href="#uf1d9ad8b-3831-5cd7-8536-aa54fe734c1d">15,
18
|
6.3.1
|
Account management
|
15
|
|
6.3.2
|
Management review and approval
|
15
|
|
6.3.3
|
Key performance and risk indicators
|
15
|
|
6.3.4
|
Backup verification data
|
15
|
|
6.3.5
|
Training and awareness
|
15, 18
|
|
6.3.6
|
Disaster Recovery (DR) and Business Continuity (BC)
|
18, 3
|
|
6.4
|
Analyze test output and generate report
|
15
|
|
6.4.1
|
Remediation
|
15
|
|
6.4.2
|
Exception handling
|
15
|
|
6.4.3
|
Ethical disclosure
|
15
|
|
6.5
|
Conduct or facilitate security audits
|
15
|
|
6.5.1
|
Internal
|
15
|
|
6.5.2
|
External
|
15
|
|
6.5.3
|
Third-party
|
15
|
|
Domain 7
|
Security Operations
|
|
|
7.1
|
Understand and comply with investigations
|
19
|
|
7.1.1
|
Evidence collection and handling
|
19
|
|
7.1.2
|
Reporting and documentation
|
19
|
|
7.1.3
|
Investigative techniques
|
19
|
|
7.1.4
|
Digital forensics tools, tactics, and procedures
|
19
|
|
7.1.5
|
Artifacts (e.g., computer, network, mobile device)
|
19
|
|
7.2
|
Conduct logging and monitoring activities
|
17, 21
|
|
7.2.1
|
Intrusion detection and prevention
|
17
|
|
7.2.2
|
Security Information and Event Management (SIEM)
|
17
|
|
7.2.3
|
Continuous monitoring
|
17
|
|
7.2.4
|
Egress monitoring
|
17
|
|
7.2.5
|
Log management
|
17
|
|
7.2.6
|
Threat intelligence (e.g., threat feeds, threat hunting)
|
17
|
|
7.2.7
|
User and Entity Behavior Analytics (UEBA)
|
21
|
|
7.3
|
Perform Configuration Management (CM) (e.g., provisioning, baselining, automation)
|
16
|
|
7.4
|
Apply foundational security operations concepts
|
16
|
|
7.4.1
|
|
href="#uf1d9ad8b-3831-5cd7-8536-aa54fe734c1d">15, 18
