How to think like a manager for the CISSP

What the phrase means

The CISSP is written for people who lead security, not only people who operate it. Most questions describe a situation and ask what you should do. Often, several options would help. The exam is asking which one a security manager, accountable to senior leadership and to the organisation as a whole, would choose.

That is why candidates with deep technical skill sometimes find the CISSP harder than they expected. Their instinct, built over years of good work, is to fix the problem in front of them: patch the server, block the address, change the configuration. Those are often right in real life. In the exam, they are often the second-best answer, because a manager first asks whose decision it is, what the policy says, what the risk is and who needs to be involved.

Thinking like a manager does not mean ignoring technology. It means placing technology inside a bigger frame: people, business purpose, governance and risk.

The priorities behind the manager's answer

When you are torn between options, run through these priorities in order. They resolve most questions.

1. People's safety comes first

Human life and safety outrank every asset, every control and every cost. If a scenario involves fire, a medical emergency, a natural disaster or any threat to people, the right answer protects people before data, systems or evidence. Doors in an emergency fail safe so people can leave; the server room can wait.

2. Security serves the business

Security exists so the organisation can pursue its objectives safely. An answer that stops a risk by stopping the business is rarely right. Look for the option that supports the mission at a cost that makes sense. A control that costs more than the asset it protects is not a good control.

3. Governance sets the direction

Senior management owns security. They set the strategy, approve the policy, accept residual risk and fund the programme. The security function advises and implements. When an answer gives a decision that belongs to senior leadership to a technician, or the other way round, it is probably wrong.

4. Decisions are risk-based

A manager does not chase every vulnerability equally. They identify assets, assess threats and impact, and then choose to mitigate, transfer, avoid or accept each risk. When the question asks what to do before acting, an assessment or analysis is usually the step that comes first.

5. Due care and due diligence

Due diligence is doing the homework: researching, assessing and planning. Due care is acting on it as a reasonable, prudent person would: putting the controls in place and keeping them working. Many questions test whether you can tell which one the situation needs, and whether the organisation has met its duty.

6. Policy before technology

Nothing in a well-run security programme happens without a policy behind it. Policies state intent; standards, procedures and guidelines follow; tools come last. When one option writes or applies a policy and another buys a tool, the policy option usually comes first.

7. Involve the right stakeholders

Security decisions affect legal, HR, finance, operations and the business owners of systems and data. A manager brings the right people in: the data owner decides classification, legal advises on regulation, HR handles disciplinary matters, and senior leadership accepts risk. Answers where the security team acts alone on someone else's decision are traps.

8. Don't fix it yourself

A manager directs, approves, escalates and makes sure the work is done properly through change management. They do not log in and change the configuration at midnight. An answer where you personally make the technical change is usually the technician's answer.

How to read a question

Many wrong answers come from answering a different question from the one asked. Use the same three steps every time.

Step 1: Find the operative word

Before you read the options, find the word that tells you what kind of answer is wanted.

Step 2: Identify your role

Who are you in the scenario? A security manager, a CISO, an auditor, a consultant? Your role defines which actions are yours. An auditor reports and recommends; they do not fix. A CISO advises the board; they do not reconfigure a router.

Step 3: Eliminate, then choose

Remove options that are wrong outright. Then remove options that are too narrow (they fix one system, not the issue) or out of order (they act before assessing). Of the two that remain, choose the one that is more complete and more in keeping with the priorities above.

Technician versus manager: three worked examples

These are our own examples, written for this page to illustrate the reasoning. They are not exam items and are not based on any.

Our example 1: the alarm during the backup

A fire alarm sounds in the data centre while a critical backup job is 90% complete. You are the security manager on site. What should you do FIRST?

• A. Wait for the backup to finish so no data is lost
• B. Make sure everyone leaves the building safely
• C. Shut down the servers in an orderly way to protect the hardware
• D. Call the insurance provider to report a possible loss

The technician's pick: A or C. Both protect valuable assets, and finishing the backup sounds responsible.

The manager's pick: B. The operative word is FIRST, and people's safety outranks every asset. Data can be restored from an earlier backup; people cannot be replaced. Shutting systems down and calling the insurer may follow, but only after everyone is out.

Our example 2: the unapproved file-sharing service

You are the CISO. You learn that the sales team has been using an unapproved cloud file-sharing service to exchange customer proposals with clients for three months. There is no sign of a breach. What should you do FIRST?

• A. Block the service at the web proxy immediately
• B. Meet the head of sales to understand the business need and assess the risk against policy
• C. Deploy a cloud access security broker to monitor uploads
• D. Report the team members to HR for breaching the acceptable use policy

The technician's pick: A. Blocking the service is fast and visibly stops the risk.

