712-50 Question 47
Single answerUnderstand information security changes, trends, and best practicesA newly appointed CISO is preparing a 3-year security strategy for a global enterprise that has rapidly adopted SaaS, remote work, and cloud-native development. The board is concerned that the current security program is still centered on perimeter controls and annual compliance audits. The CISO wants to align the strategy with current security trends and best practices while ensuring measurable business value. Which action should the CISO prioritize FIRST to build an effective forward-looking strategy?
- A
Commission an enterprise-wide assessment to identify how business changes, threat trends, technology adoption, and regulatory developments affect the organization's risk profile, then use the results to define strategic security priorities
- B
Increase spending on next-generation firewall technologies to strengthen the network perimeter before evaluating other initiatives
- C
Adopt every major emerging security framework in parallel so the program reflects the latest industry direction
- D
Require all business units to complete annual compliance checklists before any strategic security changes are approved
Show answer and explanation
Correct answer: A
Explanation
The best first step is to establish a current, enterprise-level understanding of how information security changes, trends, and best practices affect the organization. For a CISO, strategy should be driven by business context, threat intelligence, technology transformation, and regulatory developments, not by isolated tool purchases or compliance rituals. This approach is consistent with widely used guidance such as NIST CSF 2.0, which emphasizes organizational context, governance, risk assessment, and continuous improvement; NIST SP 800-37 and SP 800-30, which support risk-based decision-making; and ISO/IEC 27001 and 27005, which stress risk assessment and treatment as the basis for security planning. In practice, modern trends such as zero trust principles, cloud security posture management, identity-centered controls, software supply chain security, and resilience planning should be evaluated only after the organization understands where they provide the greatest reduction in business risk. A CCISO-level leader is expected to translate these trends into prioritized strategic initiatives tied to enterprise objectives and measurable outcomes.
- A. Correct.
Correct. A CISO should begin by understanding how changes in the business environment, threat landscape, technology architecture, and regulatory obligations alter enterprise risk. This creates a defensible basis for strategy, investment prioritization, and governance. In a modern environment shaped by SaaS, remote work, and cloud-native development, relying on legacy assumptions about perimeter defense is insufficient. A structured assessment supports risk-based planning and aligns with accepted security leadership practice.
- B. Incorrect.
Incorrect. Strengthening perimeter controls may be useful in some contexts, but prioritizing firewall investment first assumes the main problem is still perimeter-centric. In a distributed enterprise with cloud services, remote users, and modern application delivery, this can misallocate resources. The misconception is treating a tactical control upgrade as a strategic response without first reassessing the organization's evolving risk profile.
- C. Incorrect.
Incorrect. Adopting multiple emerging frameworks in parallel is not a best practice and often creates duplication, confusion, and governance overhead. Frameworks should be selected and tailored based on business needs, risk, maturity, and regulatory context. The misconception is equating more frameworks with better security, rather than using a coherent, risk-driven operating model.
- D. Incorrect.
Incorrect. Compliance activities are important, but annual checklist-driven compliance should not gate strategic modernization. Compliance is typically a subset of security governance, not a substitute for strategy. The misconception is assuming that passing audits demonstrates preparedness for new threats and operating models; in reality, compliance alone may lag current risks and business changes.