In the short term, it is better to outsource and have someone that knows what they are doing build your security plan. They will probably suggest ongoing consul

In the short term, it is better to outsource and have someone that knows what they are doing build your security plan. They will probably suggest ongoing consulting as well, but for cost savings it would be better to have period (quarterly or 2x/year) reviews after you have things rolling. Long term, it would be better to build this out internally, but outsourcing could significantly jump start any improvements you'll see.