712-50 Question 98
Single answerOrganizational Change LeadershipA newly appointed CISO is leading a company-wide security transformation after several audit findings revealed inconsistent access management and weak data handling practices across business units. Previous security initiatives failed because business leaders viewed them as IT-imposed controls that slowed operations. The CEO has approved the new program but warned that adoption must improve quickly without creating major disruption to revenue-generating teams. Which action should the CISO take FIRST to improve the likelihood of successful organizational change?
- A
Mandate immediate compliance with the new security standards across all departments and track violations through monthly audit reports
- B
Begin with a stakeholder analysis and change impact assessment, then align the security program messaging and rollout to business priorities and influential sponsors
- C
Deploy technical controls rapidly in the highest-risk areas so employees adapt to the new processes through enforced usage
- D
Launch a mandatory security awareness campaign for all staff before engaging business unit leaders, since user behavior is the root cause of most control failures
Show answer and explanation
Correct answer: B
Explanation
In CCISO-level organizational change leadership, the CISO is expected to drive enterprise adoption by influencing culture, governance, and executive alignment rather than relying primarily on mandates or technical enforcement. Established change management practices, such as stakeholder analysis, sponsor engagement, impact assessment, targeted communications, and phased implementation, are critical when prior efforts failed due to resistance and lack of business ownership. This aligns with recognized change management principles found in frameworks and guidance such as Prosci change management concepts, COBIT governance alignment principles, and NIST guidance emphasizing the importance of organizational roles, risk communication, and integrating security into business processes. The best first action is therefore to understand the affected stakeholders and business impacts, then build a sponsor-backed rollout aligned to business priorities.
- A. Incorrect.
This is incorrect because immediately mandating compliance without first building stakeholder alignment, understanding business impacts, and identifying resistance patterns often reinforces the perception that security is an external constraint. Audit tracking is useful for governance, but in organizational change leadership it is not the best first step when prior initiatives failed due to poor business buy-in.
- B. Correct.
This is correct because effective organizational change leadership starts with understanding who is affected, how workflows and incentives will change, where resistance is likely, and which executives can champion the initiative. A stakeholder analysis and change impact assessment allow the CISO to tailor messaging, sequence rollout, and connect security outcomes to business objectives such as operational continuity, customer trust, and regulatory performance. This approach directly addresses the root cause of previous failure: lack of ownership outside IT.
- C. Incorrect.
This is incorrect because technical enforcement can reduce risk in some cases, but using technology first as the primary change mechanism often causes friction, workarounds, and opposition if business process implications are not addressed. In a broad transformation involving multiple business units, successful adoption depends on governance, sponsorship, communication, and readiness planning before large-scale enforcement.
- D. Incorrect.
This is incorrect because awareness training alone rarely resolves structural adoption issues. If business leaders are not engaged first, employees may receive the message that security is another compliance exercise rather than a business-supported change. Training is an important enabler, but it should follow or accompany a broader change strategy that includes leadership sponsorship and role-based impact management.