712-50 Question 164
Single answerSocial and Cultural IntelligenceA newly appointed CISO is leading the rollout of a global phishing-resistance program across operations in the United States, Germany, Japan, and Brazil. Early metrics show that employees in Japan and Germany complete the training but rarely report suspicious emails, while employees in Brazil actively use informal messaging channels to ask peers before escalating. Regional leaders say the current awareness campaign, built centrally in the U.S., is perceived in some locations as overly punitive and not aligned with local communication norms. The board expects a measurable improvement in reporting rates within two quarters without increasing employee resistance to the security team. Which action should the CISO take FIRST to improve the program's effectiveness using social and cultural intelligence?
- A
Mandate a single global reporting workflow and require all regions to use the same escalation scripts so that behavior can be standardized and compared
- B
Work with regional business leaders to identify local communication norms, trust barriers, and decision-making styles, then adapt reporting channels and messaging while keeping core control objectives consistent
- C
Increase the frequency of phishing simulations in the lowest-reporting regions and publish comparative regional scorecards to create accountability
- D
Translate the existing U.S. awareness materials into local languages and require annual acknowledgment from all employees
Show answer and explanation
Correct answer: B
Explanation
The best first step is to apply social and cultural intelligence to understand how different regional workforces interpret authority, accountability, peer consultation, and reporting. In security leadership, cultural adaptation does not mean weakening standards; it means aligning implementation methods with local behaviors so that the intended control outcome is achieved. This is consistent with widely accepted security program practices: governance should define consistent objectives, while implementation can be tailored to business and regional context. Guidance from security awareness and behavior-focused best practices, including NIST SP 800-50 (Building an Information Technology Security Awareness and Training Program) and NIST SP 800-61 Rev. 2 (Computer Security Incident Handling Guide), supports building reporting mechanisms that are understandable, trusted, and operationally effective. From a leadership perspective, this also aligns with change management principles: engage stakeholders, identify barriers to adoption, and design for human behavior rather than assuming policy uniformity alone will produce results.
- A. Incorrect.
This is incorrect because it prioritizes uniformity over effectiveness. Standardization can support governance and metrics, but imposing a single workflow before understanding regional social dynamics may reinforce the very barriers causing underreporting. In culturally diverse environments, differences in hierarchy, uncertainty avoidance, and preferred communication channels affect whether employees will report security concerns. A CCISO should preserve common control objectives while allowing appropriate local adaptation.
- B. Correct.
This is correct because it addresses the root cause identified in the scenario: the program is not resonating with local social and cultural norms. By engaging regional leaders, the CISO can understand how employees perceive authority, risk escalation, peer consultation, and possible loss of face or blame. Adapting the reporting experience and messaging to local norms while maintaining enterprise security requirements is a practical leadership response that improves adoption without weakening controls.
- C. Incorrect.
This is incorrect because more testing and public comparisons may worsen resistance, especially where employees already perceive the program as punitive. Comparative scorecards can create shame, defensiveness, or gaming of metrics rather than genuine reporting behavior. Simulations are useful measurement tools, but they should follow, not replace, culturally informed program design and stakeholder engagement.
- D. Incorrect.
This is incorrect because language translation alone does not solve cultural misalignment. Employees may fully understand the words yet still avoid reporting if the tone, escalation model, or expected behavior conflicts with local norms or trust levels. Annual acknowledgment is also a weak control for changing daily reporting behavior. This option reflects the common misconception that localization is only about language rather than social context.