Which option is a major standard family for information security management systems?

Which option is a major standard family for information security management systems?

• A. Payment Card Industry Data Security Standard
• B. ISO/IEC
• C. HIPAA
• D. Sarbanes Oxley Act

Answer: (B)

The main idea here is recognizing the broad framework used to manage information security across an organization. The ISO/IEC 27000-series is the major standard family for information security management systems, developed by ISO and IEC. This collection provides a structured, risk-based approach to establishing, implementing, operating, monitoring, reviewing, maintaining, and continually improving an ISMS. The key standard in the family is ISO/IEC 27001, which outlines the requirements for an ISMS, while other parts like ISO/IEC 27002 offer controls and ISO/IEC 27005 covers risk management. That makes ISO/IEC the best choice because it represents the globally recognized framework for information security management systems. The other options refer to more specific or different regulatory frameworks. PCI DSS targets payment card data security, HIPAA governs health information privacy and security, and the Sarbanes-Oxley Act focuses on financial reporting controls. While important, none of them constitute the broad ISMS framework that ISO/IEC 27000 provides.

The main idea here is recognizing the broad framework used to manage information security across an organization. The ISO/IEC 27000-series is the major standard family for information security management systems, developed by ISO and IEC. This collection provides a structured, risk-based approach to establishing, implementing, operating, monitoring, reviewing, maintaining, and continually improving an ISMS. The key standard in the family is ISO/IEC 27001, which outlines the requirements for an ISMS, while other parts like ISO/IEC 27002 offer controls and ISO/IEC 27005 covers risk management. That makes ISO/IEC the best choice because it represents the globally recognized framework for information security management systems.

The other options refer to more specific or different regulatory frameworks. PCI DSS targets payment card data security, HIPAA governs health information privacy and security, and the Sarbanes-Oxley Act focuses on financial reporting controls. While important, none of them constitute the broad ISMS framework that ISO/IEC 27000 provides.