712-50 Question 148
Single answerBuilding Loyalty and RetentionA newly appointed CISO inherits a security organization with 28% annual voluntary turnover among senior analysts and engineers. Exit interviews show employees do not leave primarily for pay; instead, they cite limited career progression, lack of recognition, and burnout from constant after-hours incident work. The board has approved only a modest budget increase and expects measurable improvement in retention within 12 months without reducing security coverage. Which action should the CISO prioritize FIRST to build loyalty and improve retention while aligning with business constraints?
- A
Implement a formal security talent retention program that includes defined career paths, skills-based development plans, recognition mechanisms, and a redesigned on-call/incident rotation to reduce burnout
- B
Recruit additional senior staff immediately and defer internal people-program changes until staffing levels stabilize
- C
Introduce retention bonuses for all security team members and postpone workload and career-development changes until the next budget cycle
- D
Increase monitoring and productivity metrics for security staff so underperformers can be identified and replaced more quickly
Show answer and explanation
Correct answer: A
Explanation
For a CCISO-level leader, building loyalty and retention requires addressing organizational and cultural factors, not just staffing numbers or compensation. The most effective first action is to identify and correct the root causes of attrition shown by workforce feedback. In this scenario, employees are signaling three classic retention risks: limited advancement, inadequate recognition, and operational burnout. A structured retention program is the best response because it is strategic, measurable, and feasible within modest budget constraints. Practical elements include role-based career ladders, succession planning, individual development plans, mentoring, recognition tied to meaningful contributions, and more sustainable workload management such as fair on-call rotations, cross-training, and incident surge support. These actions align with accepted people-management and governance practices reflected in leadership-oriented frameworks and guidance, including workforce planning and competency development concepts seen in NIST NICE Workforce Framework, governance and organizational design principles in COBIT, and human factor considerations emphasized in security leadership practice. A CISO should treat retention as a business risk issue: losing experienced security personnel increases operational risk, weakens institutional knowledge, and raises replacement costs. Therefore, the first priority should be a targeted retention strategy that improves employee experience while maintaining security operations.
- A. Correct.
Correct. The scenario identifies the primary retention drivers as career stagnation, lack of recognition, and burnout rather than compensation. A formal retention program that addresses career progression, professional development, recognition, and sustainable operating practices is the most effective first step because it targets the root causes of attrition. Redesigning on-call and incident response coverage helps reduce exhaustion without requiring a major budget increase, while career paths and development plans build loyalty by showing employees a future in the organization. This is consistent with leadership best practices in security management, where retention improves when employees see advancement opportunities, receive recognition, and work in a sustainable operating model.
- B. Incorrect.
Incorrect. Hiring more senior staff may help capacity over time, but it does not address the reasons current employees are leaving. If the organization has unresolved burnout, unclear growth opportunities, and weak recognition, new hires may quickly become dissatisfied as well. In addition, immediate recruiting can be costly and time-consuming, and the board expects measurable retention improvement within 12 months under limited budget conditions. This option treats the symptom of turnover rather than its underlying causes.
- C. Incorrect.
Incorrect. Retention bonuses can be useful in specific circumstances, but the scenario explicitly indicates that pay is not the primary reason for attrition. Offering bonuses without addressing workload sustainability, career progression, and recognition is unlikely to produce durable loyalty. It may temporarily delay departures, but employees often still leave when day-to-day frustrations remain unchanged. This option reflects a common misconception that compensation is the main lever for retention in all cases.
- D. Incorrect.
Incorrect. Increasing productivity surveillance and using it to replace staff more quickly is likely to damage trust and morale, especially in a team already experiencing burnout. This approach may accelerate turnover rather than improve retention. In leadership roles, especially at the CISO level, loyalty and retention are built through engagement, support, fairness, recognition, and development, not through primarily punitive management mechanisms.