CySA+ (CS0-003) is organised into four operations-focused domains. This is a plain-English summary with approximate weightings; CompTIA’s official objectives are authoritative.
| # | Domain | Approx. weight |
|---|---|---|
| 1 | Security Operations | ~33% |
| 2 | Vulnerability Management | ~30% |
| 3 | Incident Response and Management | ~20% |
| 4 | Reporting and Communication | ~17% |
Domain 1 — Security Operations
System and network monitoring, SIEM and log analysis, threat intelligence, indicators of compromise, and identifying malicious activity. The core of SOC analysis.
Domain 2 — Vulnerability Management
Vulnerability scanning, interpreting results, CVSS scoring, prioritisation by real-world risk, and managing remediation and validation.
Domain 3 — Incident Response and Management
The incident-response lifecycle, analysis and triage, containment, eradication and recovery, and basic digital forensics.
Domain 4 — Reporting and Communication
Reporting vulnerabilities and incidents, communicating with technical and non-technical stakeholders, and supporting metrics and KPIs.