Within the company, there is executive management pressure to start advertising to a new target
market. Due to the perceived schedule and budget inefficiencies of engaging a technology
business unit to commission a new micro-site, the marketing department is engaging third parties
to develop the site in order to meet time-to-market demands. From a security perspective, which of
the following options BEST balances the needs between marketing and risk management?
A.
The third party should be contractually obliged to perform adequate security activities, and
evidence of those activities should be confirmed by the company prior to launch.
B.
Outsourcing is a valid option to increase time-to-market. If a security incident occurs, it is not of
great concern as the reputational damage will be the third party’s responsibility.
C.
The company should never outsource any part of the business that could cause a security or
privacy incident. It could lead to legal and compliance issues.
D.
If the third party has an acceptable record to date on security compliance and is provably faster
and cheaper, then it makes sense to outsource in this specific situation.