* Explanation:
* Contracting with a managed security service provider (MSSP) offers 24/7 monitoring and incident detection capabilities without adding full-time staff.
* Current staff can remain on-call for critical incident response, ensuring coverage without increasing headcount.
* Why Other Options Are Incorrect:
* A. Deploy a SEIM solution: While useful, a SEIM requires constant monitoring to be effective.
Simply reviewing incidents in the morning is insufficient.
* C. Configure syslog to send SMS messages: This approach lacks comprehensive monitoring and is reactive rather than proactive.
* D. Employ an assumption of breach protocol: This does not address the need for consistent monitoring and is not a direct solution to coverage gaps.
* EC-Council CISO Reference:The program highlights the value of MSSPs in enhancing organizational security capabilities while managing costs.

Comprehensive and Detailed Explanation (250-350 words) From Exact Extract from Chief Information Security Officer (CCISO) Documents:
According to the EC-Council CCISO framework, a security strategy must clearly define alignment to business objectives and articulate the organization's risk tolerance. CCISO documentation repeatedly emphasizes that security programs exist to enable the business, not operate independently of it.
The security strategy outlines how security initiatives support revenue, operational resilience, regulatory compliance, and strategic growth while operating within acceptable risk boundaries defined by leadership.
CCISO guidance notes that without this alignment, security programs become cost centers rather than value enablers.
Market data, audit history, or board statements may inform strategy, but they are not core components.
Therefore, alignment with business goals and risk tolerance is most often included.

Explanation