ServiceNow CIS-VR exam guide 2026: prerequisite, domains and how to prepare

The ServiceNow Certified Implementation Specialist – Vulnerability Response (CIS-VR) exam checks that you can configure, implement and maintain ServiceNow Vulnerability Response. This guide covers the prerequisite, how the exam is booked and delivered, the five official domains and a way to prepare.

CIS-VR at a glance

Who it is for

ServiceNow says the certification shows you can manage vulnerability data, connect scanners, automate the response to vulnerabilities and work with tools such as workspaces and remediation workflows. Its intended audience is ServiceNow customers, partners, employees and anyone else interested in the certification.

ServiceNow recommends three to six months of field experience, either on a Vulnerability Response deployment project or maintaining the Vulnerability Response application suite in a ServiceNow instance.

The prerequisite

You must hold the Certified Implementation Specialist – Data Foundations (CMDB and CSDM) certification before you register for CIS-VR. It is the only prerequisite in the exam’s prerequisite data on ServiceNow University.

The Certified System Administrator (CSA) is not a prerequisite. ServiceNow’s credential path for CIS-VR lists ServiceNow Administration Fundamentals/CSA as a suggested pre-requisite, alongside Welcome to ServiceNow, Get Started with the Now Create Methodology and ServiceNow Platform Implementation.

Booking and taking the exam

1. Register on ServiceNow University. Registering is paying: the exam costs 450 learning credits, and both learning credits and credit cards are accepted. Exam fees are non-refundable, so register only when you are ready to schedule. Completing an instructor-led course includes one free exam attempt.
2. Schedule and sit it within 90 days. If you do not complete the exam within 90 days of registering, the registration expires and you have to register and pay again.
3. Choose how to sit it. You are passed to Pearson VUE and can take the exam at an authorised Pearson test centre or online with OnVUE, where a proctor watches by webcam.
4. Get your result. A conditional Pass or Did Not Pass appears straight after the exam. If you pass, you receive the certification and a Credly digital badge.

If you do not pass: ServiceNow requires a waiting period between attempts, and you pay the exam fee for each attempt. The full retake rules are in ServiceNow’s Credentialing Program Guide.

The five official domains

The CIS-VR exam blueprint on ServiceNow University sets out the domains, their weightings and the objectives. You need to sign in to ServiceNow University to read it. The domains and weights are:

The first two domains carry half of the weight between them, and the top four together carry 93%.

Official study resources

ServiceNow’s exam page says the recommended courses are not required, but it strongly recommends finishing them before you register, because they are designed to align with the exam blueprint.

• Implementer Vulnerability Response credential path on ServiceNow University: the suggested pre-requisites, the CIS-Data Foundations step, the recommended courses and the exam, in order.
• Security Operations (SecOps) Fundamentals: a 2-day instructor-led or self-paced on-demand course on the Security Operations suite, including Vulnerability Response, Security Incident Response and Threat Intelligence.
• Vulnerability Response Implementation: a 2-day instructor-led or self-paced on-demand course. Its topics include how data is organised in Vulnerability Response, tools to manage that data, vulnerability integration and solution management, and remediation.
• ServiceNow product documentation for Vulnerability Response, in the Security Management section of servicenow.com/docs.
• A Personal Developer Instance: a free ServiceNow instance from developer.servicenow.com. The exam page suggests getting hands-on practice on your own ServiceNow environment.

A suggested 6-week study plan

This is our suggested plan if you already hold CIS-Data Foundations and can study 6–8 hours a week. It follows the domain weights, so the largest domains get the most time.

1. Week 1: work through SecOps Fundamentals and start the Vulnerability Response Implementation course. Read the CIS-VR blueprint once from start to finish.
2. Week 2: Vulnerability Response Applications and Modules (25%). Finish the implementation course and make notes on each application and module it covers.
3. Week 3: Getting Data into Vulnerability Response (25%). Go back over the course material on vulnerability integration and data organisation, and read the matching documentation.
4. Week 4: Tools to Manage Vulnerability Response (23%). Review the tools and remediation material, and try what you can in your own instance.
5. Week 5: Automating Vulnerability Response (20%) and Dashboards and Reports (7%).
6. Week 6: practice exams. Take full-length timed practice exams, read every explanation, and go back to the documentation for the domains where you score lowest.

Keeping your certification

To keep CIS-VR current, ServiceNow requires you to complete annual maintenance exams (deltas) and pay the yearly Certification Maintenance Program (CMP) fee.

I run ExamCrest, where this guide first appeared. Try free CIS-VR practice questions: https://examcrest.com/exam/sn-vr/free-questions?utm_source=devto&utm_campaign=cis-vr-guide-copy