712-50 Question 150
Single answerMotivating Teams for Common GoalsA newly appointed CISO inherits a security organization with high turnover, tension between incident response, engineering, and compliance teams, and repeated delays in a strategic identity modernization program. Team leads report that staff view the initiative as "another executive project" that increases workload without helping their daily responsibilities. The CEO has asked the CISO to improve execution without increasing headcount. Which action should the CISO take FIRST to motivate teams toward a common goal and improve commitment to the program?
- A
Define a shared mission for the program that links identity modernization to business risk reduction and each team's operational pain points, then establish cross-functional success measures owned by the participating leaders
- B
Announce that completion of identity modernization milestones will be tied directly to year-end bonuses for all security staff to increase urgency
- C
Replace resistant team leads with external hires who have transformation experience so the organization can move faster
- D
Move ownership of the entire program to the compliance team so accountability is centralized and disagreements are minimized
Show answer and explanation
Correct answer: A
Explanation
The strongest leadership response is to create alignment before applying pressure. In CCISO-level practice, motivating teams for common goals requires translating security strategy into a shared mission that resonates with business objectives and with the day-to-day concerns of different functions. When teams see how an initiative reduces business risk, improves resilience, and removes operational friction, they are more likely to commit to it. The CISO should also establish shared success measures across teams so that incident response, engineering, and compliance are rewarded for joint outcomes rather than siloed tasks. This approach reflects widely accepted leadership and change principles found in frameworks and guidance such as NIST Cybersecurity Framework governance concepts, NIST SP 800-53 Program Management controls emphasizing organization-wide coordination, and general change-management best practices that prioritize vision, stakeholder engagement, and reinforcement over coercion. Incentives, structural changes, or personnel actions may have a place later, but they should follow, not replace, clear strategic alignment and shared ownership.
- A. Correct.
This is the best first action because it addresses the root cause of low motivation: the teams do not see a meaningful connection between the initiative, business outcomes, and their own work. Effective senior security leadership aligns teams around a clear purpose, shows how the initiative reduces enterprise risk, and translates strategy into role-relevant benefits. Establishing shared, cross-functional measures also reduces silo behavior and reinforces collective accountability. This is consistent with executive leadership and change-management best practices, which emphasize vision, stakeholder alignment, and measurable outcomes before using incentives or structural changes.
- B. Incorrect.
This is plausible because incentives can influence behavior, but it is not the best first step. Tying bonuses to milestones may create short-term compliance, yet it does not resolve the underlying issue that staff do not understand or believe in the common objective. It can also encourage gaming of metrics, resentment, and unhealthy competition between teams. In executive leadership contexts, motivation based solely on extrinsic rewards is weaker than commitment built through shared purpose, clarity, involvement, and ownership.
- C. Incorrect.
This option reflects a common but flawed assumption that resistance is primarily a personnel problem. Replacing leaders may be necessary in rare cases, but doing so first is disruptive, expensive, and likely to damage trust further. High turnover already exists, so this approach risks worsening morale. A capable CISO should first determine whether misalignment, poor communication, conflicting incentives, or unclear success criteria are causing the resistance before making staffing changes.
- D. Incorrect.
Centralizing ownership under compliance may appear to simplify accountability, but identity modernization is typically a cross-functional effort involving architecture, operations, access management, risk, and audit considerations. Assigning sole ownership to one team can deepen silos and reduce buy-in from engineering and operations groups whose participation is essential. This does not motivate teams toward a common goal; it merely shifts authority and may reinforce the perception that the initiative is disconnected from operational realities.