2 cissp ® Official Study Guide Eighth Edition

Emergency Management
Emergency management plans and practices help an organization address personnel safety and 
security after a disaster. Disasters can be natural (such as hurricanes, tornadoes, and earth-
quakes) or man-made (such as fires, terrorist attacks, or cyberattacks causing massive power 

---

710
Chapter 16 
■
Managing Security Operations
outages), as discussed in Chapter 18, “Disaster Recovery Planning.” Organizations will have 
different plans depending on the types of natural disasters they are likely to experience.
Security Training and Awareness
It’s also important to implement security training and awareness programs. These pro-
grams help ensure that personnel are aware of duress systems, travel best practices, emer-
gency management plans, and general safety and security best practices.
Securely Provisioning Resources
Another element of the security operations domain is provisioning and managing resources 
throughout their lifecycle. Chapter 13, “Managing Identity and Authentication,” covers 
provisioning and deprovisioning for user accounts as part of the identity and access provi-
sioning lifecycle. This section focuses on the provisioning and management of other asset 
types such as hardware, software, physical, virtual, and cloud-based assets.
Organizations apply various resource protection techniques to ensure that resources are 
securely provisioned and managed. As an example, desktop computers are often deployed 
using imaging techniques to ensure that they start in a known secure state. Change man-
agement and patch management techniques ensure that the systems are kept up-to-date 
with required changes. The techniques vary depending on the resource and are described in 
the following sections.
Managing Hardware and Software Assets
Within this context, hardware refers to IT resources such as computers, servers, rout-
ers, switches, and peripherals. Software includes the operating systems and applications. 
Organizations often perform routine inventories to track their hardware and software.