712-50 Question 217
Single answerFor each information systems project develop a clear project scope statement in alignment with organizational objectivesA global manufacturing company is launching an identity and access management (IAM) modernization project after several audit findings highlighted excessive privileged access and inconsistent joiner-mover-leaver processes across regions. The board has approved funding because the initiative is expected to reduce operational risk, support planned acquisitions, and improve compliance reporting. During project initiation, the CIO asks the CISO to review the draft project scope statement. Which scope statement BEST aligns the project with organizational objectives while keeping the project appropriately bounded?
- A
Implement a global IAM program that defines business objectives, in-scope systems, target user populations, key deliverables, major exclusions, success criteria tied to risk reduction and audit remediation, and phased integration of priority applications within the approved budget and timeline.
- B
Deploy a best-of-breed IAM platform across all corporate and acquired environments as quickly as possible, allowing regional teams to decide scope and controls locally so implementation is not delayed by governance reviews.
- C
Replace all legacy authentication, HR, and ERP systems with a centralized cloud platform to eliminate identity-related risk and ensure full compliance with all current and future regulatory requirements.
- D
Create a technical implementation plan focused on privileged access management configuration standards, leaving business objectives and measurable outcomes to be defined after the tool selection and pilot are completed.
Show answer and explanation
Correct answer: A
Explanation
For CCISO-level leadership, a project scope statement must do more than describe technology tasks. It should explicitly connect the initiative to organizational objectives, such as reducing identified risk, addressing audit issues, enabling strategic growth, improving process consistency, and supporting compliance reporting. Good scope statements define what is in scope, what is out of scope, the major deliverables, assumptions, constraints, stakeholders, and measurable success criteria. This helps prevent scope creep, supports prioritization, and ensures that security investments are justified in business terms. This approach is consistent with widely accepted project governance and security management practices reflected in PMI project management guidance, COBIT governance principles, and security program planning expectations found in executive security leadership frameworks. The best answer is the one that balances strategic alignment with clear boundaries and practical execution controls.
- A. Correct.
Correct. This option reflects what a strong project scope statement should contain: clear linkage to business and organizational objectives, explicit boundaries, defined deliverables, exclusions, measurable success criteria, and constraints such as budget and timeline. It also supports executive governance by showing how the project addresses audit findings, reduces risk, and enables business growth such as acquisitions. A scope statement should clarify what is included and excluded so that stakeholders can manage expectations and control scope creep.
- B. Incorrect.
Incorrect. Although speed and flexibility may seem attractive, allowing regional teams to determine scope and controls independently weakens governance and undermines alignment with enterprise objectives. This approach risks inconsistent control implementation, unclear accountability, and scope fragmentation. A CCISO-level scope statement should establish enterprise direction and boundaries rather than defer core scope decisions to local teams.
- C. Incorrect.
Incorrect. This option is too broad and unrealistic for an IAM modernization project. Replacing all legacy authentication, HR, and ERP systems expands the effort far beyond a reasonable project boundary and confuses the project objective with wholesale enterprise transformation. It also makes an absolute promise to eliminate risk and ensure full compliance with current and future regulations, which is not an appropriate or achievable scope statement.
- D. Incorrect.
Incorrect. A technical implementation plan is not a substitute for a project scope statement. Deferring business objectives and measurable outcomes until after tool selection reverses proper governance sequence. The scope should be established first so technology decisions can be evaluated against organizational goals, risk priorities, and success criteria.