A business unit of a large enterprise has outsourced the hosting and development of a new external website
which will be accessed by premium customers, in order to speed up the time to market timeline. Which of the
following is the MOST appropriate?

A.
The external party providing the hosting and website development should be obligated under contract to
provide a secure service which is regularly tested (vulnerability and penetration). SLAs should be in place
for the resolution of newly identified vulnerabilities and a guaranteed uptime.

B.
The use of external organizations to provide hosting and web development services is not recommended as
the costs are typically higher than what can be achieved internally. In addition, compliance with privacy
regulations becomes more complex and guaranteed uptimes are difficult to track and measure.

C.
Outsourcing transfers all the risk to the third party. An SLA should be in place for the resolution of newly
identified vulnerabilities and penetration / vulnerability testing should be conducted regularly.

D.
Outsourcing transfers the risk to the third party, thereby minimizing the cost and any legal obligations. An
MOU should be in place for the resolution of newly identified vulnerabilities and penetration / vulnerability
testing should be conducted regularly.