712-50 Question 417
Single answerA newly appointed CISO is reviewing a proposed three-year, $4.5 million security modernization program that includes endpoint detection and response (EDR), privileged access management (PAM), and expanded security monitoring. The CEO supports stronger security, but the CFO has challenged the business case because the proposal mainly emphasizes tool features and industry trends rather than measurable financial value. The organization’s strategic plan prioritizes protecting digital revenue channels, reducing operational disruption, and improving audit readiness ahead of a planned market expansion. Which action should the CISO take FIRST to best demonstrate sound cost management and ROI while ensuring alignment to the strategic plan?
- A
Rebuild the proposal into a risk-based business case that maps each investment to strategic objectives, quantifies expected reduction in loss exposure and operational impact, and includes total cost of ownership over the program lifecycle
- B
Proceed with the most mature technology stack available because stronger technical capability will inherently produce positive ROI over time
- C
Delay the program until the security team can produce benchmark data showing that peer organizations have implemented similar tools successfully
- D
Request that procurement negotiate lower licensing costs first, since reducing upfront spend is the most important factor in demonstrating ROI
Show answer and explanation
Correct answer: A
Explanation
At the CCISO level, security investment decisions should be governed as business initiatives, not tool purchases. The best first action is to develop a risk-based business case that aligns spending with enterprise strategy and quantifies expected value. This typically includes mapping investments to strategic objectives, identifying key risk scenarios, estimating current and target-state exposure, and presenting TCO, expected benefits, implementation dependencies, and measurable success indicators. Widely accepted practices from enterprise governance and risk frameworks support this approach: NIST SP 800-30 emphasizes risk-informed decision-making; NIST CSF 2.0 highlights governance and prioritization of cybersecurity outcomes; and ISACA/COBIT principles reinforce alignment of IT and security investments to business objectives and value delivery. While exact ROI calculations in cybersecurity can be challenging because some benefits are loss avoidance and resilience gains, executive decision-makers still expect financially grounded analysis, including cost management, reduction in probable business impact, and clear linkage to strategic outcomes.
- A. Correct.
This is correct because the CISO must translate security investments into business terms before seeking approval. A defensible business case should connect proposed controls to strategic objectives, such as protecting digital revenue, reducing downtime, and supporting audit readiness. It should also estimate financial impact using measures such as reduced annualized loss exposure, avoided disruption costs, implementation and operating expenses, staffing implications, and total cost of ownership (TCO). This approach demonstrates both cost governance and strategic alignment, which is expected at the executive level.
- B. Incorrect.
This is incorrect because technical maturity alone does not justify expenditure. A common mistake is assuming that the 'best' tools automatically generate value. CCISO-level decision-making requires evaluating whether capabilities address prioritized business risks and whether expected benefits justify full lifecycle costs. Without that analysis, the organization may overspend on features that do not materially support strategic goals.
- C. Incorrect.
This is incorrect because peer benchmarking can be informative, but it is not the first step in establishing ROI for this organization. What succeeded elsewhere may not match this company’s risk profile, operating model, or strategic plan. Executive approval depends on organization-specific value, not just evidence that competitors or peers adopted similar technologies.
- D. Incorrect.
This is incorrect because lower acquisition cost does not by itself prove ROI. Focusing first on price can lead to under-scoped solutions, hidden operational costs, or failure to address the most important risks. Procurement optimization is useful after the organization has defined the required outcomes, target risk reduction, and full cost-benefit profile.