CCISO (712-50) Executive Decision Simulation

Enhance your strategic thinking. This simulation trains you to evaluate business impact, understand governance decisions, and select the best executive path.

Executive Briefing

You are the Chief Information Security Officer (CISO) for a mid-sized financial services firm. A peer executive, the VP of Sales, approaches you informally to request immediate access to the email account of one of their direct reports. They cite an urgent internal matter but wish to handle it "quietly and quickly."

Business Context

The organization operates in a highly regulated environment. To protect the firm's assets, there is a prominent "no right to privacy" notice on all corporate logon screens, and all employees have signed an Acceptable Use Policy (AUP) acknowledging this condition. While the company legally retains the right to monitor communications, the Board of Directors expects all internal investigations to strictly adhere to the established risk management and compliance frameworks to prevent legal liabilities and HR disputes.

Decision Scenario

Your relationship with the VP of Sales is excellent, and you want to be a business enabler. Technically, your team can grant access in less than a minute. However, granting access purely on informal verbal authorization—even with an AUP in place—bypasses standard governance controls. You must balance supporting a peer executive's urgent request with enforcing the enterprise control framework to protect the organization from undocumented risks.

Question

Your company has a "no right to privacy" notice on all logon screens for your information systems and users sign an Acceptable Use Policy informing them of this condition. A peer group member and friend comes to you and requests access to one of her employee's email account. What should you do?

A. Deny the request citing national privacy laws

B. None

C. Grant her access, the employee has been adequately warned through the AUP.

D. Assist her with the request, but only after her supervisor signs off on the action.

E. Reset the employee's password and give it to the supervisor.

Executive Hint: Consider the difference between the legal right to monitor an employee and the internal governance process required to authorize that monitoring. Who owns the risk if this access is challenged in a wrongful termination lawsuit?

Strategic Analysis

1. What is the real problem?
Informal requests bypass governance controls. Even if an action is legally permissible under company policy, executing it without a formal, documented paper trail creates unmanaged HR and legal liabilities.

2. Business vs. Security Perspective
The business unit (VP of Sales) wants speed, agility, and discretion to manage their team. Security and Governance require auditability, proper authorization, and process adherence to protect the enterprise from internal disputes or external litigation.

3. Risk and Impact Analysis
Undocumented access can invalidate findings in an internal investigation. If the employee is terminated based on this access and sues, the lack of a formal authorization process demonstrates a breakdown of internal controls, exposing the company to significant financial and reputational damage.

4. Why the correct answer (D) is BEST
Option D strictly adheres to the governance framework while still supporting the business. It enforces the separation of duties and ensures non-repudiation. By requiring the appropriate level of management/HR sign-off, you create an audit trail and appropriately shift the risk acceptance from the IT/Security department to the authorized business leader.

5. Why other options are weaker:

A: Incorrect. The signed AUP and logon banners establish that the company retains the right to monitor; therefore, broad privacy laws do not typically prevent internal monitoring in this specific context.
B: A non-answer that fails to provide strategic direction.
C: Ignores the need for documented authorization. The AUP warns the employee, but it does not grant peer executives unilateral, undocumented access rights.
E: Poor technical practice. Resetting the password immediately alerts the employee to the investigation, disrupting the user and lacking the required formal authorization layer.

6. Mini Lesson: Governance & Alignment
Governance is not merely about writing policies; it is about enforcing the processes that execute those policies safely. An Acceptable Use Policy grants the organization the right to monitor, but robust internal controls dictate exactly who can authorize that monitoring. This ensures actions are legally defensible and aligned with risk tolerance.

"Policy establishes the right to act; governance ensures the action is authorized, documented, and defensible."

Explore more CCISO simulations to sharpen your executive decision-making.

Visit Practice Tests →