Which statement about the ISO/IEC 2700 family is accurate according to the material?

• A. Corporate governance
• B. IT governance
• C. IT security governance
• D. All of the above about equally

Answer: (C)

The ISO/IEC 27000 family centers on information security management within an organization, providing the framework, controls, and processes to protect information assets through an information security management system. Because of that focus, the material describes governance of information security—how security decisions are made, risks are managed, and controls are implemented to protect confidentiality, integrity, and availability. That makes IT security governance the best description.

Corporate governance covers the overall direction and oversight of the entire organization, not specifically information security management. IT governance is broader still, encompassing how IT supports business objectives in general; the 27000 series zooms in on information security management rather than IT governance as a whole. So options about corporate governance or IT governance aren’t as accurate, and the “all of the above equally” choice isn’t correct.