CCISO (712-50) Executive Decision Simulation

Executive Briefing

You recently championed a $2.5 million Enterprise Identity and Access Management (IAM) overhaul to address a critical audit finding. The board approved the project with a strict six-month deadline to align with the upcoming fiscal year regulatory compliance audit.

Business Context

Three months into the project, the PMO reports that the budget has ballooned to $3.2 million, and the timeline is pushed back by 10 weeks. Upon review, you discover that various Business Unit Directors requested "small enhancements"—such as biometric integrations, vendor portal customizations, and legacy app single sign-on (SSO)—which the engineering team accepted without formal review. These additions, while arguably good for security, jeopardize the foundational compliance deadline.

Decision Scenario

You are stepping into a heated steering committee meeting to rein in the project. The business leaders are defending the added features as necessary improvements, but you must identify the core governance failure that allowed the project to spiral out of control in the first place, ensuring it is properly labeled and stopped.

Question

Which of the following refers to the quantity or quality of project deliverables expanding from the original project plan?

Strategic Analysis

1. What is the real problem

The root cause of the budget and timeline overrun is not the technical difficulty of the IAM rollout, but a complete failure in project governance. Changes to the project's requirements were accepted informally by engineers, bypassing a formalized Change Control Board (CCB).

2. Business vs security perspective

From a purely technical security perspective, adding biometric MFA and vendor SSO is highly desirable. However, from an executive business perspective, failing a compliance audit because the baseline security controls weren't implemented on time poses a catastrophic enterprise risk. Security must align with the agreed-upon business charter.

3. Risk and impact analysis

Uncontrolled expansion introduces multiple risks: budget depletion, resource burnout, missed strategic deadlines, and architectural complexity. Every "small addition" compound-stresses the original timeline, threatening the very reason the project was funded in the first place.

4. Why correct answer is BEST

A. Scope creep is the correct standard terminology. In information security management and IT project governance (aligned with PMBOK and CCISO frameworks), scope creep describes the uncontrolled, unapproved continuous growth or changes to a project's scope. Recognizing and halting scope creep is a core leadership competency for a CISO.

5. Why other options are weaker

• B. Deadline extension: This is a symptom or consequence of scope creep, not the term for the expansion of the deliverables themselves.
• D. Scope modification: This term implies a formal, approved change to the project scope (e.g., via a change request approved by a steering committee), whereas the scenario specifically targets the unmanaged, continuous expansion.
• C. Deliverable expansion: This is an informal, non-standard term used as a distractor. It lacks the recognized definition found in formal project management and governance frameworks.

6. MINI LESSON: Project Governance & Change Control