ServiceNow CIS-SecOps study plan
ServiceNow CIS-SecOps · Give each week a clear focus.
8 weeks · About 6 hours per week
Security Operations Fundamentals and Setup
Map the Security Operations data model by listing every table that Security Incident Response, Threat Intelligence, and Vulnerability Response depend on and how they relate
Configure a personal sub-production instance with the Security Operations plugin set and record the installed application versions
Set up assignment groups, user roles, and assignment rules so that a new security incident auto-routes to the correct group
Trace one incident from creation to closure and annotate every state transition and the role required to make it
Your checkpoint
A one-page data-model and role map plus a screenshot-backed setup checklist showing auto-routing working on a test incident
Security Operations Fundamentals and Setup & Security Incident Response
Configure the security incident response workflow states, close codes, and closure information fields to match a defined process
Build a response playbook for a phishing scenario containing at least four ordered response tasks with owners
Define SLA definitions for incident response and attach them to the phishing playbook
Create the notification and approval rules that fire when the phishing incident escalates to a high severity
Your checkpoint
A working phishing playbook that creates four tasks and an SLA when a high-severity phishing incident is opened, demonstrated on a live test record
Security Incident Response
Configure security incident task types, response task templates, and the parent-child task hierarchy
Set up analyst collaboration features including work notes, the security incident communication plan, and major-security-incident handling
Configure severity and priority matrices and verify that the matrix values drive SLA timing
Run a full lifecycle test incident through every state and reconcile any state that fails to advance
Your checkpoint
A lifecycle test log for one incident covering all states, task creation, approvals, and SLA elapsed versus breached time
Threat Intelligence
Configure at least two threat intelligence sources and ingest feeds using the supported STIX/TAXII or other supported ingestion path
Define observables, observable types, and IOC records, and confirm they populate from an ingested feed
Set up threat intelligence enrichment so observables on a security incident are matched and linked automatically
Explain and configure threat lookups against an external intelligence provider and validate the returned verdicts
Your checkpoint
Two active feeds with a documented record count, plus a test incident whose observables are auto-enriched with linked threat intelligence
Threat Intelligence & Vulnerability Response
Create threat intelligence cases and sighting records and link them back to the originating security incident
Configure a vulnerability scanner integration and import a sample vulnerability dataset
Configure the third-party and configuration item reconciliation rules that map imported findings to CMDB records
Verify imported vulnerable items are grouped into vulnerability groups by the correct rules
Your checkpoint
An imported vulnerability dataset reconciled to CMDB records, with a report showing matched versus unmatched findings and the rule applied
Vulnerability Response
Configure vulnerable item states, remediation task creation, and assignment rules for remediation owners
Build the exception and false-positive request workflow including approvals and expiration
Configure remediation target rules and test-risk calculation so prioritization reflects risk rather than raw severity
Run an end-to-end remediation cycle from vulnerable item to closed remediation task
Your checkpoint
A remediation cycle report covering one vulnerability group closed through tasks plus one approved exception, with the risk score justification recorded
Integrations, Flows, and Reporting
Build a Flow Designer flow that triggers on a security incident event and performs at least three automated actions
Configure an outbound integration to an external system using the available REST or integration framework capability and log the response
Build three reports covering incident volume, mean time to close, and open critical vulnerabilities
Assemble the reports into a dashboard and add a scheduled email delivery
Your checkpoint
A published dashboard with three working reports and one triggered flow, demonstrated by a flow execution log
Security Operations Fundamentals and Setup & Security Incident Response & Threat Intelligence & Vulnerability Response & Integrations, Flows, and Reporting
Re-audit every domain against the exam blueprint and rate personal confidence per objective
Re-run the weakest two hands-on deliverables from weeks 1 through 7 without notes
Complete two timed practice sets and log every missed objective with the reason for the miss
Close the top five logged gaps by re-reading platform documentation on those specific features
Your checkpoint
A gap remediation sheet with every sub-60-percent objective re-tested and a final timed practice score of 85 percent or higher
Milestones
Week 2: Can explain the Security Operations data model and demonstrate auto-routed incident creation plus a playbook generating tasks and SLA without reference notes
Week 4: Two threat intelligence feeds are live and observables on a test incident are automatically matched and linked
Week 6: A vulnerability has traveled from scanner import through reconciliation, remediation task, and closure, with a documented exception path
Week 8: Dashboard with three reports and one triggered flow is published, and the final timed practice score is at or above 85 percent