Which regulatory standards are commonly referenced in Annex B and what is their role?

• A. GDPR, HIPAA; they set data privacy fines.
• B. NIST, ISO, FISMA; they provide security controls, risk management frameworks, and compliance requirements used for audits and certification.
• C. PCI DSS; it governs payment card processing.
• D. COBIT; it focuses on IT governance.

Answer: (B)

The main idea is that Annex B typically references widely used security standards and frameworks that define concrete controls and a risk-based approach, which auditors use for assessing and certifying an organization’s security posture. NIST, ISO, and FISMA fit this role because they provide structured control catalogs, formal risk management processes, and clear compliance requirements that are commonly used in audits and certification programs. For example, NIST offers detailed control families, ISO/IEC 27001/27002 provides an information security management system with its control objectives, and FISMA sets federal baselines and assessment requirements. Together, these standards give organizations a practical path to implement security measures and demonstrate compliance to auditors.

Other options touch on related areas but aren’t the core reference set for this purpose: PCI DSS focuses specifically on payment card data, COBIT centers on IT governance, and privacy-focused regulations like GDPR or HIPAA address data privacy protections rather than the general security control and certification frameworks that Annex B emphasizes.