712-50 Question 162
Single answerEmotional IntelligenceA newly appointed CISO is leading a post-incident review after a ransomware event. During the meeting, the head of IT operations becomes defensive, stating that the security team is "just looking for someone to blame," while the general counsel appears frustrated about late notification decisions. Tension is escalating, and the CEO expects a clear improvement plan by the end of the session. Which action should the CISO take FIRST to demonstrate strong emotional intelligence and keep the meeting productive?
- A
Pause the discussion, acknowledge the concerns and emotions in the room, restate the shared objective of organizational recovery and improvement, and then redirect the group to a structured lessons-learned discussion
- B
Allow the disagreement to continue so the underlying issues fully surface before intervening, since emotional expression is necessary for honest accountability
- C
Move immediately to the technical timeline and ask participants to avoid subjective comments so the meeting stays fact-based
- D
Privately note the disruptive behavior and plan one-on-one follow-up meetings later, while continuing the current meeting agenda without interruption
Show answer and explanation
Correct answer: A
Explanation
This question tests the CCISO candidate's ability to apply emotional intelligence in an executive incident-review setting. For a senior security leader, emotional intelligence is not merely interpersonal courtesy; it is a leadership capability that directly affects governance, decision-making, crisis management, and cross-functional trust. The best first action is to acknowledge the emotional state of stakeholders, de-escalate tension, and reframe the discussion around a shared organizational objective before moving into structured analysis.
This approach aligns with widely accepted leadership and incident-management best practices. Effective post-incident reviews and lessons-learned sessions are expected to focus on systemic improvement rather than blame, because blame-oriented dynamics suppress candor and reduce the organization’s ability to identify root causes. Leadership frameworks related to emotional intelligence, such as those emphasizing self-awareness, self-regulation, empathy, and relationship management, support the idea that executives should recognize emotional cues and manage them constructively. Similarly, incident handling guidance such as NIST SP 800-61 Rev. 2 emphasizes lessons learned and process improvement after incidents; these objectives are far more achievable when the meeting environment is psychologically safe and professionally managed.
In a CCISO role, emotional intelligence is especially important because the CISO must influence legal, IT, executive leadership, and operational teams that may have conflicting priorities under stress. The strongest answer therefore balances empathy with structure: validate concerns, reinforce a shared mission, and guide the group back to a disciplined review process.
- A. Correct.
Correct. This response reflects key elements of emotional intelligence expected of an executive security leader: self-regulation, empathy, social awareness, and relationship management. By pausing, the CISO prevents escalation; by acknowledging concerns, the CISO validates stakeholder perspectives without assigning blame; by restating the common goal, the CISO aligns the group around business recovery and improvement; and by redirecting to a structured review, the CISO preserves accountability and productivity. In a CCISO context, this is the most effective first step because it addresses both the emotional climate and the business need for decision-quality outcomes.
- B. Incorrect.
Incorrect. While surfacing issues can be useful, allowing conflict to continue unchecked is risky in a high-stakes executive setting. It may deepen defensiveness, reduce psychological safety, and shift the meeting from constructive review to interpersonal conflict. Emotional intelligence does not mean permitting escalation; it means recognizing emotions early and channeling them into productive dialogue.
- C. Incorrect.
Incorrect. Refocusing only on facts may seem efficient, but it ignores the emotional undercurrent that is already impairing collaboration. In executive leadership, unresolved defensiveness and frustration often distort how facts are heard and discussed. A technically correct agenda can still fail if the leader does not first stabilize the group dynamic.
- D. Incorrect.
Incorrect. One-on-one follow-up may be appropriate later, but continuing without addressing visible tension is likely to reduce trust and the quality of discussion in the moment. Emotional intelligence requires real-time awareness and intervention, not just deferred remediation. The immediate need is to reset the tone so the group can produce an effective improvement plan.