A firm’s Chief Executive Officer (CEO) is concerned that IT staff lacks the knowledge to identify complex vulnerabilities that may exist in a payment system being internally developed. The payment system being developed will be sold to a number of organizations and is in direct competition with another leading product. The CEO highlighted that code base confidentiality is of critical importance to allow the company to exceed the competition in terms of the product’s reliability, stability, and performance. Which of the following would provide the MOST thorough testing and satisfy the CEO’s requirements?
A . Sign a MOU with a marketing firm to preserve the company reputation and use in-house resources for random testing.
B . Sign a BPA with a small software consulting firm and use the firm to perform Black box testing and address all findings.
C . Sign a NDA with a large security consulting firm and use the firm to perform Grey box testing and address all findings.
D . Use the most qualified and senior developers on the project to perform a variety of White box testing and code reviews.
Answer: C