What is the best staffing model for an incident response team if current employees' expertise is very low?

Question

Options

• AFully insourced
• BFully outsourced
• CPartially outsourced
• DAll the above

• A
  13% (6)
• B
  78% (36)
• C
  7% (3)
• D
  2% (1)

Explanation

Fully outsourcing (B) is correct when internal expertise is very low because building an effective incident response capability from scratch takes years - hiring an experienced Managed Security Service Provider (MSSP) or IR firm gives you immediate access to trained professionals, established playbooks, and specialized tools without the ramp-up time.

Why the distractors fail:

• A (Fully insourced) requires your own staff to handle incidents - impossible when expertise is very low, as inexperienced responders can worsen breaches through poor containment decisions.
• C (Partially outsourced) assumes you have enough internal competence to handle some portion of IR work; with very low expertise, there's no meaningful internal contribution to split the work with.
• D (All the above) is wrong because A and C both depend on a baseline of internal skill that doesn't exist in this scenario.

Memory tip: Think of it as a spectrum - no skill = full outsource, some skill = partial outsource, strong skill = full insource. "Very low" expertise maps directly to the "full outsource" end of that scale.

No community discussion yet for this question.