712-50 Question 173
Single answerLeading with Persuasive Business CommunicationA newly appointed CISO must persuade the executive committee to fund a 3-year identity and access modernization program after an internal audit found excessive privileged access, inconsistent joiner-mover-leaver controls, and weak third-party access governance. The CEO is focused on growth, the CFO has rejected prior security proposals as too technical, and business unit leaders are concerned about operational disruption. The CISO has 15 minutes on the agenda and wants to maximize the likelihood of approval. Which approach is MOST effective for leading with persuasive business communication?
- A
Center the presentation on technical control gaps, identity architecture diagrams, and detailed explanations of privileged access management features so executives understand the severity of the weaknesses.
- B
Frame the proposal in business terms by linking identity risks to revenue protection, regulatory exposure, audit remediation, and operational resilience; present phased investment options, quantified business impact, and clear success metrics tailored to each executive stakeholder.
- C
Emphasize that peer organizations are investing heavily in identity modernization and warn that the company could appear negligent if it does not immediately approve the full program.
- D
Focus on the audit findings and request emergency funding first; defer discussion of business outcomes, change impact, and implementation sequencing until after the committee approves the budget.
Show answer and explanation
Correct answer: B
Explanation
In CCISO practice, leading with persuasive business communication means translating cybersecurity issues into the language of enterprise risk, value, strategy, and operational impact. The most effective executive communication is audience-specific and decision-oriented: it explains why the issue matters now, what business objectives are affected, what options exist, what the tradeoffs are, how success will be measured, and how disruption will be managed. This aligns with widely accepted executive communication and governance principles reflected in frameworks and guidance such as NIST Cybersecurity Framework governance outcomes, NIST SP 800-53 control families related to access control and risk management, COBIT’s emphasis on stakeholder needs and value delivery, and ISO/IEC 27001’s management-driven risk treatment approach. For a CFO, quantified financial exposure, phased funding, and measurable return in risk reduction matter. For a CEO, strategic enablement, resilience, and trust matter. For business leaders, implementation impact and continuity matter. Therefore, the strongest persuasive approach is to connect the identity program to business outcomes, provide options, and present a credible roadmap rather than relying on technical depth, peer pressure, or audit urgency alone.
- A. Incorrect.
This is not the most effective approach for executive persuasion. While technical accuracy matters, senior executives typically make decisions based on business impact, risk appetite, cost, regulatory implications, and strategic alignment rather than detailed control descriptions. Overloading the committee with architecture and feature-level detail is a common communication mistake for security leaders because it explains the problem in security language instead of decision-making language.
- B. Correct.
This is the best answer because it aligns the security initiative to enterprise priorities and uses audience-centered communication. Persuasive executive communication translates security issues into business consequences and decision options: financial exposure, operational resilience, audit closure, customer trust, and enablement of growth. Offering phased options addresses budget sensitivity, while quantified impact and measurable outcomes improve credibility. Tailoring the message to the CEO, CFO, and business leaders demonstrates stakeholder awareness and increases the chance of approval.
- C. Incorrect.
This is plausible but weaker than option 2. Benchmarking against peers can support a business case, but relying primarily on peer pressure or reputational comparison is not as persuasive as showing organization-specific risk, value, and implementation planning. It may also come across as fear-based or insufficiently grounded in the company’s own strategic and financial context.
- D. Incorrect.
This is ineffective because it asks for funding before establishing a compelling business rationale and before addressing change impact concerns. Executives are more likely to resist proposals that do not explain outcomes, tradeoffs, implementation approach, and disruption management. Audit findings can create urgency, but urgency alone rarely secures sustainable executive sponsorship without a clear business narrative.