In designing the campus of an IoT device manufacturer, a security consultant was hired to recommend best practices for deterring criminal behavior. Which of the following approaches would he have used to meet his client's needs?

Crime Prevention Through Environmental Design (CPTED) is a multi-disciplinary approach that uses urban and architectural design to deter criminal behavior. Its core principles—natural surveillance, natural access control, territorial reinforcement, and maintenance—are specifically aimed at manipulating the built environment to reduce the opportunity for crime. This methodology directly addresses the consultant's task of designing a physical campus to deter criminal activity, making it the most appropriate approach among the choices. The other options are frameworks focused on information and cybersecurity, not physical environmental security design.

B. British Standard 7799 part 3 (BS 7799-3): This is an outdated standard focused on guidelines for information security risk management, not the physical design of a campus to deter general crime.
C. International Organization for Standardization 17799 (ISO 17799): This standard, now ISO/IEC 27002, provides a code of practice for information security controls, not a methodology for general crime prevention through environmental design.
D. National Institute of Standards and Technology Cybersecurity Framework (NIST CSF): This is a voluntary framework consisting of standards, guidelines, and best practices to manage cybersecurity-related risk, not physical security design for a campus. ---

1. CPTED: Crowe, T. D. (2000). Crime Prevention Through Environmental Design: Applications of Architectural Design and Space Management Concepts (2nd ed.). National Crime Prevention Institute. As cited in Cozens, P. M., & Love, T. (2015). A Review and Current Status of Crime Prevention through Environmental Design (CPTED). Journal of Planning Literature, 30(4), 393–412. (See Section: "The CPTED Concept", pp. 394-395). https://doi.org/10.1177/0885412215595440

2. NIST CSF: National Institute of Standards and Technology. (2018). Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1. U.S. Department of Commerce. (See Section 1.1, "Framework Purpose," p. 1, which states its focus is on reducing cybersecurity risk). https://doi.org/10.6028/NIST.CSWP.04162018

3. ISO 17799 / ISO/IEC 27002: International Organization for Standardization. (2022). ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls. The scope is defined as providing a reference set of generic information security controls. (See Introduction, Section 0.1 "General").

4. BS 7799-3: The British Standards Institution. (2006). BS 7799-3:2006 Information security management systems. Guidelines for information security risk management. This standard's scope was explicitly limited to information security risk management and served as a basis for the later ISO/IEC 27005 standard.