Which security function is usually not outsourced?

• A. Planning
• B. Intrusion detection
• C. Vulnerability testing
• D. All of the above

Answer: (A)

The question tests which security function is typically kept in-house because it requires deep knowledge of the organization’s business context, policies, and governance. Planning involves defining security strategy, risk management, and policy development—areas that need tight alignment with business goals, regulatory requirements, and internal decision-making processes. Keeping planning in-house ensures the organization maintains control, accountability, and the ability to tailor controls to its unique environment.

In contrast, intrusion detection and vulnerability testing are commonly outsourced because they are specialized, ongoing, and benefit from external expertise and round-the-clock capabilities. Outsourcing the monitoring and periodic testing helps leverage up-to-date tools, skilled personnel, and scalable resources.

So, the function usually not outsourced is planning.