Information Security Frameworks and Standards
Frameworks and standards give structure and assurance. Candidates should understand ISO/IEC 27001 as the certifiable standard for an information security management system (ISMS) built on continual improvement, and ISO/IEC 27002 as guidance on controls. ISO/IEC 27005 addresses risk management, and 27017 covers cloud security. The Plan-Do-Check-Act cycle underpins the ISMS: establish the system, implement it, monitor and review, then improve. Certification means an independent auditor has verified the ISMS against the standard, not that the organisation is perfectly secure.
Other frameworks
COBIT supports IT governance, ITIL covers service management, and NIST publications (such as the Cybersecurity Framework and SP 800-53) provide control catalogues and risk guidance. PCI DSS is a contractual standard for cardholder data, not a law. Legislation differs from standards: laws are mandatory, standards are often voluntary or contractual. Legislation relevant to candidates includes data protection law, computer misuse law and industry regulation. Basel II and similar frameworks address financial-sector operational risk.
Traps and worked example
Examiners like to test whether a standard is certifiable (27001 is; 27002 is guidance) and to confuse compliance with security. A common question asks what certification proves: it demonstrates that a management system conforms, not that no breaches can occur. Worked example: a firm wants to reassure clients that its security management is independently verified, so it certifies to ISO/IEC 27001; if it merely wants control guidance it uses 27002. Rule of thumb: match the framework to the purpose, governance, control guidance, assurance or legal compliance.