The Chief Executive Officer (CEO) of a Small Startup Company

The Chief Executive Officer (CEO) of a small startup company has an urgent need for a security policy and assessment to address governance, risk management, and compliance. The company has a resource-constrained IT department, but has no information security staff. The CEO has asked for this to be completed in three months. Which of the following would be the MOST cost-effective solution to meet the company's needs?

A) Select one of the IT personnel to obtain information security training, and then develop all necessary policies and documents in-house.
B) Accept all risks associated with information security, and then bring up the issue again at next year's annual board meeting.
C) Release an RFP to consultancy firms, and then select the most appropriate consultant who can fulfill the requirements.
D) Hire an experienced, full-time information security team to run the startup company's information security department.