The organization is implementing an information security management system (ISMS).

The ISMS framework (aligned with ISO 27001) follows thePDCA cycle:

P – Plan

D – Do

C – Check

A – Act

This model ensures:

Continuous improvement

Systematic risk management

Documented policies and controls

Regular audits and corrective actions

Why other options are incorrect:

A – SMART: For objective setting, not ISMS.

B – PCI-DSS: A security compliance standard, not a process model.

C – ROI: A financial metric, unrelated.

Thus,Dis correct.

EPI DCFOM-Aligned Reference Concepts (Paraphrased)

ISMS implementation is based on PDCA methodology.

Ensures continuous improvement of security controls.