Operational Aspects of Information Security Controls, Incident Management, and Change Management
Domain 4 covers operational aspects of information security controls, incident management, and change management. The exam tests whether you can select and operate controls, run the incident lifecycle, and make changes without weakening security or availability.
Core rules and concepts
- Controls are preventive, detective, or corrective; they can be administrative, technical, or physical. Layer them and verify that they actually operate.
- Incident management follows preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Severity drives escalation and communication.
- Containment must balance evidence preservation, business impact, and attacker evasion. Recovery requires validation against known-good baselines.
- Change management uses requests, risk assessment, approval, testing, implementation, rollback, and review. Emergency changes still need authorization and retrospective review.
- Configuration baselines and asset inventories make control drift visible.
Worked example
During an active incident, an analyst needs to block a malicious domain at the secure web gateway. The normal change window is two days away. The analyst raises an emergency change: documented risk, affected users, proposed rule, test result in monitor mode, rollback steps, and incident reference. The change manager and incident commander approve. The rule is deployed, monitored for false positives, and linked to the incident record. After containment, a post-implementation review confirms the rule, updates the baseline, and converts it to a permanent change.
Traps that cost marks
Bypassing change control because the incident feels urgent. Closing an incident before recovery is validated. Treating containment as eradication. Failing to test rollback or update the configuration baseline. Confusing an incident with a problem or a service request.