712-50 Question 156
Single answerMentoring and Coaching TeamsA newly appointed CISO inherits a security operations team with strong technical skills but inconsistent incident leadership, weak cross-functional communication, and rising turnover among high-potential analysts. The board has approved funding for tools, but the CISO believes the larger risk is the lack of a leadership pipeline within the security function. Which action should the CISO take FIRST to build sustainable team capability through mentoring and coaching while still supporting operational performance?
- A
Implement a structured mentoring and coaching program that identifies high-potential staff, defines development goals tied to business and security outcomes, and pairs them with senior leaders while measuring progress through performance and retention indicators
- B
Send all analysts to advanced technical training immediately so the team can improve credibility and rely less on management intervention during incidents
- C
Replace current team leads with experienced external hires who have already managed enterprise-scale incidents and can mentor by example without a formal program
- D
Require managers to conduct weekly status meetings focused on open tickets and SLA compliance so accountability improves before leadership development is addressed
Show answer and explanation
Correct answer: A
Explanation
The best answer is the structured mentoring and coaching program because CCISO-level leadership is fundamentally about building an effective, resilient security organization, not merely managing current technical operations. In this scenario, the CISO correctly recognizes that the larger organizational risk is weak succession and leadership depth. A mature response includes identifying high-potential employees, defining competency expectations for future leaders, assigning mentors or coaches, providing stretch opportunities such as leading post-incident reviews or cross-functional exercises, and measuring outcomes over time.
This approach is consistent with widely recognized leadership and workforce development practices, including guidance from NIST SP 800-181 on cybersecurity workforce development, which emphasizes role-based capability building, and with broader governance principles found in frameworks such as COBIT, where people, skills, and competencies are key enablers of effective governance and management. It also aligns with good talent management practice: mentoring and coaching are most effective when they are structured, tied to organizational objectives, and supported by measurable outcomes such as retention, readiness, leadership performance, and improved collaboration.
The distractors each reflect common executive errors: overinvesting in technical training when the gap is leadership, overrelying on external hiring instead of internal development, or focusing on operational metrics without addressing strategic capability building. A CISO should balance operational demands with long-term organizational resilience, and mentoring/coaching is a primary mechanism for doing so.
- A. Correct.
Correct. This is the best first action because it addresses the root problem described in the scenario: insufficient leadership depth, inconsistent incident leadership, weak communication, and retention risk among high-potential staff. A structured mentoring and coaching program is aligned with executive leadership responsibilities in CCISO, where the CISO must build organizational capability, succession depth, and management maturity rather than only technical competence. Tying development goals to business and security outcomes ensures the program is not perceived as an HR exercise detached from mission needs. Measuring outcomes such as incident leadership effectiveness, cross-functional feedback, promotion readiness, and retention helps demonstrate value to senior stakeholders.
- B. Incorrect.
Incorrect. Advanced technical training may improve specialized skills, but the scenario does not identify technical capability as the main deficiency. The stated gaps are leadership consistency, communication, and retention of emerging leaders. A common misconception is that stronger technical depth alone will solve management and influence problems. In practice, incident leadership requires judgment, coordination, communication, and coaching capability, which are better developed through mentoring, stretch assignments, and feedback mechanisms.
- C. Incorrect.
Incorrect. External hiring can be appropriate in some cases, especially when critical skill gaps exist, but replacing current team leads as the first step is disruptive, costly, and does not create a sustainable internal pipeline. It can also damage morale and worsen turnover among high-potential employees who see limited advancement opportunities. Another misconception reflected here is that mentoring occurs automatically through observation alone. Effective coaching usually requires intentional goals, regular feedback, and accountability, not just exposure to experienced hires.
- D. Incorrect.
Incorrect. Increased operational reporting and cadence may improve task visibility, but it does not directly develop leadership bench strength or coaching capability. Focusing primarily on tickets and SLA compliance can reinforce short-term transactional management rather than long-term people development. This option is plausible because operational discipline matters in security functions, but it is not the best first action when the strategic issue is the absence of a leadership pipeline.