Certified Implementation Specialist - Security Incident Response (CIS-SIR) Mainline Exam Blueprint


ServiceNow Logo.png
 
 
Updated January 2026

 

Introduction

The ServiceNow Certified Implementation Specialist – Security Incident Response Exam Specification document defines the purpose, audience, testing options, exam content coverage, test framework, and prerequisites for earning the Certified Implementation Specialist – Security Incident Response certification.

 

Exam Purpose

The Certified Implementation Specialist – Security Incident Response exam confirms you have the knowledge and skills to configure, implement, and maintain a ServiceNow Security Incident Response solution. This certification validates their ability to manage security incidents, integrate threat intelligence, automate responses, and use visualization tools. Certified individuals enhance security by streamlining incident response and post-incident reviews.  

 

Exam Audience

The ServiceNow Certified Implementation Specialist – Security Incident Response exam is available to ServiceNow customers, partners, employees, and others interested in becoming a ServiceNow Certified Implementation Specialist – Security Incident Response. Here is the recommended experience:

    • Three to six months of field experience participating in a ServiceNow Security Incident Response deployment project or maintaining the Security Incident Response application suite in a ServiceNow instance.
       

Exam Prerequisites 

Prerequisite Certification 

  • Candidates must hold the Certified Implementation Specialist – Data Foundations (CMDB and CSDM) Certification before registering for this exam. 

Exam Preparation

Exam questions are based on official ServiceNow training materials, the ServiceNow Security Incident Response - ServiceNow Docs and the ServiceNow developer site. Study materials posted elsewhere online are not official and should not be used to prepare for the examination.

ServiceNow recommends completing these training course(s) in preparation for the Certified Implementation Specialist – Security Incident Response (CIS-SIR) exam.

    • Welcome to ServiceNow
    • ServiceNow Administration Fundamentals
    • ServiceNow Platform Implementation 
    • Automated Test Framework Fundamentals
    • Workflow Studio Fundamentals
    • Flow Designer Fundamentals
    • IntegrationHub Fundamentals
    • Mobile Development Essentials 
    • Service Portal Fundamentals 
    • Common Service Data Model Fundamentals 
    • Configuration Management Database Fundamentals 
    • Now Experience UI Builder Fundamentals 
    • Configuration Compliance Essentials 
    • What’s New in the Store for Security Operations
    • Now Assist for SIR Bootcamp
    • Security Operations Fundamentals
    • Security Incident Response Implementation

Additional Recommended Resources

In addition to the above, these additional resources are valuable in preparation for the exam.

 

Exam Scope

This table shows the exam domains, weightings, sub-topics, and the percentage of questions represented in each domain. The listed sub-skills should NOT be considered an all-inclusive list of the exam content.  

 

Number of Domains

Exam Domain

Percent of Exam

1

Security Incident Response Overview and Data Visualization

  • Introducing Security Incident Response
  • Data Visualization
  • Security Incident Response - Components

15%

2

Security Incident Creation and Threat Intelligence 

  • Explore How to Create Security Incidents 
  • Major Security Incident Management 
  • Understanding Threat Intelligence 
  • MITRE ATT&CK Framework

14%

3

Security Incident and Threat Intelligence Integrations 

  • ServiceNow Store and Share 
  • Managing Pre-Built Integrations 
  • Creating Custom Integrations
  • Threat Intelligence Service Center 

14%

4

Security Incident Response Management 

  • Security Incident Response Workspace
  • Standard Automated Assignment Options and Escalation Paths
  • Security Tags 
  • Process Definitions and Selection 

15%

5

Risk Calculations and Post Incident Response 

  • Security Incident Calculator Groups and Risk Scores 
  • Post Incident Reviews
  • Event Management

12%

6

Automation and Standard Processes 

  • Automate Security Incident Response Overview 
  • Security Incident Process Automation Using Playbooks and Runbooks
  • User Reported Phishing

30%

Total

100%

 

Exam Registration

Step 1: Register for your exam 

  • Registration = payment. This step secures your exam attempt. Learning credits and credit card payments are accepted. Instructor-led training completion includes one free exam attempt. Discounted exam pricing may be available through associated company benefits.  
  • You can register at any time. Once registered, you have 90 days to schedule and complete your exam. 
  • Exam fees are non-refundable. Register only when you are prepared to schedule your exam. 

