712-50 Question 194
Single answerReadiness to Set into New Leadership RolesA newly appointed CISO has been promoted from a highly technical security architecture role into an enterprise leadership position at a global manufacturing company. In the first month, the CEO asks for a 12-month security transformation plan that will gain board support, improve cross-functional cooperation, and demonstrate that the new CISO is ready to operate at the executive level rather than as a technical manager. Which action should the CISO take FIRST to show readiness for the new leadership role?
- A
Develop a roadmap that aligns security initiatives to business objectives, enterprise risk appetite, regulatory obligations, and measurable outcomes, then socialize it with executive stakeholders
- B
Begin replacing legacy security tools immediately to demonstrate rapid action and visible technical progress
- C
Reorganize the security team reporting lines before meeting business unit leaders so the CISO can establish authority quickly
- D
Present the board with a detailed list of unresolved vulnerabilities and ask for additional budget based primarily on technical severity ratings
Show answer and explanation
Correct answer: A
Explanation
This question tests whether the candidate understands the shift from technical expertise to enterprise leadership, which is essential when stepping into a CISO role. Readiness for a new leadership role is demonstrated by strategic planning, stakeholder engagement, business alignment, and governance awareness. In practice, a successful CISO translates security into business risk language, aligns initiatives with organizational strategy, and builds coalitions across executive functions before driving major technology or organizational change. This approach is consistent with widely accepted leadership and governance practices reflected in frameworks such as NIST Cybersecurity Framework 2.0's Govern function, NIST SP 800-39 on managing information security risk at the organizational level, and ISO/IEC 27014 guidance on information security governance. The best answer is therefore the option that emphasizes a business-aligned, risk-based roadmap with executive engagement.
- A. Correct.
Correct. A CISO moving into a new leadership role must demonstrate business alignment, risk-based decision-making, and executive communication. Building a transformation roadmap tied to business goals, risk appetite, compliance needs, and measurable outcomes shows strategic maturity. Socializing the plan with executives also helps secure buy-in across operations, legal, finance, and technology functions. This is the strongest first step because it positions the CISO as an enterprise leader rather than a technical specialist.
- B. Incorrect.
Incorrect. Although technical modernization may eventually be necessary, immediately replacing tools is a tactical response that may not address the organization's most important business risks. It can also create unnecessary cost, disruption, and resistance if done before understanding strategic priorities, governance expectations, and stakeholder needs. A new CISO should first establish direction, alignment, and decision criteria.
- C. Incorrect.
Incorrect. Adjusting reporting lines may be appropriate later, but doing so before engaging business leaders reflects an inward-looking management focus rather than executive leadership readiness. Effective CISOs first understand the organization's strategy, culture, and risk environment, then determine whether structural changes are needed to support agreed objectives. Reorganization without context can undermine trust and create avoidable conflict.
- D. Incorrect.
Incorrect. Boards generally expect concise, business-oriented reporting centered on risk exposure, strategic impact, resilience, legal obligations, and investment trade-offs. A vulnerability list based mainly on technical severity does not by itself show leadership readiness or connect security issues to enterprise priorities. This option reflects a common misconception that more technical detail automatically leads to better executive decisions.