712-50 Question 136
Single answerLeading Virtual TeamsA newly appointed CISO leads a globally distributed security team spanning North America, Europe, and Asia. Over the last quarter, incident response handoffs have become inconsistent, regional teams are duplicating work, and analysts report that decisions made in one time zone are often unclear to the next. The CISO wants to improve execution without adding headcount or imposing excessive meetings outside business hours. Which action should the CISO take FIRST to improve the effectiveness of the virtual team?
- A
Establish a shared operating model with clearly defined decision rights, handoff procedures, documentation standards, and overlap-hour communication protocols
- B
Require all regional team members to attend a daily global video call so everyone receives the same information at the same time
- C
Centralize all incident response decisions with the CISO until the team demonstrates consistent performance across regions
- D
Replace regional collaboration tools with a single new platform and require immediate migration to standardize communication
Show answer and explanation
Correct answer: A
Explanation
Leading virtual security teams effectively requires a deliberate operating model that supports clarity, trust, accountability, and asynchronous collaboration. In this scenario, the key problems are unclear decision-making, inconsistent handoffs, and duplicated effort across regions. The strongest first step is to define and document how the team works: roles and responsibilities, escalation paths, handoff criteria, minimum documentation requirements, and expected overlap windows for live coordination. This aligns with widely accepted management and governance practices for distributed teams, including use of RACI-style responsibility clarity, documented standard operating procedures, and follow-the-sun support models commonly used in security operations centers. Best practices from incident management guidance, such as NIST Computer Security Incident Handling Guide principles and operational governance concepts found in security leadership frameworks, support establishing repeatable processes and clear authority before attempting tooling changes or increasing meeting volume. A CISO should optimize for scalable coordination, not dependence on constant synchronous communication.
- A. Correct.
This is the best answer because it addresses the root causes of poor virtual-team performance: ambiguity in ownership, inconsistent handoffs, and lack of shared context across time zones. A documented operating model clarifies who makes which decisions, what must be recorded before a handoff, how asynchronous updates should be captured, and when synchronous communication is necessary. For a distributed security function, this improves accountability, reduces duplicate effort, and supports follow-the-sun operations without requiring excessive meetings.
- B. Incorrect.
This is plausible because more frequent communication can appear to solve coordination problems. However, requiring a daily global meeting across multiple time zones is operationally inefficient, harms morale, and does not scale well. It also treats the symptom rather than the cause. If roles, handoffs, and documentation are unclear, adding meetings often creates meeting fatigue while still leaving ambiguity unresolved.
- C. Incorrect.
This is incorrect because centralizing all decisions with the CISO creates a bottleneck, slows incident response, and reduces empowerment of regional leaders. In a virtual team, effective leadership depends on establishing governance and delegated authority, not making the CISO the operational hub for every decision. During security incidents, delayed decisions can increase business impact.
- D. Incorrect.
This is a common but incomplete response. Tool standardization can help, but replacing collaboration platforms first does not solve process, governance, or accountability issues. Without clear expectations for handoffs, documentation, and decision rights, the team may simply recreate the same problems on a new platform. Process and operating norms should drive tool usage, not the reverse.