712-50 Question 354
Single answerA global SaaS company has grown through acquisition and now runs hundreds of internet-facing applications built by internal teams and third-party vendors. During a quarterly board review, the CISO is asked to reduce the organization's exposure to emerging vulnerabilities in open-source components and supplier-managed software without significantly slowing product delivery. Current issues include inconsistent subscription to vendor security advisories, limited visibility into software dependencies, and no formal process to evaluate whether threat intelligence is relevant to business-critical assets. Which action should the CISO prioritize FIRST to establish an effective enterprise threat management program?
- A
Mandate immediate patching of all published CVEs within 72 hours across all systems, including third-party hosted applications, to demonstrate strong governance
- B
Implement a centralized threat management process that maps threat intelligence and security bulletins to an asset inventory and software bill of materials (SBOM), with defined ownership for internal and third-party remediation workflows
- C
Outsource vulnerability monitoring entirely to each strategic supplier and require annual attestations that they review open-source and vendor security bulletins
- D
Increase perimeter monitoring and block indicators of compromise from commercial intelligence feeds until the organization can fund a broader software risk program
Show answer and explanation
Correct answer: B
Explanation
The best first step is to establish a centralized, risk-based threat management capability that connects three things: relevant intelligence, visibility into assets and dependencies, and accountable remediation workflows. For a CCISO, the priority is not merely receiving threat feeds or issuing aggressive patch mandates, but ensuring the organization can determine whether a bulletin or intelligence item affects business-critical systems and who must act. In practice, this means maintaining an accurate asset inventory, tracking software dependencies through mechanisms such as an SBOM, and integrating vendor advisories, vulnerability intelligence, and third-party risk processes into a common operating model.
This aligns with widely recognized best practices. NIST SSDF (SP 800-218) emphasizes managing software component risks and receiving/responding to vulnerability information. NIST SP 800-161 on supply chain risk management highlights visibility, supplier coordination, and governance. CISA and other industry guidance increasingly promote SBOM usage to improve transparency into software components, especially open-source dependencies. The key executive decision is to build a program that enables prioritization based on asset criticality, exploitability, business impact, and ownership rather than reacting uniformly to every bulletin or delegating accountability to suppliers.
- A. Incorrect.
This is incorrect because it imposes a blanket SLA based on CVE publication rather than business risk, exploitability, asset criticality, compensating controls, and operational feasibility. Many vulnerabilities are not equally urgent, and third-party hosted applications may be outside the organization's direct patching authority. A CCISO-level program should first create the governance, visibility, and decision framework needed to prioritize action, not start with an unrealistic universal patch mandate.
- B. Correct.
This is correct because an effective threat management program begins with visibility and relevance. Mapping threat intelligence and security bulletins to a current asset inventory and SBOM allows the organization to determine which threats actually affect its environment, especially for open-source components and supplier-managed software. Defined ownership and workflows for both internal teams and third parties are essential to operationalize remediation, escalation, and exception handling. This approach balances risk reduction with delivery needs and supports governance at enterprise scale.
- C. Incorrect.
This is incorrect because supplier attestations alone provide limited assurance and do not give the organization timely operational visibility into exposure. Third-party risk management should include contractual requirements, monitoring, escalation paths, and validation mechanisms, not complete delegation. The misconception is that annual compliance evidence is sufficient for fast-moving software supply chain risk; in practice, threat management requires more continuous oversight.
- D. Incorrect.
This is incorrect because perimeter blocking can be useful for some threats, but it does not address the core issue described: unknown exposure to vulnerable software components and inconsistent intake of security advisories. Indicators of compromise are also more useful for detecting active threats than for managing software vulnerability exposure. This option treats a software supply chain and vulnerability governance problem as primarily a network defense problem.