Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by ServiceNow
Exam Format
90 min
60
70% (approximate, exact score not disclosed)
Professional
Registration
$450 USD
Kryterion Test Centers or online proctoring
English
Validity
2 years
Pass the delta exam when available; Pass the current mainline exam; Maintain active Certification Maintenance Program (CMP) membership
CIS-SIR Exam Topics and Domains
CIS-SIR is organized into 6 weighted domains. Expect to work with Email Parser, Flow Designer, IntegrationHub, Action Designer, and more.
1
Security Incident Response Overview and Data Visualization
15%
Introducing Security Incident Response
SIR Purpose and FeaturesInstallation and Configuration
- Understand the purpose and core features of Security Incident Response
- Identify installation requirements and roles needed
- Explain how SIR integrates with the ServiceNow platform
Data Visualization
Dashboards and Reports
- Navigate and utilize Security Incident Response dashboards
- Interpret data visualizations for security metrics
- Create and customize reports
Security Incident Response - Components
Core Components
- Identify and describe all major components of SIR
- Understand how components interact
2
Security Incident Creation and Threat Intelligence
14%
Explore How to Create Security Incidents
Incident Creation Methods
- Create security incidents through various methods
- Understand required vs optional fields
- Configure automated incident creation
Major Security Incident Management
Major Incident Handling
- Define criteria for major security incidents
- Configure escalation paths
- Manage major incident workflows
Understanding Threat Intelligence
Threat Intelligence Integration
- Configure and manage threat intelligence feeds
- Enrich security incidents with threat data
- Correlate threats across incidents
MITRE ATT&CK Framework
ATT&CK Integration
- Apply MITRE ATT&CK framework to incidents
- Map threats to tactics and techniques
- Use framework for threat analysis
3
Security Incident and Threat Intelligence Integrations
14%
ServiceNow Store and Share
Store Applications
- Navigate ServiceNow Store for security integrations
- Install and configure store applications
- Share integration configurations
Managing Pre-Built Integrations
Integration Configurations Module
- Configure pre-built integrations
- Monitor integration status
- Troubleshoot integration issues
Creating Custom Integrations
Custom Integration Development
- Create custom integrations using IntegrationHub
- Develop REST API integrations
- Build custom connectors for third-party tools
Threat Intelligence Service Center
TISC Configuration
- Configure Threat Intelligence Service Center
- Manage multiple threat feeds
- Correlate intelligence across sources
4
Security Incident Response Management
15%
Security Incident Response Workspace
Workspace Navigation
- Navigate Security Incident Response Workspace
- Customize workspace for efficiency
- Utilize workspace widgets effectively
Standard Automated Assignment Options and Escalation Paths
Assignment Rules
- Configure automated assignment rules
- Set up escalation paths
- Implement workload balancing
Security Tags
Tag Management
- Create and manage security tags
- Use tags for incident categorization
- Generate tag-based reports
Process Definitions and Selection
Process Framework
- Understand different process definitions
- Select appropriate process for organization
- Customize process definitions
5
Risk Calculations and Post Incident Response
12%
Security Incident Calculator Groups and Risk Scores
Risk Calculation
- Configure security incident calculators
- Understand risk scoring methodology
- Set values based on conditions
Post Incident Reviews
PIR Process
- Conduct post incident reviews
- Document lessons learned
- Track improvement actions
Event Management
Event Correlation
- Integrate with Event Management
- Correlate events to security incidents
- Reduce alert fatigue
6
Automation and Standard Processes
30%
Automate Security Incident Response Overview
Automation Fundamentals
- Understand automation capabilities in SIR
- Identify automation opportunities
- Select appropriate automation tools
Security Incident Process Automation Using Playbooks and Runbooks
Playbook ManagementOrchestration Actions
- Create and modify playbooks
- Implement runbook automation
- Configure orchestration actions
User Reported Phishing
Phishing Response
- Configure user reported phishing
- Automate phishing email analysis
- Implement phishing response workflows
How do I earn this certification?
Passing CIS-SIR earns the ServiceNow Certified Implementation Specialist - Security Incident Response certification. It sits in the Security Operations track.
Current Level Exams
Next Level Options
- CTA-SecOps - Certified Technical Architect - Security Operations
- CMA - Certified Master Architect
Alternative Paths
- CIS-ITSM - IT Service ManagementComplementary ITSM skills for incident management
- CIS-CPG - Cloud Provisioning and GovernanceCloud security and governance skills
- CAD - Certified Application DeveloperCustom security application development
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for CIS-SIR is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2025-01-01
Updates
- Security Posture Control Washington D.C. May appear in future exam updates • Release date: 2024-10-01
- Now Assist for SecOps Xanadu AI-assisted features becoming exam relevant • Release date: 2024-07-01
- Interactive Investigation Canvas Store Update Enhanced threat analysis capabilities • Release date: 2024-08-01
Who should take this exam?
This exam is typically taken by ServiceNow Implementation Specialists and Security Operations Analysts.
ServiceNow Certified System Administrator (CSA) certification recommended but not mandatory
- Three to six months of field experience with ServiceNow Security Incident Response
- Completion of Security Operations Fundamentals course
- Completion of Security Incident Response Implementation course
- General familiarity with industry security terminology
- Experience with incident response processes