712-50 Question 236
Single answerEnsure that necessary changes and improvements to the information systems processes are implemented as requiredA newly appointed CISO learns that several recent security incidents were caused by inconsistent user access reviews, delayed vulnerability remediation, and undocumented exceptions to change procedures. Internal audit has already issued findings, and the board expects measurable improvement within two quarters. The CISO has funding for only one major initiative this year and wants to ensure that required improvements to information systems processes are actually implemented and sustained across business units. Which action should the CISO take FIRST to achieve this objective?
- A
Launch a companywide security awareness campaign so process owners better understand their responsibilities
- B
Implement a formal governance-driven remediation program that assigns ownership, prioritizes process changes based on risk, defines target metrics, and tracks closure through management review
- C
Acquire a new security orchestration platform to automate vulnerability management, access reviews, and change approvals across all systems
- D
Require every business unit to rewrite its local procedures immediately and submit them for annual policy approval
Show answer and explanation
Correct answer: B
Explanation
At the CCISO level, the key issue is not merely identifying weaknesses but ensuring that necessary changes to information systems processes are implemented effectively, prioritized appropriately, and sustained through oversight. The strongest first step is to establish a formal remediation and improvement program under governance structures that define ownership, risk-based priorities, timelines, metrics, and escalation paths. This reflects leadership responsibilities for corrective action management and continual improvement.
Relevant best practices support this approach. ISO/IEC 27001 emphasizes continual improvement of the information security management system through corrective actions and management review. NIST Cybersecurity Framework highlights governance, improvement, and risk-informed prioritization across functions. NIST SP 800-53 and related guidance reinforce tracking remediation actions, assigning responsibilities, and verifying closure effectiveness. From an audit and executive reporting perspective, boards and regulators generally expect evidence of accountable ownership, milestone tracking, exception management, and measurable reduction in control gaps.
In short, before launching awareness efforts, rewriting procedures in isolation, or buying new tools, the CISO should create the governance mechanism that ensures process changes are implemented, monitored, and validated.
- A. Incorrect.
This is a plausible action, but it is not the best first step. Awareness can improve understanding and compliance, yet the scenario highlights systemic process weaknesses, audit findings, and a need for measurable implementation. Without formal ownership, prioritization, accountability, and monitoring, awareness alone does not ensure that necessary process improvements are designed, executed, and sustained.
- B. Correct.
This is the best answer. A governance-driven remediation program directly addresses the CISO's need to ensure that required changes are implemented. It establishes accountable owners, risk-based prioritization, target dates, performance indicators, and management oversight. This approach is aligned with executive-level security leadership responsibilities and with common control improvement practices in frameworks such as NIST CSF, NIST SP 800-53 corrective action concepts, ISO/IEC 27001 continual improvement, and audit remediation management. It is also realistic given limited funding, because it focuses first on governance and execution rather than assuming technology alone will solve process deficiencies.
- C. Incorrect.
This is attractive because automation can help reduce delays and inconsistency, but it is not the best first action. Technology deployment without first defining standardized processes, roles, exception handling, and success metrics often automates flawed practices. In addition, the scenario states there is funding for only one major initiative, so choosing a tool before establishing governance and remediation priorities creates execution risk and may fail to satisfy audit and board expectations for demonstrable process improvement.
- D. Incorrect.
This option appears action-oriented, but it is overly tactical and likely to create inconsistent results. Forcing each business unit to rewrite procedures immediately can lead to fragmented controls, uneven quality, and little assurance that the highest-risk issues are addressed first. Annual policy approval is also too slow and too disconnected from active remediation tracking to meet the board's expectation for measurable improvement within two quarters.