The ISO/IEC 2700 family focuses on ________.

• A. corporate governance
• B. IT governance
• C. IT security governance
• D. All of the above about equally

Answer: (C)

The main idea tested is that the ISO/IEC 27000 family is all about governing information security within an organization, implemented through an Information Security Management System (ISMS). It provides the framework, requirements, and controls to protect information assets, manage security risks, and continually improve security posture. This focus is specific to information security governance in the IT context, rather than governing the organization as a whole or IT governance in broad terms. Corporate governance deals with overall organizational direction and accountability, while IT governance covers IT’s role in achieving business objectives more broadly. Because the standards concentrate on securing information and managing related risks, IT security governance is the best fit.