The IT department of a large telecommunications company has developed and finalized a set of security solutions and policies which have been approved by upper management for deployment within the…

Question

Options

• Acontact vendor management so the RFI and RFP process can be started as soon as possible.
• Bcontact an independent consultant who can tell them what policies and solutions they need.
• Cdiscuss requirements with stakeholders from the various internal departments.
• Dinvolve facilities management early in the project so they can plan for the new security hardware

• A
  2% (1)
• B
  9% (4)
• C
  84% (36)
• D
  5% (2)

Explanation

Security solutions and policies must be grounded in actual business requirements. The very first step in any security program development is to gather requirements by discussing needs with stakeholders from all relevant internal departments (HR, Finance, Legal, Operations, etc.). Without understanding what the business actually needs to protect and how it operates, any security policy or solution risks being misaligned with reality. Contacting vendors (A) or consultants (B) before understanding internal requirements leads to solutions that may not fit. Involving facilities (D) is appropriate later, when hardware deployment is being planned - not at the requirements-gathering stage.

No community discussion yet for this question.