A newly hired information security manager discovers that business units routinely skip the security review step so they can hit product launch dates, and no one has been sanctioned for it. What should the security manager do FIRST?
Select an answer to reveal the explanation.
Short Explanation
Think of it like a doctor meeting a new patient: you don't prescribe before you ask where it hurts. Skipped reviews are a symptom, and until you know why the business keeps doing it and how much risk leadership is actually willing to carry, any control you bolt on just gets routed around. The trap is grabbing the enforcement lever on day one.
Full Explanation
When a control is bypassed routinely and without consequence, the bypass is a cultural signal, not just a process failure. The security manager's first move is to understand the business drivers behind it: launch pressure, how security is perceived, and what level of risk senior management is prepared to accept. That understanding determines whether the review process is too slow, poorly positioned, or simply not valued, and it lets the manager propose changes that the business will adopt. Imposing a mandatory sign-off gate before that diagnosis treats the symptom; a gate that conflicts with business priorities tends to generate exceptions or quiet workarounds. Escalating the offending units to the audit committee turns a governance conversation into a blame exercise and damages the partnership the manager will need. Automated pipeline scanning is a useful technical control, but it assumes the problem is review speed and chooses a solution before the cause and risk appetite are known. Exam caveat: on CISM, a new manager facing an established pattern almost always starts by understanding the organization before changing it. Operational check: interview the affected product owners, map where the review sits in their delivery timeline, and confirm with senior management the risk appetite for launch-related exposure.