What do SOC 2 or ISO 27001 represent in IT security?

• A. Programming language standards
• B. Billing and accounting standards
• C. Graphic design standards
• D. Standards for managing information security and trust service criteria (SOC 2) or ISMS requirements (ISO 27001)

Answer: (D)

These are established frameworks for handling information security and proving trust in how data is managed. SOC 2 is a framework developed by the AICPA that service organizations use to show they have effective controls related to trust services criteria—security, availability, processing integrity, confidentiality, and privacy. It typically results in a detailed report that customers can review to assess the organization’s controls over time. ISO 27001 is an international standard that specifies the requirements for an Information Security Management System (ISMS), guiding an organization to assess risks, implement appropriate controls, monitor performance, and continually improve its security posture. Together, they represent standards for managing information security and providing assurance to stakeholders that data is protected. The other options describe areas like programming languages, billing standards, or graphic design standards, which are unrelated to IT security governance.