Which framework is specifically focused on information security controls?

Which framework is specifically focused on information security controls?

• A. ITIL
• B. CMM
• C. ISO 27002
• D. PMBOK Guide

Answer: (C)

ISO 27002 is designed specifically to provide guidelines for establishing, implementing, maintaining, and continuously improving information security management practices. It outlines security controls based on internationally recognized best practices, making it a vital resource for organizations looking to enhance their information security posture. The framework includes detailed descriptions of various security controls and how to implement them, focusing on areas such as risk assessment and treatment, and aligns closely with the principles of ISO 27001, which deals with establishing an information security management system. This makes ISO 27002 particularly relevant for organizations that aim to protect their information assets effectively. In contrast, ITIL is primarily focused on IT service management, CMM (Capability Maturity Model) addresses process improvement and organizational maturity, while PMBOK (Project Management Body of Knowledge) provides standards for project management. These frameworks do not specifically target information security controls in the way that ISO 27002 does.

ISO 27002 is designed specifically to provide guidelines for establishing, implementing, maintaining, and continuously improving information security management practices. It outlines security controls based on internationally recognized best practices, making it a vital resource for organizations looking to enhance their information security posture.

The framework includes detailed descriptions of various security controls and how to implement them, focusing on areas such as risk assessment and treatment, and aligns closely with the principles of ISO 27001, which deals with establishing an information security management system. This makes ISO 27002 particularly relevant for organizations that aim to protect their information assets effectively.

In contrast, ITIL is primarily focused on IT service management, CMM (Capability Maturity Model) addresses process improvement and organizational maturity, while PMBOK (Project Management Body of Knowledge) provides standards for project management. These frameworks do not specifically target information security controls in the way that ISO 27002 does.