I have chosen option two as I was recently been hired as CISO of a large, well-established company. I would approach the issue by assesting the situation, as working for a large company we need to evaluate the circumstances and assesing the danger and security issues that hold, after I will be check procedure to see how to move forward with the circumstances. My biggest approach will be able to develop a procedure for the company to ensure as a company we are covering everyarea such as data protection within our work devices, and security training within our staff for example when receiving an unknown email that seems suspicious with an unknown link send iit over to the security team to access the address and ensure it is coming from an outside source attempting to receive information of the company. How I would engage stakeholders in my plan to create a security portfolio I will communicate the importance of security to my team members and staff to ensure the importance and reasons why we have to improve on security not only for the company but for the clients safety ?