712-50 Question 96
Single answerLeading at Scale and ScopeA newly appointed CISO has been asked to lead cybersecurity across a global enterprise that has grown rapidly through acquisitions. Business units operate with different risk tolerances, overlapping security tools, and inconsistent reporting to executive leadership. The CEO wants the CISO to improve enterprise-wide security outcomes without slowing regional innovation or creating unnecessary friction with business leaders. Which action should the CISO take FIRST to lead effectively at this scale and scope?
- A
Standardize all security technologies and processes across every business unit within the first year to eliminate inconsistency
- B
Establish an enterprise security governance model with clear decision rights, a common risk taxonomy, and business-aligned metrics for reporting
- C
Delegate security ownership entirely to regional CISOs so each geography can tailor controls to local operational needs
- D
Begin by increasing the frequency of technical vulnerability scans and penetration tests across all acquired entities
Show answer and explanation
Correct answer: B
Explanation
Leading at scale and scope in a CCISO context requires building an operating model that connects cybersecurity strategy to enterprise governance, business priorities, and risk management. In a large, federated, or acquisition-heavy organization, the first priority is usually not a technology action but a leadership action: define how decisions are made, who is accountable, how risk is classified, and how performance is reported. This aligns with widely recognized practices from governance and risk frameworks such as NIST CSF, which emphasizes governance and risk management outcomes, and COBIT, which stresses governance objectives, decision rights, and alignment between enterprise goals and IT/security objectives. A mature CISO should create centralized visibility and consistent risk communication while allowing appropriate local implementation flexibility. That is the core of effective leadership at enterprise scale.
- A. Incorrect.
This is not the best first action. While rationalizing tools and processes may eventually be appropriate, forcing immediate enterprise-wide standardization in a complex post-acquisition environment can create resistance, disrupt business operations, and ignore legitimate local requirements. At the executive level, leading at scale starts with governance, alignment, and decision-making structures before large-scale implementation changes.
- B. Correct.
This is the best answer. In a distributed enterprise, the CISO must first create a governance structure that clarifies accountability, escalation paths, and authority across business units. A common risk taxonomy enables leaders to compare issues consistently across acquired entities, and business-aligned metrics help the CEO and board understand security in terms of enterprise impact. This approach supports both scale and flexibility, allowing local variation where justified while maintaining central oversight and strategic alignment.
- C. Incorrect.
This is incorrect because it overcorrects toward decentralization. Regional adaptation is important, but fully delegating security ownership without enterprise governance usually reinforces fragmentation, inconsistent risk treatment, and weak executive visibility. A CISO leading at scale must balance local autonomy with centralized standards, oversight, and reporting.
- D. Incorrect.
This is a plausible operational step but not the best first action for the scenario. More scanning and testing may identify technical issues, but it does not solve the underlying leadership challenge of inconsistent risk tolerance, duplicated capabilities, and fragmented reporting. Without governance and common priorities, additional findings can actually overwhelm leadership and increase noise rather than improve enterprise-wide outcomes.