Name common compliance frameworks relevant to IT security.

Name common compliance frameworks relevant to IT security.

• A. HIPAA, PCI DSS.
• B. ISO 27001/27002, PCI DSS, GDPR, HIPAA, SOC 2, NIST CSF.
• C. GDPR, HIPAA.
• D. COBIT and ITIL.

Answer: (C)

Compliance in IT security is about following rules that tell you how to protect data and manage risk. GDPR and HIPAA are two of the most widely referenced regulatory requirements that shape security practices across many organizations. GDPR governs the protection of personal data of individuals in the European Union, while HIPAA governs the handling of protected health information in the United States. These regulations drive concrete security obligations such as access controls, data minimization, encryption, breach notification, and ongoing risk assessment, making them foundational references for organizations aiming to align with broad, legally enforceable data-protection expectations. Other items on the list are important—some are detailed standards (like ISO 27001 and PCI DSS), some are governance or service-management frameworks (like COBIT or ITIL), and some are sector-specific or framework-based (like SOC 2 or NIST CSF). While valuable, they don’t represent the same widely applicable regulatory pull as GDPR and HIPAA, which is why they’re the most commonly cited compliance references in broad IT security discussions.

Compliance in IT security is about following rules that tell you how to protect data and manage risk. GDPR and HIPAA are two of the most widely referenced regulatory requirements that shape security practices across many organizations. GDPR governs the protection of personal data of individuals in the European Union, while HIPAA governs the handling of protected health information in the United States. These regulations drive concrete security obligations such as access controls, data minimization, encryption, breach notification, and ongoing risk assessment, making them foundational references for organizations aiming to align with broad, legally enforceable data-protection expectations. Other items on the list are important—some are detailed standards (like ISO 27001 and PCI DSS), some are governance or service-management frameworks (like COBIT or ITIL), and some are sector-specific or framework-based (like SOC 2 or NIST CSF). While valuable, they don’t represent the same widely applicable regulatory pull as GDPR and HIPAA, which is why they’re the most commonly cited compliance references in broad IT security discussions.