Question

A newly appointed information security manager is building out the security program and discovers that the existing team lacks the specialized skills needed to operate a recently acquired cloud-native SIEM platform. Budget for additional headcount will not be available until the next fiscal year. Which of the following is the BEST course of action to ensure the program's monitoring capability is sustained in the interim?

Accepted Answer

Engage a managed security service provider under a time-bound contract while developing an internal skills-development plan

Answer

Postpone deployment of the SIEM platform until internal staff can be hired and trained next fiscal year

Answer

Reassign existing staff to operate the SIEM and require them to learn the platform on the job

Answer

Reduce the scope of monitoring to only the assets the current team can support with existing skills