The manager's pick: B. There is no active breach, so there is time to understand why the team chose the service and what data is involved. Blocking it without that conversation may stop a business process and push people to an even less visible workaround. The assessment may well end in blocking it, approving it with conditions, or providing an approved alternative, but that decision is made with the business owner, against policy and risk. Monitoring tools and HR action may come later and are not the first step.

Notice the condition: if the question said customer data was being leaked right now, containment would come first. Read the scenario for urgency before you apply the rule.

Our example 3: the critical vulnerability on payroll

A vulnerability scan finds a critical flaw on the production server that runs payroll. The vendor has released a patch. Payroll runs in three days. What is the BEST course of action?

• A. Apply the patch to the production server tonight
• B. Take the payroll server offline until the patch is applied
• C. Assess the risk with the system owner, test the patch, schedule it through change management and use compensating controls until then
• D. Accept the risk until after the payroll run

The technician's pick: A. The patch exists and the flaw is critical, so apply it.

The manager's pick: C. The operative word is BEST, so the most complete answer wins. Patching production untested could break payroll, which is itself a business impact. Taking it offline stops the business. Accepting the risk is a decision for the system owner after an assessment, not a default. Option C covers the risk assessment, the owner's involvement, change management and interim protection: due care in practice.

Common traps

The same patterns turn up again and again in wrong answers.

The do-it-yourself answer

An option where you personally reconfigure, delete, patch or investigate outside process. Managers delegate and follow procedure.

The most technical answer

The option with the most impressive technology is often a distractor. Ask whether a policy, an assessment or a conversation should come first.

The most secure answer

Maximum security that halts the business, or costs more than the asset is worth, is not good security. The exam wants appropriate security.

Skipping a step

Jumping to a fix before identifying assets, assessing risk or getting approval. With FIRST questions, ask what must logically happen before each option.

The wrong person decides

Security deciding a data classification (the owner's job), IT accepting business risk (senior management's job), or a manager handling a legal matter without counsel.

Absolute language

Options that say "always", "never", "all" or "immediately" are worth a second look. Real decisions usually depend on context.

Evidence before people, or evidence trampled

In an incident, people come first; after that, preserve evidence. Options that power off a compromised machine on impulse, or skip the chain of custody, are often wrong.

The default escalation

"Report it to senior management" is sometimes right, but not always. If the matter is within your authority and a clear procedure exists, follow the procedure.

When the manager's answer is not the right one

The rules above are priorities, not reflexes. Three situations call for care.

• The question asks for a technical fact. "Which mechanism provides non-repudiation?" has a technical answer. There is no manager's version of a fact.
• The scenario is urgent. If an attack is under way or people are in danger, containment or evacuation comes before a meeting. Read for urgency first.
• Your role is defined as technical. If the question makes you the network administrator asked to implement an approved change, the right answer is the correct way to implement it.

A useful test: would a sensible security leader be embarrassed by this answer in front of the board? If the manager's option would be absurd in context, it is not the manager's option.

A one-minute checklist

Before you submit any scenario answer, run through these questions:

1. Is anyone's safety at stake? If so, people first.
2. What is the operative word, and what does it ask for?
3. Who am I in this scenario, and is this action mine to take?
4. Has the risk been assessed, and has the owner been involved?
5. Is there a policy or procedure that already covers this?
6. Does my answer support the business, at a sensible cost?
7. Of the remaining options, which covers the most of the problem?

How to practise the mindset

The manager's view is a habit, and habits come from repetition with feedback.

• Use the drill above. Each pair shows a technician's answer and a manager's answer to the same question, with a one-line reason.
• Explain every option. In your practice sessions, say aloud why each wrong option is wrong. If you cannot, you are guessing.
• Keep a traps log. When you fall for a technician's answer, write down which trap it was. Patterns appear within a week.
• Read for role and keyword first. Make it automatic: role, operative word, then options.
• Study the governance domain early. Security and Risk Management carries 16% of the exam and sets the vocabulary of ownership, risk and policy.

How CISSP Buddy trains it

Every question in our bank of 1,700+ carries a short manager's lens note, and every explanation covers each option, not just the key. The Mindset trainer has four drills: spot the operative word before the options appear, pick the manager's answer from a technician-versus-manager pair, discard two options before you may choose, and answer "as the CISO, what do you do FIRST?". The drill on this page uses a sample of those pairs.

Next steps

• Try our free practice questions and read the manager's view on each.
• See how judgement fits into a full plan in how to pass the CISSP.
• Crossing over from a non-technical role? Read CISSP for non-technical professionals.
• Leading a team already? CISSP for managers covers what is different for you.