712-50 Question 125
Single answerLeading Innovative and Risky ProjectsA global manufacturing company wants to deploy an AI-driven predictive maintenance platform across its plants. The solution will collect operational technology (OT) sensor data from production lines, send selected data to a cloud-based analytics provider, and allow plant engineers to receive automated maintenance recommendations. The CEO is sponsoring the initiative because of expected cost savings, but the board has asked the CISO to ensure the project is managed appropriately given the potential cyber, operational, regulatory, and third-party risks. The project team wants to move quickly and has asked the CISO for the BEST approach to lead security involvement without unnecessarily blocking innovation. What should the CISO do FIRST?
- A
Require the engineering team to complete implementation first, then conduct a full security assessment before production go-live to avoid delaying innovation
- B
Establish a risk-based governance approach that defines business objectives, risk appetite, security requirements, stakeholder accountability, and phased decision gates for the project
- C
Reject the project until the cloud provider agrees to accept full liability for any cyber incident affecting plant operations
- D
Focus primarily on deploying additional technical controls in the OT environment, since technical mitigation is the fastest way to reduce project risk
Show answer and explanation
Correct answer: B
Explanation
In CCISO-level practice, leading innovative and risky projects requires the CISO to act as a business and risk leader, not only as a technical specialist. The best first step is to establish a governance framework for the initiative: clarify the business case, identify stakeholders, define risk appetite and tolerance, assign accountability, and implement phased review gates so that risk decisions are made deliberately throughout the project lifecycle. This is especially important when a project spans OT, cloud, data sharing, third-party reliance, and operational resilience concerns. Best practices from enterprise risk management and governance frameworks support this approach. COBIT emphasizes governance objectives, stakeholder alignment, and managed risk. NIST guidance, including the NIST Risk Management Framework and NIST Cybersecurity Framework, supports integrating security and risk considerations early into system planning and design. ISO/IEC 27001 and ISO 31000 also reinforce risk-based management, defined ownership, and continual review. The key principle is that innovation should be enabled through structured governance and informed risk acceptance, not delayed by late security reviews or reduced to isolated technical controls.
- A. Incorrect.
This is incorrect because postponing security assessment until the end of implementation is a common failure in innovative projects. It creates expensive rework, increases the chance that unacceptable risks are embedded into architecture decisions, and weakens executive oversight. In high-impact initiatives involving OT, cloud integration, and third-party services, security should be engaged early through governance and risk-informed design rather than as a final checkpoint.
- B. Correct.
This is correct because the CISO's first responsibility in a high-risk, innovative initiative is to create governance that aligns the project with business goals and enterprise risk management. A risk-based governance model enables innovation while setting clear expectations for acceptable risk, required controls, ownership, escalation paths, and stage gates for architectural review, vendor due diligence, legal/privacy review, resilience planning, and go/no-go decisions. This approach is consistent with executive-level leadership expected of a CCISO, where the CISO balances opportunity and risk instead of acting solely as a technical approver.
- C. Incorrect.
This is incorrect because demanding full liability transfer from a provider is usually unrealistic and does not represent an effective first step for project leadership. Third-party contracts are important, but risk cannot be completely outsourced, especially where the organization remains accountable for operational resilience, safety, and regulatory obligations. This option reflects the misconception that contract language alone can eliminate business risk.
- D. Incorrect.
This is incorrect because technical controls may be necessary, but focusing primarily on technical mitigation too early skips the broader leadership role of the CISO. The project involves strategic tradeoffs across business value, safety, OT operations, cloud services, data governance, vendor risk, and compliance. Without governance, risk criteria, and accountable decision-making, technical controls may be misapplied, incomplete, or inconsistent with business priorities.