
Would you make the right call? 

Question 1:  MFA

Quiz score

Postpone MFA implementation until the helpdesk is better staffed.

Roll out MFA in phases, starting with high-risk user groups.

Push through; MFA is too important, roll it out organisation-wide now.

Make MFA optional: those who want it, can enable it.

A supplier you rely on doesn’t have a formal security policy. What’s your best next step?

Question 2: Critical Vulnerability

Proceed with the update and let the product team deal with the consequences.

Assess whether the vulnerable code is actually in use, and produce a temporary risk acceptance document.

Recommend scheduling the fix for the next planned update in three months, leaving the system down for several days is disproportionate.

Escalate to upper management and advise taking the software offline until the update is applied, despite the cost.

Your organisation falls under NIS 2. A security incident affects some internal systems but didn’t impact customer data. What should you do?

Question 3: Phishing test

Organise additional mandatory phishing training for all employees, and increase the frequency of simulations. Consider using incentives to boost engagement and awareness.

People will always fall for phishing to some degree. Training remains necessary, but focus more on technical controls to either reduce phishing email delivery or limit the impact when someone inevitably clicks.

Accept the results, these click rates are normal and unavoidable, and as CISO you have bigger fish to fry.

Ask HR to formally sanction the 15 employees who entered credentials, to set an example.