712-50 Question 158
Single answerLeading Self (6 questions)A newly appointed CISO joins a global company after a public security incident. The CEO wants visible change within 90 days, while the board expects a long-term strategy. Internally, the security leadership team is divided: some directors want the CISO to personally approve most decisions to avoid further mistakes, while others want more delegation so they can move faster. The CISO recognizes a personal tendency to become deeply involved in technical details during crises, which has previously caused delays in strategic work. To lead effectively and improve personal leadership impact, which action should the CISO take FIRST?
- A
Establish a personal leadership operating model that defines decision rights, escalation thresholds, and time reserved for strategic priorities, then communicate it to the leadership team
- B
Take direct control of all high-risk security decisions until the organization regains confidence in the security function
- C
Delay changes to leadership approach until a full-year security strategy is approved by the board
- D
Focus primarily on technical remediation metrics so the CEO can demonstrate immediate progress to external stakeholders
Show answer and explanation
Correct answer: A
Explanation
This question tests Leading Self at the executive level: self-awareness, personal discipline, role clarity, and the ability to align behavior with organizational needs. A successful CISO must manage not only cyber risk but also their own leadership tendencies, especially under pressure. In this scenario, the CISO has already identified a personal risk factor: over-engagement in technical detail during crises. The best first action is to convert that insight into a structured leadership approach that sets boundaries around decision-making and protects time for strategic responsibilities.
This aligns with established executive leadership and governance practices: clear delegation, defined authority, and escalation criteria are core components of effective management systems and are consistent with governance principles reflected in frameworks such as COBIT and broader leadership guidance in security governance. It also supports the distinction between governance and management emphasized in executive security roles: the CISO should ensure oversight, direction, and accountability rather than becoming the operational decision point for every issue. By first establishing a leadership operating model, the CISO demonstrates maturity in Leading Self, improves team performance, and better meets the different expectations of the CEO and board.
- A. Correct.
Correct. In the CCISO context of Leading Self, self-awareness must translate into disciplined leadership behavior. The scenario highlights the CISO's known tendency to over-involve themselves in technical detail, which can undermine strategic effectiveness. Creating and communicating a leadership operating model addresses personal effectiveness first: it clarifies what the CISO will decide personally, what will be delegated, when issues must be escalated, and how time will be protected for strategic obligations to the CEO and board. This is the most appropriate first step because it directly manages the leader's own behavior, aligns team expectations, and balances short-term crisis response with long-term governance.
- B. Incorrect.
Incorrect. This is a plausible reaction after a recent incident, but it reflects overcorrection and weak leadership scalability. Centralizing all high-risk decisions may temporarily feel safer, yet it reinforces bottlenecks, reduces team accountability, and increases the likelihood that the CISO will stay trapped in operational detail. In a senior executive role, effective self-leadership includes recognizing when personal involvement becomes counterproductive.
- C. Incorrect.
Incorrect. Waiting for the annual strategy process ignores an immediate leadership problem. The issue in the scenario is not lack of a documented strategy alone; it is the CISO's own leadership behavior and the team's uncertainty about how decisions will be made. Deferring action would allow confusion, slow execution, and role ambiguity to continue during a critical period.
- D. Incorrect.
Incorrect. Technical remediation metrics are important after an incident, and the CEO may need short-term evidence of improvement. However, focusing primarily on technical metrics does not address the root leadership issue described: the CISO's self-awareness about becoming too tactical and the team's disagreement over delegation. This option may improve reporting optics but not the CISO's effectiveness as an executive leader.