7.5 Apply resource protection techniques

• 7.5.1 Media Management
• 7.5.2 Hardware and software asset management
• 7.5.3 Data at rest/Data in transit

7.3 Perform Configuration Management (e.g., provisioning, baselining, automation)

7.4 Apply foundational security operations concepts

• 7.4.1 Need to know/Least privileges
• 7.4.2 Separation of Duties (SoD) and responsibilities
• 7.4.3 Privileged account management
• 7.4.4 Job rotation
• 7.4.5 Service Level Agreement (SLA)

7.2 Conduct logging and monitoring activities

• 7.2.1 Intrusion detection and prevention systems (IDPS)
• 7.2.2 Security information and Event Management (SIEM)
• 7.2.3 Security orchestration, automation, and response (SOAR)
• 7.2.4 Continuous Monitoring
• 7.2.5 Egress Monitoring
• 7.2.6 Log Management
• 7.2.7 Threat Intelligence (e.g. Threat feeds, threat hunting)
• 7.2.8 User and Entity Behavior Analytics (UEBA)

7.0 DOMAIN 7: SECURITY OPERATIONS

• 7.1 Understand and support investigations
• 7.1.1 Evidence Collection and Handling
• 7.1.2 Reporting and Documentation
• 7.1.3 Investigation Techniques
• 7.1.4 Digital forensics tools, tactics, and procedures
• 7.1.5 Artifacts (e.g., data, computers, networks, mobile devices)

6.4 Analyze test output and generate report

• 6.4.1 Remediation
• 6.4.2 Exception Handling
• 6.4.3 Ethical disclosure

6.5 Conduct or facilitate security audits

• 6.5.1 Internal
• 6.5.2 External
• 6.5.3 Third Party
• 6.5.4 Location

6.3 Collect Security Process data

• 6.3.1 Account Management
• 6.3.2 Management review and approval
• 6.3.3 Key Performance and Risk Indicator
• 6.3.4 Backup Verification data
• 6.3.5 Training and Awareness
• 6.3.6 Disaster Recovery (DR) and Business Continuity (BC)

6.2 Conduct Security Control Testing

• 6.2.1 Vulnerability Assessment
• 6.2.2 Penetration Testing
• 6.2.3 Log Reviews
• 6.2.4 Synthetic Transaction
• 6.2.5 Code review and testing
• 6.2.6 Misuse case testing
• 6.2.7 Coverage analysis
• 6.2.8 Interface Testing
• 6.2.9 Breach attack simulations (BAS)
• 6.2.10 Compliance checks

6.0 DOMAIN 6: SECURITY ASSESSMENT AND TESTING

• 6.1 Design and Validate assessment, test, and audit strategies
• 6.1.1 Internal
• 6.1.2 External
• 6.1.3 Third-party
• 6.1.4 Location (e.g. on-premises, cloud, hybrid)

5.5 Manage the identity and access provisioning lifecycle

• 5.5.1 Account access review (e.g., user, system, service)
• 5.5.2 Provisioning and deprovisioning (e.g., on/off boarding & transfers)
• 5.5.3 Role definition & transition (e.g. people assigned to new roles)
• 5.5.4 Privilege escalation (e.g. use of sudo, auditing its use)
• 5.5.5 Service Accounts Management
• 5.5.6 Implement Authentication Systems

5.4 Implement and manage authorization mechanisms