200-201 Security Policies and Procedures Practice Question
A multinational manufacturer handles personal data of employees in several countries and wants to ensure its security program aligns with recognized international standards for establishing, implementing, maintaining, and continually improving an information security management system. Which framework should the security team adopt as the primary basis for this program?
⚠ Common exam trap
The trap here is selecting a widely known security framework based on familiarity, without checking whether it defines a certifiable management system, which is the specific requirement described.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ISO/IEC 27001
ISO/IEC 27001 is the internationally recognized standard that specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system. That scope matches the manufacturer's goal of a globally aligned, certifiable security program. The NIST Cybersecurity Framework, CIS Controls, and PCI DSS serve different purposes: voluntary taxonomy, technical safeguards, and payment card requirements, respectively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CIS Critical Security Controls
Why it's wrong here
The CIS Critical Security Controls are prioritized, prescriptive safeguards aimed at defending against common attacks. They are excellent for technical hardening and prioritization but are not a management-system standard and do not define an ISMS with certification requirements. Adopting them alone would not satisfy the scenario's need for an internationally recognized management-system framework.
- ✓
ISO/IEC 27001
Why this is correct
ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system, which is exactly what the scenario describes. It is internationally recognized and applicable across jurisdictions, making it suitable for a multinational manufacturer. The standard's management-system approach also supports certification, which provides external validation of the program.
- ✗
PCI DSS
Why it's wrong here
PCI DSS applies specifically to organizations that store, process, or transmit cardholder data, and it focuses on payment card security rather than a general information security management system. The manufacturer's need concerns employee personal data across countries, not card data, so PCI DSS is out of scope. It also lacks the ISMS continual-improvement structure the scenario requires.
- ✗
NIST Cybersecurity Framework
Why it's wrong here
The NIST Cybersecurity Framework provides a voluntary, outcome-based taxonomy organized around identify, protect, detect, respond, and recover functions. While useful for structuring a program, it does not specify requirements for a certifiable management system with continual improvement clauses. The scenario asks for a standard for establishing and maintaining an ISMS, which is the specific scope of ISO/IEC 27001.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.