712-50 Question 130
Single answerSuccession PlanningA global financial services company is preparing for the planned retirement of its CISO in 12 months. The board is concerned that several security functions rely heavily on the CISO's personal relationships with regulators, knowledge of the incident escalation model, and informal influence across business units. The CEO asks the deputy CISO to design a succession planning approach that will reduce operational and governance risk if the CISO leaves earlier than expected. Which action should the deputy CISO prioritize FIRST to create an effective succession plan?
- A
Identify critical CISO responsibilities and decision authorities, document key relationships and tacit knowledge, and map them to one or more internal successors with targeted development plans
- B
Launch an external executive search immediately so the organization has access to a larger candidate pool if the CISO departs unexpectedly
- C
Require all security managers to rotate through the CISO role for short periods so each leader gains exposure to executive-level responsibilities
- D
Delay succession planning until the annual strategy review so the future CISO profile can be aligned to next year's budget and technology roadmap
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1 because succession planning for a senior security executive is primarily a risk management and continuity activity, not just a recruiting exercise. In practice, the first step is to define what must be preserved if the incumbent departs: decision rights, regulatory and board interactions, crisis leadership responsibilities, strategic priorities, informal networks, and institutional knowledge. From there, the organization can assess internal bench strength, identify gaps, and implement mentoring, delegation, tabletop participation, stakeholder exposure, and documented transition artifacts.
This approach aligns with leadership continuity and key-person risk reduction principles found in governance and continuity best practices. It is also consistent with common enterprise security governance expectations that critical roles have defined responsibilities, delegated authorities, and resilient operating models. In a CCISO setting, strong succession planning typically includes: role criticality assessment, competency mapping, emergency and long-term successors, knowledge transfer, stakeholder transition planning, and periodic review by executive leadership or the board. External hiring may still be appropriate, but only after the organization has clarified the role and reduced immediate continuity risk.
- A. Correct.
Correct. Effective succession planning starts with identifying the mission-critical responsibilities of the role, including formal authorities, stakeholder relationships, regulatory touchpoints, and tacit knowledge that is not captured in procedures. In a CCISO context, this reduces key-person dependency and supports continuity of governance, incident leadership, and executive communication. Mapping those requirements to internal successor candidates and creating development plans addresses both immediate continuity risk and long-term leadership readiness.
- B. Incorrect.
Incorrect. External search can be part of a broader succession strategy, especially for contingency planning, but it should not be the first priority when the immediate risk is dependence on undocumented knowledge and informal influence. If the CISO leaves suddenly, an external candidate will not solve the near-term continuity gap. The organization first needs role clarity, knowledge capture, and interim successor readiness.
- C. Incorrect.
Incorrect. Rotational exposure may support leadership development, but making all security managers rotate through the CISO role is inefficient and may create confusion over authority, accountability, and governance. It also does not directly address the core problem of undocumented critical responsibilities and relationship dependencies. Development should be targeted to viable successors based on competency and organizational needs.
- D. Incorrect.
Incorrect. Waiting increases risk. Succession planning is a continuity and governance issue, not a task to postpone until strategy or budget cycles. In this scenario, the planned retirement is already known and there is also a risk of earlier-than-expected departure. Best practice is to begin immediately by documenting critical functions and establishing successor readiness rather than delaying for future planning alignment.