then active intrusion or duress, then environmental and trouble conditions. A duress or hold-up alarm is never treated as routine.
- The response plan is the written authority: who is called, in what order, within what time, and who may authorize dispatch.
- Incident reports record who, what, when, where, how, actions taken, and notifications made. They contain facts and direct observations, not guesses.
- Evidence: preserve video from before and after the event, export in native format with a hash, log every transfer, and maintain chain of custody.
- Handover must include open alarms, pending service, keyholder changes, and outstanding investigations.
Worked example
At 02:14 a panel reports a rear door alarm on zone 3, then motion on zone 4 forty seconds later; an AC trouble was logged at 01:50. Reasoning: the sequence follows a plausible path through the building, so the operator dispatches police, then notifies the keyholder, preserves video from 01:50 to 02:30, and notes the AC trouble so responders know the panel is on battery. By contrast, a single zone that alarms nightly at 18:30 with no other activity suggests an environmental cause; the operator follows verification policy and schedules service rather than repeated dispatch.
Traps that cost marks
Dispatching on a trouble or supervisory signal; calling a keyholder before police when a life-safety signal is present; clearing an alarm without documenting the disposition; and writing conclusions such as 'the suspect probably entered through the roof.' Also watch for missed timestamps and unlogged notifications.