CIS-SIR
1Security Incident Response Components
15%
2MITRE ATT&CK Framework
14%
3Threat Intelligence Service Center
14%
4Process Definitions and Selection
15%
5Event Management
12%
6User Reported Phishing
30%
Exam guide · CIS-SIR
ServiceNow Implementation Specialist – Security Incident Response exam guide
The CIS-SIR exam has 60 questions and takes 90 minutes. ServiceNow doesn’t publish a passing score. It costs $450 (before customer and partner discounts). ServiceNow hasn’t announced a retirement date.
Last updated
The exam at a glance
ServiceNow Implementation Specialist – Security Incident Response (CIS-SIR)
- Questions
- 60
- Time
- 90 min
- Passing score
- Not published by ServiceNow
- ServiceNow shows results as a conditional pass or fail
- ServiceNow’s exam blueprints
- Recommended experience
- CIS – Data Foundations first · 3–6 months with SIR
- Level
- Implementation Specialist
- Role
- Security Operations Implementer
- Upkeep
- Yearly delta
- Exam code
- CIS-SIR
From ServiceNow’s own pages, checked every week (last on November 7, 2026). The cost is checked every week too. How we check our facts
Versions and dates
What’s changing, and when
ServiceNow hasn’t announced a retirement date for CIS-SIR. We check ServiceNow’s site every week, and this page changes the day it does.
Exam domains
What the exam covers
Each domain’s share of the exam, as ServiceNow publishes it. Spend your study time in the same proportion.
Prepare
Start on ServiceNow CIS-SIR today
Free tools to find your weak domains and plan your weeks, then full practice exams in OpenpassAI.
Free practice test
10 CIS-SIR questions
Original questions across the exam’s domains, each with an explanation, and your score by domain.
Take the testFree study plan
A week-by-week plan
Pick your exam date and weekly hours, and get a plan weighted like the domains above.
Make my planServiceNow certifications
Where Security Incident Response fits
Every ServiceNow certification on one map, with each exam’s facts checked weekly.
See the ServiceNow page
Take it further in OpenpassAI
Full ServiceNow CIS-SIR practice exams
Timed exams weighted like the real one, an AI tutor that explains every answer, and a readiness score for each domain.
FAQs
Got Questions? We’ve Got Answers.
Find quick answers or contact our support team.
How many questions are on the ServiceNow Implementation Specialist – Security Incident Response exam?
The CIS-SIR exam has 60 questions, and you get 90 minutes.
What is the passing score for ServiceNow Implementation Specialist – Security Incident Response?
ServiceNow doesn’t publish a passing score for CIS-SIR. ServiceNow shows results as a conditional pass or fail.
How much does the ServiceNow Implementation Specialist – Security Incident Response exam cost?
$450 (before customer and partner discounts). Check ServiceNow’s site for the price in your country.
When does CIS-SIR retire?
ServiceNow hasn’t announced one yet. We check ServiceNow’s site every week, and this page changes the day it does.
What experience do I need for ServiceNow Implementation Specialist – Security Incident Response?
ServiceNow recommends CIS – Data Foundations first · 3–6 months with SIR. It isn’t required to sit the exam.
How should I study for ServiceNow Implementation Specialist – Security Incident Response?
Weight your time like the exam: User Reported Phishing carries the most (30%). Take the free practice test to find your weakest domains, make a study plan around them, and before you book, sit full-length timed practice exams until you pass them comfortably.
More exam guides
ServiceNow Implementation Specialist – IT Service Management
CIS-ITSM
- Questions: 60
- Time: 90 min
ServiceNow Implementation Specialist – Software Asset Management
CIS-SAM
- Questions: 60
- Time: 90 min
ServiceNow Implementation Specialist – Hardware Asset Management
CIS-HAM
- Questions: 60
- Time: 90 min
ServiceNow Implementation Specialist – Strategic Portfolio Management
CIS-SPM
- Questions: 60
- Time: 90 min
