TR-C Domain 4: Operations and Management
TR-C Domain 4, Operations and Management, tests the day-to-day control of a live service. Questions cover ownership, runbooks, SLAs, incident and problem management, access reviews, backup and restore, capacity, vendor operations, and operational metrics. The exam expects you to show that controls continue to operate, not just that they were designed and deployed.
Core rules
- Assign a service owner and control owners. Every recurring task needs a schedule, procedure, escalation path, and evidence location.
- Use runbooks for repeatable operations and keep them current after incidents and changes.
- Distinguish incidents from problems: an incident restores service; a problem removes the root cause. Both need records and ownership.
- Review access on a defined cadence, especially for privileged, contractor, and terminated-user accounts. Remove access promptly and retain the review evidence.
- Test backups by restoring data, not by checking job success. Track capacity against thresholds and manage vendor performance against contractual SLAs.
Worked example
A quarterly access review finds an active account for a contractor whose engagement ended. The reviewer disables the account the same day, opens an incident record, and checks logs for activity since the end date. The problem record traces the cause to a delayed leaver notification between HR and IT. The team updates the joiner-mover-leaver runbook, adds an automated termination feed, and schedules a follow-up sample review. Evidence includes the review spreadsheet, disablement timestamp, log review, and runbook change.
Traps
Do not operate controls without named owners. Do not treat a successful backup job as a successful restore. Do not use emergency changes to bypass all review; require retrospective approval. Do not measure operations with vanity metrics that omit failed SLAs, open problems, or overdue access reviews. Do not let vendor oversight stop at contract signature.