thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

ServiceNow · Cybersecurity · Professional

ServiceNow CIS - Security Incident Response exam guide

Exam ServiceNow Certified Implementation Specialist - Security Incident Response (CIS-SIR)

CIS-SIR proves you can implement ServiceNow Security Incident Response: security incident creation from SIEM and other sources, playbooks, threat intelligence enrichment, response tasks and post-incident reviews.

QuestionsSee official page
Time limitSee official page
Passing scoreSee official page
Exam feeSee official page
Valid forSee official page
DeliveryProctored exam booked through ServiceNow University (online proctored or test center)

Format: Multiple choice and multiple select, proctored. Fee note: ServiceNow sets voucher pricing in ServiceNow University; check there before booking (a retake costs less than a first attempt).

Who it's for

SOC engineers and ServiceNow consultants who implement security incident workflows.

What the exam covers

The vendor does not publish a domain breakdown for this exam. Check the official exam page for the current objectives.

Eligibility & prerequisites

Required: ServiceNow Certified System Administrator (CSA) plus completion of the required ServiceNow University implementation training for this product before you can book the exam.

Recommended: Experience in a SOC or incident response role and with ServiceNow security operations configuration.

Keeping it active

ServiceNow mainline certifications must be kept current with the platform: complete the maintenance (delta) requirement ServiceNow publishes for new platform releases within its window, or the credential lapses. Check the current maintenance rules in ServiceNow University.

Skills & careers

Skills it validates

  • Configuring security incident intake from SIEM, email and users
  • Building playbooks with Flow Designer
  • Configuring threat intelligence enrichment
  • Calculating security incident severity and risk
  • Managing response tasks and post-incident reviews
  • Building SOC dashboards

Job roles

SOC AnalystServiceNow SecOps ConsultantIncident Response EngineerSecurity Automation EngineerServiceNow Implementation Specialist

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Complete the required SIR implementation training on ServiceNow University.
  2. Week 2: Security incident data model, intake channels and SIEM integrations.
  3. Week 3: Playbooks, enrichment, threat intelligence and calculator groups for severity.
  4. Week 4: Response tasks, post-incident review, reporting; practice tests.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know how security incidents differ from IT incidents (data separation, roles).
  • Understand how playbooks are built and triggered.
  • Expect questions on severity calculators and their inputs.
  • Know how observables and threat intelligence enrich incidents.

Key terms for this exam

All 9 terms Study with thinQcards™

Frequently asked questions

How much does the CIS-SIR exam cost?

ServiceNow sets exam voucher pricing in ServiceNow University and it can differ by region and by whether you hold a subscription or partner/customer entitlement; check the current price there before booking. Retakes cost less than a first attempt.

How do I keep CIS-SIR active?

Keep it current with each ServiceNow family release by completing the maintenance (delta) requirement ServiceNow publishes within its window; otherwise the certification lapses.

Does CIS-SIR count for DoD 8140?

No. It is a product implementation credential.

CIS-SIR vs CIS-VR?

SIR covers responding to security incidents; VR covers managing vulnerabilities from scanners. SecOps consultants often hold both.

What is required before the exam?

CSA plus the required SIR implementation training in ServiceNow University.

Official page: www.servicenow.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.