712-50 Question 143
Single answerPerformance Evaluation Reviews and FeedbackA newly appointed CISO is preparing annual performance evaluations for the security leadership team. One director successfully reduced critical vulnerabilities by 40% during the year, but several business unit leaders complain that the director’s communication style created friction and delayed risk acceptance decisions. The CISO wants the review process to improve future performance, support succession planning, and remain defensible to HR if challenged. Which action is the MOST appropriate?
- A
Base the evaluation primarily on the vulnerability reduction metric because quantitative security outcomes are the most objective measure of performance
- B
Use a balanced review that assesses measurable security results, leadership behaviors, and stakeholder feedback against pre-defined expectations, then document a development plan
- C
Defer the evaluation until additional incident and audit data is available so the review is based only on a full year of hard evidence
- D
Lower the rating significantly based on business complaints to reinforce that collaboration is more important than technical delivery
Show answer and explanation
Correct answer: B
Explanation
In CCISO-level performance evaluation, the goal is not merely to score past activity but to improve executive effectiveness, align leadership behavior with enterprise objectives, and create a documented basis for talent decisions. Best practice in performance management is to assess employees against clearly defined objectives and competencies, using multiple sources of evidence such as KPIs, stakeholder input, observed leadership behaviors, and business outcomes. For security leaders, this often means balancing operational metrics like vulnerability reduction, incident response maturity, audit outcomes, and risk treatment progress with softer but equally critical capabilities such as communication, governance influence, and cross-functional collaboration. A balanced, documented review with actionable feedback is also more defensible under standard HR practices because it reduces bias, avoids overreliance on a single metric or anecdotal complaint, and supports succession and development planning. This approach aligns with common enterprise performance management principles and governance expectations reflected in frameworks such as NIST CSF governance concepts, COBIT performance and alignment principles, and general HR best practices for objective, competency-based reviews.
- A. Incorrect.
This is incorrect because relying primarily on one quantitative metric creates an incomplete and potentially misleading assessment. In senior security roles, performance evaluation should include operational results, leadership effectiveness, communication, cross-functional influence, and alignment with business objectives. Focusing only on vulnerability reduction ignores whether the director achieved results in a sustainable and collaborative manner.
- B. Correct.
This is correct because an effective executive performance review should be balanced, evidence-based, and tied to pre-established expectations. For a security leader, both outcomes and behaviors matter: reducing vulnerabilities demonstrates delivery, while stakeholder feedback highlights leadership and communication risks that can affect enterprise governance. Documenting strengths, gaps, and a development plan supports accountability, coaching, and succession planning, while also making the review more defensible from an HR perspective.
- C. Incorrect.
This is incorrect because performance reviews should occur on schedule using the best available evidence rather than being postponed unnecessarily. Delaying the review can weaken feedback effectiveness, create inconsistency in personnel management, and undermine the organization’s formal performance management cycle. The scenario already provides sufficient data points to conduct a balanced assessment.
- D. Incorrect.
This is incorrect because sharply reducing the rating based mainly on complaints can overcorrect and may appear subjective if not tied to defined performance criteria. Collaboration is important, but the director also delivered a significant security outcome. A defensible review should weigh both dimensions proportionately and translate concerns into specific improvement goals rather than relying on a punitive reaction.