712-50 Question 203
Single answerA global manufacturing company is deploying a new privileged access management (PAM) control for administrators who support 24/7 production systems. Operations leaders are concerned that stronger controls could delay emergency maintenance and disrupt plant uptime, while the audit committee expects measurable reduction of privileged account misuse. As the CISO, you must ensure the control design aligns with business objectives and is tested before full rollout. Which action is the MOST appropriate to take first?
- A
Implement the PAM solution in all plants immediately, then tune access workflows after reviewing production incidents for 90 days
- B
Require the security architecture team to enable the vendor's most restrictive default settings because stronger controls provide the highest assurance
- C
Define business and security success criteria with operations and audit stakeholders, pilot the PAM control in a representative environment, and validate it through functional, failover, and emergency-access testing before enterprise deployment
- D
Defer the PAM deployment until the organization can redesign all legacy administrator processes so the new control can be introduced in a single transformation program
Show answer and explanation
Correct answer: C
Explanation
The best answer is Option 3 because CCISO-level decision-making requires balancing security effectiveness, operational continuity, audit expectations, and implementation risk. When designing information systems controls, leaders should begin by confirming business objectives, risk appetite, regulatory or audit requirements, and operational constraints. For a PAM deployment in a manufacturing environment, the control must reduce privileged misuse while preserving availability for emergency support. A pilot in a representative environment is a recognized best practice because it enables pre-implementation validation of control effectiveness and operational impact.
Relevant best practices are reflected across common governance and control frameworks. NIST SP 800-53 emphasizes selecting and tailoring security controls based on organizational needs and mission/business processes, then assessing them to determine whether they are implemented correctly, operating as intended, and producing the desired outcome. NIST SP 800-37's Risk Management Framework also stresses control implementation followed by assessment before authorization and broader operational use. ISO/IEC 27001 and ISO/IEC 27002 similarly support risk-based control selection, change management, and verification of control effectiveness. From a governance perspective, COBIT aligns control design and implementation with enterprise objectives, stakeholder needs, and measurable outcomes.
In this scenario, the key testing activities include validating normal privileged workflows, emergency or break-glass access, logging and monitoring, failover behavior, and any latency or operational bottlenecks affecting plant support. This demonstrates that the control is not only technically present but operationally effective and aligned with the enterprise's uptime and assurance goals.
- A. Incorrect.
This is incorrect because deploying the control enterprise-wide before validating operational impact creates unnecessary business risk. Although post-implementation tuning is common, the scenario specifically requires designing controls in alignment with operational needs and conducting testing prior to implementation. A broad rollout without pilot testing could introduce outages, delay emergency support, and undermine stakeholder confidence.
- B. Incorrect.
This is incorrect because selecting the most restrictive configuration by default does not ensure alignment with operational requirements. Security controls must be risk-based and fit for purpose, not simply maximally restrictive. In a 24/7 production environment, overly rigid settings could block legitimate emergency maintenance and conflict with availability objectives. This reflects the common misconception that stronger technical settings are automatically better regardless of business context.
- C. Correct.
This is correct because it addresses both governance and implementation discipline. First, defining measurable success criteria with operations and audit stakeholders ensures the control supports business uptime requirements and security objectives. Second, piloting in a representative environment allows validation under realistic conditions. Third, testing functional behavior, resilience, and break-glass or emergency-access scenarios confirms the control is effective without impairing critical operations. This is the most appropriate first action because it establishes alignment and evidence before full deployment.
- D. Incorrect.
This is incorrect because it over-delays risk reduction and assumes perfect process redesign is required before introducing an improved control. In practice, CISOs should use phased implementation and risk-based prioritization rather than waiting for a large-scale transformation. While legacy process issues may need remediation, deferring the project entirely does not meet the immediate need to reduce privileged access risk.