712-50 Question 142
Single answerPerformance Evaluation Reviews and FeedbackA newly appointed CISO is preparing annual performance evaluations for the security leadership team after a year marked by several high-profile incidents, a delayed identity management rollout, and successful completion of a board-requested cyber resilience exercise. One security manager is widely regarded as technically strong and worked long hours during incidents, but post-incident reviews repeatedly showed poor delegation, incomplete communication to business stakeholders, and failure to develop junior team members. The CISO wants the review process to improve future performance, remain fair, and support succession planning. Which action is the MOST appropriate?
- A
Base the manager's rating primarily on visible effort during incidents, since commitment under pressure is the strongest indicator of security leadership potential
- B
Use measurable objectives and behavioral competencies from the manager's role profile, incorporate evidence from incident reviews and stakeholder feedback, and agree on a development plan with clear follow-up milestones
- C
Delay the evaluation until the next review cycle so the manager has more time to demonstrate improvement and the recent incidents do not overly influence the assessment
- D
Score the manager lower in all categories to send a strong message that missed project deadlines and communication gaps are unacceptable in information security
Show answer and explanation
Correct answer: B
Explanation
The best answer is to evaluate performance against established objectives and leadership competencies, using multiple evidence sources and translating findings into a concrete development plan. For senior security roles, performance evaluation should not focus only on technical firefighting or personal effort; it should assess whether the leader improved team capability, communicated effectively with stakeholders, managed delivery, and contributed to strategic business outcomes. This reflects widely accepted performance management principles such as role-based criteria, documented evidence, timely feedback, and development-oriented reviews. In information security leadership, post-incident reviews, project outcomes, and stakeholder input are especially valuable because they reveal whether a manager can lead under pressure while maintaining governance, communication, and team effectiveness. Best practices from HR performance management and security governance frameworks emphasize objective criteria, documented feedback, and individual development planning to strengthen capability and support succession readiness.
- A. Incorrect.
Incorrect. Visible effort and long hours can indicate commitment, but they are not sufficient measures of leadership effectiveness. Performance reviews should assess outcomes, leadership behaviors, communication, talent development, and alignment with role expectations. Overemphasizing effort creates a common management error: rewarding activity rather than effectiveness and business impact.
- B. Correct.
Correct. This approach aligns with sound performance management practice by using predefined objectives and competencies, relying on documented evidence, and balancing technical delivery with leadership behavior. Including post-incident findings and stakeholder feedback improves fairness and relevance, while a development plan with milestones turns the review into a tool for improvement, not just judgment. It also supports succession planning by identifying gaps in delegation, communication, and team development.
- C. Incorrect.
Incorrect. Deferring the review weakens accountability and reduces the value of timely feedback. Effective performance evaluation should be based on the current review period using documented evidence, while also addressing recency bias through a full-period assessment. Waiting can allow issues in leadership behavior to persist and undermines the purpose of structured reviews.
- D. Incorrect.
Incorrect. Lowering all ratings as a punitive signal is neither objective nor constructive. Performance evaluations should distinguish among competency areas and reflect actual evidence. A blanket downgrade introduces bias, reduces credibility of the review process, and does not help the manager understand which specific behaviors or outcomes require improvement.