712-50 Question 124
Single answerLeading Innovative and Risky ProjectsA global financial services company is launching an AI-driven fraud detection platform that will ingest transaction data from multiple regions and use a newly acquired cloud-native analytics engine. The CEO wants the system deployed within six months to reduce fraud losses, but the legal team has raised concerns about cross-border data transfer, the model team wants broad access to production data for tuning, and the cloud engineering group has not yet completed its security architecture review. As the CISO, you have been asked to lead the initiative without delaying the strategic business objective. What is the BEST course of action?
- A
Approve the project immediately because fraud reduction is a business priority, and address legal and architectural issues during post-implementation hardening.
- B
Stop the project until every technical, legal, and operational risk is fully eliminated, then resume deployment once a zero-risk state is achieved.
- C
Establish a risk-based governance structure for the project, require a formal risk assessment and data protection impact review, define compensating controls and stage gates, and obtain documented business risk acceptance for residual risks before production rollout.
- D
Delegate security decisions to the cloud engineering manager because the implementation risk is primarily technical and outside executive security leadership.
Show answer and explanation
Correct answer: C
Explanation
The best answer is to lead the project through formal, risk-based governance while enabling the business objective. In CCISO practice, leading innovative and risky projects requires balancing opportunity, time-to-market, compliance obligations, and enterprise risk appetite. The CISO should ensure that major initiatives involving emerging technology, sensitive data, and new vendors or platforms go through structured review mechanisms such as security architecture assessments, privacy impact or data protection impact assessments where applicable, phased approvals, and formal residual risk acceptance by appropriate business owners.
This approach is consistent with widely accepted practices from enterprise risk management and security governance frameworks. For example, ISO 27001 and ISO 27005 emphasize risk assessment and treatment rather than unrealistic risk elimination. NIST guidance, including the NIST Risk Management Framework, supports categorizing systems, selecting and implementing controls, assessing effectiveness, and authorizing operation based on residual risk. From a privacy perspective, impact assessments are a recognized best practice when introducing new processing activities involving personal data, especially across jurisdictions. In executive leadership terms, the CISO's role is to provide decision-quality risk information, define control expectations, coordinate stakeholders, and support informed business decisions rather than either obstructing innovation or allowing unmanaged exposure.
- A. Incorrect.
This is incorrect because it prioritizes speed over governance and due diligence in a high-risk initiative involving regulated data, cross-border processing, and a new cloud platform. A CCISO is expected to enable business objectives, but not by bypassing risk management. Deferring legal, privacy, and architecture issues until after deployment can create compliance violations, unmanaged residual risk, and weak accountability. This reflects a common misconception that security can be retrofitted later without strategic consequences.
- B. Incorrect.
This is incorrect because it assumes that all risk can be removed before proceeding. Executive security leadership is expected to manage risk to an acceptable level, not eliminate it entirely. Innovative projects inherently involve uncertainty, and insisting on a zero-risk condition is impractical, likely to undermine business strategy, and inconsistent with risk-based decision-making. The misconception here is confusing prudent governance with risk avoidance.
- C. Correct.
This is correct because it aligns with the CCISO role of enabling innovation through structured governance, not blocking it or rubber-stamping it. A formal risk assessment helps identify threats, vulnerabilities, and business impact; a data protection impact review is appropriate where sensitive personal or regulated data may be processed across jurisdictions; compensating controls and stage gates allow the project to move forward in a controlled manner; and documented risk acceptance ensures accountable executive decision-making for any residual risk. This approach balances strategic urgency with security, compliance, and operational discipline.
- D. Incorrect.
This is incorrect because while cloud engineering should own technical implementation tasks, the CISO cannot abdicate accountability for enterprise security governance, risk oversight, and cross-functional coordination. The scenario includes legal, privacy, access management, and business risk considerations that require executive leadership. This option reflects the misconception that security leadership is merely a technical advisory function rather than a business governance role.