Platform Governance and Reporting
About 4% of the CIS-SP exam — see all 6 domains.
Smallest domain, but still tested.
- Reporting respects domain visibility: a report run by a customer user returns only that customer's data; a provider user with contains/visibility across domains can report across customers. The same report definition therefore yields different result sets depending on who runs it.
- Reports and dashboards are themselves domain-separable artifacts and can be scoped/overridden per domain.
- Governance: use domain logs to find errors/warnings caused by domain-separation misconfiguration (e.g., a record created in an unexpected domain, or a process that crossed a boundary). Delegated/limited administration lets a customer's own admin manage their domain without seeing siblings.
- Maintain governance over overrides — uncontrolled per-domain copies create maintenance drift; track which domains have diverged from the global baseline.
Sample questions from this domain
Three of the 12 in this domain, with the reasoning. The full set is in the question bank.
What is 'delegated administration' in a domain-separated service provider instance?
- A. Granting administrative capabilities scoped to a specific domain so a delegated admin manages only their domain's configuration/users. ✓
- B. Moving admin to global only.
- C. Giving every user full admin.
- D. Disabling all administration.
Why: Delegated administration lets a provider grant domain-scoped administrative rights so a delegated admin manages only their own domain's users and configuration, supporting multi-tenant governance. It is not universal admin, disabling administration, or global-only admin.
A service provider wants each customer's local administrator to manage that customer's users without seeing other customers. The appropriate mechanism is to:
- A. Place each customer admin in global.
- B. Use delegated/domain-scoped administration so the local admin's authority is limited to their domain. ✓
- C. Grant the security_admin role globally to each customer admin.
- D. Disable domain separation for admins.
Why: Domain-scoped delegated administration confines each local admin's authority to their own domain, preventing cross-customer access. Global security_admin, placing admins in global, or disabling separation would all over-expose other customers' data.
How does reporting across domains work for a provider-level (oversight) user?
- A. Reporting is disabled by domain separation.
- B. Reports always show every domain to everyone.
- C. A user with broad domain visibility (e.g., in global) can build reports spanning the domains they can see. ✓
- D. Reports can never span multiple domains.
Why: An oversight user with broad visibility (such as a global-domain user) can report across all the domains they are permitted to see, while customer users are limited to their own domain. Cross-domain reporting is possible for authorized users, is not universal to everyone, and is not disabled by separation.