Which term is the standard body widely cited for security guidelines in IT?

Which term is the standard body widely cited for security guidelines in IT?

• A. Nist
• B. Accounting
• C. Generic Accounts
• D. Mandatory Vacations

Answer: (A)

In IT security, established standard bodies publish the guidelines that many organizations base their programs on. NIST, the National Institute of Standards and Technology, is the widely cited authority in this area. Its published materials, especially the SP 800-series and the Cybersecurity Framework, provide concrete security controls and practical guidance that government agencies and private companies use to design, implement, and assess security programs. These guidelines are freely available, frequently updated, and align with risk-management practices, which is why NIST is the go-to reference for security guidelines. The other options don’t fit because they aren’t standard-setting bodies for security guidelines. Accounting deals with financial records, generic accounts refer to a type of user account, and mandatory vacations are a control practice used to detect fraud, not organizations that publish security standards.

In IT security, established standard bodies publish the guidelines that many organizations base their programs on. NIST, the National Institute of Standards and Technology, is the widely cited authority in this area. Its published materials, especially the SP 800-series and the Cybersecurity Framework, provide concrete security controls and practical guidance that government agencies and private companies use to design, implement, and assess security programs. These guidelines are freely available, frequently updated, and align with risk-management practices, which is why NIST is the go-to reference for security guidelines.

The other options don’t fit because they aren’t standard-setting bodies for security guidelines. Accounting deals with financial records, generic accounts refer to a type of user account, and mandatory vacations are a control practice used to detect fraud, not organizations that publish security standards.