Final answer:
An outside vendor is typically recommended to execute penetration tests during a security evaluation, providing an unbiased view of the corporate network's security.
Step-by-step explanation:
When a Chief Information Security Officer (CISO) is evaluating the security of a corporate network and connected devices, utilizing an outside vendor is often recommended for penetration tests. These tests involve simulating a cyber attack against the company’s network to identify exploitable vulnerabilities. An external party performing the penetration test can provide an unbiased view and is less likely to be influenced by internal policies or politics, which might affect the rigor of the test.
Vulnerability assessments, while sometimes done by third parties, can also be conducted internally. However, unbiased third-party assessments can also offer value. Tabletop exercises are designed to be internal drills, wherein team members walk through security scenarios to assess their incident response plans. Blue-team operations, which involve defensive measures against simulated attacks, are typically performed by the company's own security team.