The ServiceNow CIS-SIR certification covers implementing ServiceNow Security Incident Response. This guide sets out the prerequisite, how the exam is delivered, the six official domains, the courses ServiceNow recommends and a way to prepare.
CIS-SIR at a glance
| Detail | CIS-SIR |
|---|---|
| Full name | ServiceNow Certified Implementation Specialist – Security Incident Response |
| Prerequisite | CIS-Data Foundations (CMDB and CSDM) |
| Duration | 1 hour 30 minutes |
| Delivery | Proctored Pearson VUE exam |
| Booked through | ServiceNow University |
| Price | 450 learning credits on ServiceNow University |
| On passing | The CIS-SIR certification and a Credly digital badge |
| Blueprint | Updated January 2026 |
Who it is for
ServiceNow says the exam confirms that you can configure, implement and maintain a ServiceNow Security Incident Response solution. The certification covers managing security incidents, integrating threat intelligence, automating responses and using visualization tools, with the aim of streamlining incident response and post-incident reviews. If you implement Security Incident Response for clients or your own security team, it is aimed at you.
The prerequisite
ServiceNow’s exam listing states that candidates must hold the Certified Implementation Specialist – Data Foundations (CMDB and CSDM) certification before attempting the CIS-SIR exam. It is the only prerequisite listed. The CSA is not on the list.
ServiceNow also publishes a suggested path to the certification:
- Suggested pre-requisites: Welcome to ServiceNow; ServiceNow Administration Fundamentals or the CSA, which ServiceNow treats as equivalent; Get Started with the Now Create Methodology; and ServiceNow Platform Implementation.
- Data Foundations: complete the recommended Data Foundations training and earn the required CIS-Data Foundations certification.
- Recommended specialization courses: Security Operations (SecOps) Fundamentals and Security Incident Response (SIR) Implementation.
- The CIS-SIR exam.
How the exam is delivered
CIS-SIR is a proctored Pearson VUE exam with a duration of 1 hour 30 minutes. You register on ServiceNow University, which lists the exam at 450 learning credits and also accepts payment by credit card. Pearson VUE’s ServiceNow page covers both OnVUE online testing and test centres, and sends you to ServiceNow University to schedule, reschedule or cancel. After the exam, your Pearson score report is in ServiceNow University under My University Account, then My Exams.
The six official domains
ServiceNow’s CIS-SIR exam blueprint (updated January 2026) weights the domains as follows:
| Domain | Weight |
|---|---|
| Automation and Standard Processes | 30% |
| Security Incident Response Overview and Data Visualization | 15% |
| Security Incident Response Management | 15% |
| Security Incident Creation and Threat Intelligence | 14% |
| Security Incident and Threat Intelligence Integrations | 14% |
| Risk Calculations and Post Incident Response | 12% |
Automation and Standard Processes is the largest domain by a wide margin, at 30%. The other five domains carry between 12% and 15% each.
Official study resources
- Security Operations (SecOps) Fundamentals: a self-paced on-demand course of about 10 hours on ServiceNow University, also offered as a 2-day instructor-led course. It gives a high-level view of ServiceNow’s Security Operations products, including Security Incident Response, Vulnerability Response and Threat Intelligence.
- Security Incident Response (SIR) Implementation: a self-paced on-demand course of about 7 hours, also offered as a 2-day instructor-led course. ServiceNow describes it as a best-practice approach to responding to security incidents that is compliant with the NIST framework. Its objectives include creating security incidents, dashboards and reports, the MITRE ATT&CK framework, SIR integrations, the Security Incident Response Workspace, security tags, calculators and risk scores, process definitions and selection, post-incident reviews, workspace playbooks and user-reported phishing.
- ServiceNow product documentation for Security Incident Response, at servicenow.com/docs, including the pages on Security Incident Response playbooks.
- A Personal Developer Instance: ServiceNow offers free personal developer instances through its Developer Site, for learning and experimenting on the platform.
A suggested 6-week study plan
This is our suggested plan if you already hold CIS-Data Foundations and can study 6–8 hours a week. It follows the domain weights, so Automation and Standard Processes gets the most time.
- Week 1: Overview and Data Visualization. Work through the SecOps Fundamentals course, then the SIR dashboards and reports.
- Week 2: Security Incident Creation and Threat Intelligence. Start the SIR Implementation course; cover how security incidents are created, threat intelligence and the MITRE ATT&CK framework.
- Week 3: Integrations and Security Incident Response Management. SIR integrations, the Security Incident Response Workspace and security tags.
- Week 4: Automation and Standard Processes. Process definitions and selection, and playbooks, using the course and the playbook pages in the documentation.
- Week 5: Automation, continued, then Risk Calculations and Post Incident Response. Calculators, risk scores and post-incident reviews.
- Week 6: practice exams. Take full-length timed practice exams, read every explanation, and go back to the documentation for the domains where you score lowest.
I run ExamCrest, where this guide first appeared. Try free CIS-SIR practice questions: https://examcrest.com/exam/sn-sir/free-questions?utm_source=devto&utm_campaign=cis-sir-guide-copy
