Which framework is structured as an ISMS with Annex A controls?

Which framework is structured as an ISMS with Annex A controls?

• A. NIST CSF
• B. ISO 27001
• C. COBIT
• D. CIS Controls

Answer: (B)

ISO/IEC 27001 is built around an Information Security Management System (ISMS), a formal, ongoing approach to governing information security risks. The standard explicitly includes Annex A, a catalog of controls that organizations can select and implement to address identified risks. This combination of an ISMS framework plus a defined set of controls in Annex A is what distinguishes ISO 27001. Other frameworks describe risk management or governance approaches and offer controls, but they don’t present themselves as an ISMS with Annex A controls. Therefore, ISO 27001 is the framework that fits this description.

ISO/IEC 27001 is built around an Information Security Management System (ISMS), a formal, ongoing approach to governing information security risks. The standard explicitly includes Annex A, a catalog of controls that organizations can select and implement to address identified risks. This combination of an ISMS framework plus a defined set of controls in Annex A is what distinguishes ISO 27001. Other frameworks describe risk management or governance approaches and offer controls, but they don’t present themselves as an ISMS with Annex A controls. Therefore, ISO 27001 is the framework that fits this description.