712-50 Question 141
Single answerInclusive LeadershipA newly appointed CISO is leading a global security transformation after several regional teams complained that security policies are being designed centrally without considering local regulatory, operational, and cultural realities. Engagement survey results show that analysts in smaller regions hesitate to challenge decisions made by headquarters, and turnover is rising among high-performing team members in those regions. The CISO wants to improve inclusion while still maintaining consistent enterprise security governance. Which action is the BEST first step?
- A
Standardize all policy decisions at headquarters to eliminate regional variation and reduce debate during policy development
- B
Create a structured governance process that includes regional security representatives in policy design, risk discussions, and exception reviews before final approval
- C
Require all regional teams to submit concerns only through their direct managers so communications remain controlled and efficient
- D
Delay policy changes until the CISO can replace resistant regional managers with leaders who better align with headquarters
Show answer and explanation
Correct answer: B
Explanation
The best answer is to build an inclusive governance mechanism that brings affected stakeholders into the decision-making process without weakening accountability. In a CCISO context, inclusive leadership is not merely interpersonal; it is an executive capability that improves risk decisions, retention, collaboration, and policy adoption across diverse business environments. A mature CISO balances centralized governance with structured local input, especially in multinational organizations where legal, cultural, and operational differences materially affect security execution. This aligns with established leadership and governance principles found in frameworks such as ISO/IEC 27014 for governance of information security and NIST Cybersecurity Framework guidance emphasizing organizational context, stakeholder engagement, and governance integration. Inclusive leadership also supports psychological safety, which is widely recognized in management best practice as essential for surfacing risk, challenging assumptions, and improving team performance.
- A. Incorrect.
This is incorrect because centralizing all policy decisions at headquarters may improve consistency, but it directly ignores the stated problem: regional teams feel excluded and local realities are not being considered. Inclusive leadership does not mean abandoning governance; it means creating mechanisms for diverse perspectives to inform decisions. A purely centralized approach can increase disengagement, reduce psychological safety, and lead to policies that are less effective in practice because they miss regional legal or operational constraints.
- B. Correct.
This is correct because it addresses both inclusion and governance. By formally involving regional representatives in policy design, risk discussions, and exception handling, the CISO creates a repeatable process for hearing diverse perspectives while preserving enterprise-level decision authority. This improves psychological safety, strengthens buy-in, and helps ensure policies are realistic across jurisdictions and business contexts. It also reflects executive-level leadership by embedding inclusion into governance rather than treating it as an ad hoc cultural initiative.
- C. Incorrect.
This is incorrect because forcing concerns through management layers may further suppress input from people who already hesitate to speak up. While management channels have value, inclusive leadership requires reducing barriers to participation, especially when power distance is part of the problem. This option prioritizes control over inclusion and may filter out critical operational or compliance concerns before they reach decision makers.
- D. Incorrect.
This is incorrect because it assumes disagreement equals resistance rather than potentially valid local concerns. Replacing managers before understanding root causes is not an inclusive or evidence-based response. It risks worsening morale and turnover, and it does not establish a sustainable mechanism for gathering diverse input. Inclusive leaders first create fair processes, seek to understand barriers, and use structured engagement to improve decision quality.