712-50 Question 195
Single answerReadiness to Set into New Leadership RolesA newly appointed CISO is moving from a highly technical security engineering role into an enterprise leadership position at a global manufacturer. In the first month, the CEO asks for a 12-month security transformation plan that will gain executive support, improve credibility with business leaders, and establish the CISO as a strategic leader rather than the head of a technical control function. Which action should the CISO take FIRST to demonstrate readiness for the new leadership role?
- A
Develop a detailed technology roadmap focused on replacing legacy security tools and present it to the IT leadership team for quick execution
- B
Conduct stakeholder meetings with business, legal, operations, finance, and IT leaders to understand enterprise objectives, risk tolerance, and critical business dependencies before finalizing the plan
- C
Begin an immediate enterprise-wide policy rewrite so that the organization sees strong governance from the new CISO
- D
Commission a full external penetration test and use the results to justify a larger security budget in the next board meeting
Show answer and explanation
Correct answer: B
Explanation
The best first step for a new CISO transitioning into a leadership role is to build an enterprise view before proposing changes. In CCISO-level practice, readiness for leadership is demonstrated by strategic alignment, stakeholder management, communication with executives, and an understanding of business risk rather than immediate technical action. This is consistent with widely accepted security leadership practices reflected in frameworks and guidance such as NIST CSF governance outcomes, ISO/IEC 27001 leadership and organizational context clauses, and general corporate governance principles that require security strategy to support business objectives. A strong CISO first listens, assesses, aligns, and then prioritizes initiatives. That sequence helps establish trust, secure sponsorship, and ensure the 12-month plan is credible, risk-based, and actionable across the enterprise.
- A. Incorrect.
This is incorrect because it reflects a technical-manager mindset rather than an executive-leadership approach. While modernizing tools may be necessary, leading with a technology refresh before understanding business priorities, risk appetite, and strategic objectives can misalign investments with enterprise needs. A CCISO is expected to translate security into business value, not start with tools.
- B. Correct.
This is correct because a CISO stepping into a leadership role must first establish business context, build relationships, and understand stakeholder expectations. Executive credibility depends on aligning the security strategy to business goals, regulatory drivers, operational realities, and the organization's risk tolerance. This approach demonstrates leadership maturity, communication skills, and readiness to operate at the enterprise level.
- C. Incorrect.
This is incorrect because governance is important, but a broad policy rewrite as the first action is premature and may be perceived as bureaucratic if it is not grounded in business priorities and current risk realities. Effective leaders assess organizational context and secure stakeholder buy-in before driving governance changes.
- D. Incorrect.
This is incorrect because penetration testing can provide useful tactical insight, but using it as the first step to drive budget discussions is too narrow and operationally focused for a newly appointed CISO seeking to establish strategic leadership. Board-level discussions are better supported by enterprise risk analysis, business impact, and alignment to strategic objectives rather than a single technical assessment.