Step 2: Schedule your exam 

  • Click here to register for the CIS-SIR exam. Note: ServiceNow provides reasonable accommodation to individuals with disabilities or English as a Second Language (ESL) while taking the certification exam. 

  • Schedule within 90 days. After registration, you must schedule your exam appointment and complete your exam within 90 days. 
  •  

Step 3: Choose your exam delivery method 

  • From the My Exams page, you will be directed to Pearson. 
  • Choose to take your exam at a Pearson test center or online with OnVUE, where proctors observe via a webcam. 

Step 4: Complete your exam  

  •  If you do not complete your exam within 90 days, your registration will expire, and you will need to register and pay the full exam fee again (start at step 1 again). 

 

Exam Structure

Exam Duration

The exam duration is 90 minutes.

Number of Items

The exam consists of 60 questions.

 

Multiple Choice (single answer)

For each multiple-choice question on the exam, there are at least three possible responses. Select the correct response. 

Multiple Select (select all that apply)

There are at least four possible responses for each multiple-select question on the exam. The question will state how many responses should be selected. Select ALL correct responses. Partial credit is not provided.

 

Exam Result

An exam result notification is immediately displayed as a *conditional pass or fail after completing and submitting the exam.  

In addition, an exam result report is available and shows your exam result and the percentage of items in each section you answered correctly. Your exam result is conditional, meaning your results are preliminary and may be updated upon final review.  

*A conditional result means the exam can be audited and reviewed at any time, and the certification may be revoked after investigation if it is found that the ServiceNow Test Security Policies have been violated.    

 Understanding Your Results: 

 
Each question on the exam is worth one point. Your total score is compared to a predetermined cut score - this score is not publicly shared and is not always 70%  - to determine a pass or fail outcome. The section percentages on the exam result notification show how you performed in each domain, but they do not determine your overall result, should not be averaged, and do not indicate expertise. 

If You Pass: 

    • You will earn the Certified Implementation Specialist – Security Incident Response (CIS-SIR) certification and receive a Credly digital badge to showcase your achievement. 

    • To maintain your certification, complete annual maintenance exams (deltas) and pay the yearly Certification Maintenance Program (CMP) fee. 

If You Do Not Pass: 

  • Review the exam blueprint and the recommended training before retaking the exam.
  • The retake policy requires a waiting period between attempts and payment of the exam fee for each attempt. 

 

Sample Questions

Sample Item #1

Which role is needed to install the Security Incident Response application? 

A. sn_si.admin 

B. admin 

C. sn_sec_cmn.admin 

D. sn_si.write 

Correct Answer: B 

 

Sample Item #2

How is Security Incident Response defined?

A. The action plan taken to mitigate security incidents and imminent security threats 

B. The change plan taken to fulfill requests raised through the Security Incident Catalog 

C. The reaction plan taken to capture and record security incidents 

D. The response plan taken to react to imminent security threats 

Correct Answer: A 

 

Sample Item #3:

In which ServiceNow module can you find pre-built integrations? 

A. Integrations 

B. Sightings Search Configuration 

C. Integration Configurations 

D. Integration Status 

Correct Answer: C 

 

Sample Item #4:

Which process definition is set as default for security incident response application? 

A. NIST Open 

B. SANS Open 

C. SANS Stateful 

D. NIST Stateful 

Correct Answer: D 

 

Sample Item #5:

Which statements best describes what Security Incident Calculators are used to do? 

A. Set specific values according to matched conditions 

B. Determine the Security Incident Risk Score 

C. Calculate the cost of an incident 

D. Calculate the time spent in the various incident states 

Correct Answer: A 

 

Sample Item #6:

Under what condition does a flow execute? 

A. trigger condition 

B. IntegrationHub activation 

C. Response Task state is Active 

D. NIST Ready State 

Correct Answer: A 

 

Sample Item #7:

Who are the key reporting audiences for Security Incident Response? (choose three)

A. Security Analysts 

B. Security Managers 

C. CIOs/CISOs 

D. Facilities Managers 

E. Human Resources Managers 

Correct Answers: A, B, C 

Back to top