In terms of security design in the information security program lifecycle, there are three possible solutions to find security controls that can ensure confidentiality, integrity, availability, authentication, and non-repudiation, i.e.

Option 1: we can design our own security controls,

Option 2: hire security experts, or

Option 3: select security controls from prescribed security control catalogs.

a. Discuss the pros and cons of each one of the options above.

b. Which option do you think is the best?

Give your reasons and examples.