The Chief Executive Officer (CEO) of a small startup company has an urgent need for a security policy and assessment to address governance, risk management, and compliance. The company has a…

Question

Options

• ASelect one of the IT personnel to obtain information security training, and then develop all
• BAccept all risks associated with information security, and then bring up the issue again at next
• CRelease an RFP to consultancy firms, and then select the most appropriate consultant who can
• DHire an experienced, full-time information security team to run the startup company's information

• A
  7% (3)
• B
  13% (6)
• C
  76% (35)
• D
  4% (2)

Explanation

Releasing an RFP (Request for Proposal) to external consultancy firms is the most cost-effective approach given the constraints: no in-house security staff, a resource-limited IT team, a tight three-month deadline, and a startup budget. Consultants bring immediate, specialized expertise in governance frameworks (NIST, ISO 27001, SOC 2) without the long-term overhead of full-time salaries and benefits. An RFP process also allows the company to select the best value offering. Option A (training an existing IT person) is problematic because building competency takes much longer than three months and the quality of the resulting policy may be insufficient for real compliance needs. Option B (accepting all risks) is irresponsible and fails to meet the stated GRC requirement - it creates liability without any mitigation. Option D (hiring a full-time security team) is the most expensive option and not justified for a startup with no existing security program, especially under a cost-effectiveness constraint.

No community discussion yet for this question.