712-50 Question 149
Single answerBuilding Loyalty and RetentionA newly appointed CISO inherits a security organization with high turnover among senior analysts and team leads. Exit interviews show that employees feel their work is reactive, advancement paths are unclear, and recognition is inconsistent. The board has approved budget for retention initiatives, but expects measurable business value within 12 months. Which action should the CISO prioritize FIRST to build loyalty and improve retention while aligning with business objectives?
- A
Implement a structured security career framework with defined competencies, progression paths, mentoring, and development plans tied to organizational security objectives
- B
Increase monitoring responsibilities and rotate staff more frequently so employees gain exposure to more tools and incidents
- C
Offer a one-time retention bonus to all senior security personnel and defer broader organizational changes until the next budget cycle
- D
Require managers to tighten performance management immediately so low performers exit and stronger employees see higher standards
Show answer and explanation
Correct answer: A
Explanation
In CCISO practice, building loyalty and retention is a leadership and workforce strategy issue, not just an HR or compensation matter. The best first step is to address systemic drivers of attrition by creating a clear employee value proposition inside the security function: visible career paths, role-based competencies, mentoring, development planning, and recognition linked to business outcomes. This aligns with established workforce and governance best practices reflected in frameworks such as NIST NICE Workforce Framework for Cybersecurity, which emphasizes role clarity and competency development, and common leadership guidance from ISACA and (ISC)2 on retention through professional growth and engagement. While bonuses, rotation, and performance rigor may have supporting roles, they should not precede a structured plan that connects employee growth to the enterprise security mission and measurable business value.
- A. Correct.
Correct. A structured career framework addresses the root causes identified in the scenario: unclear advancement, inconsistent recognition, and reactive work. It gives employees visibility into how they can grow, what skills are valued, and how their contributions support enterprise risk reduction and business goals. Including mentoring and development plans strengthens engagement and loyalty, while defined competencies allow the CISO to measure progress over time. This is more likely to produce sustainable retention improvements within 12 months than isolated financial incentives.
- B. Incorrect.
Incorrect. Cross-training and rotation can be valuable for skill development and resilience, but the scenario indicates employees already feel overburdened by reactive work. Expanding monitoring duties first may worsen burnout rather than improve loyalty. Without a clear development structure and recognition model, rotation alone is unlikely to solve retention problems.
- C. Incorrect.
Incorrect. Compensation can influence short-term retention, but a one-time bonus does not address the underlying causes of dissatisfaction identified in exit interviews. Employees who lack career clarity, meaningful development, and recognition often leave even after receiving financial incentives. This option may temporarily delay departures but is not the best first strategic action.
- D. Incorrect.
Incorrect. Strong performance management has a place in leadership, but making it the first response to a retention problem is misaligned with the evidence provided. The issue is not primarily low performance; it is disengagement caused by poor career visibility, reactive work patterns, and weak recognition. A harsher management approach may further damage trust and loyalty.