Operations and Controls
Domain 4 - Operations and Controls
This domain tests day-to-day security operations and whether controls are designed, implemented, and proven effective. Expect questions on SOC models, monitoring, vulnerability management, identity, configuration, and control testing.
Core rules and concepts
- Operate from an asset and service inventory; you cannot patch, monitor, or protect what you cannot see. Configuration baselines and change management prevent drift.
- Vulnerability management is risk-based: discover, prioritize by exploitability and business impact, remediate within agreed SLAs, and verify closure. Patch management is one treatment, not the whole program.
- Identity and access controls include joiner-mover-leaver workflows, privileged access management, multifactor authentication, and periodic access reviews.
- Measure control effectiveness, not just volume: mean time to detect, percentage of critical findings past SLA, access review completion quality, and alert false-positive rates. Test controls independently and keep evidence.
Worked example
A monthly report shows 1,200 open vulnerabilities but no business context. The CISO changes the operating model: enrich findings with asset criticality and exploit intelligence, set a 15-day SLA for internet-facing criticals, automate ticket creation, and review exceptions weekly. After one quarter, critical backlog falls 70%, and the metric reported to the board becomes "critical exposure days" rather than raw count. Reasoning: prioritization and ownership change behavior; the metric reflects risk, not activity.
Traps that cost marks
- Reporting vulnerability counts without severity, exposure, or ageing.
- Patching before confirming asset ownership and business windows.
- Assuming SIEM alerts equal detection coverage.
- Collecting control evidence once and never re-testing.