What type of compliancy standard, regulation or legislation provides a code of practice for information security?

ISO/IEC 27002 is an international standard that provides a code of practice for information security. It offers a comprehensive set of guidelines and best practices for initiating, implementing, maintaining, and improving information security management in an organization. It is designed to be used in conjunction with ISO/IEC 27001, which specifies the requirements for an Information Security Management System (ISMS). The previous version, ISO/IEC 27002:2013, was explicitly titled "Code of practice for information security controls," clearly defining its purpose as a set of recommended practices rather than a auditable set of requirements.

B. A personal data protection act is legislation focused on the privacy and rights of individuals concerning their data, not a general information security code of practice.

C. A computer criminality act is a legal framework that defines cybercrimes and associated penalties, not a set of organizational best practices for security.

D. IT Service Management (e.g., ITIL) is a discipline for managing IT services to meet business needs, which is distinct from a specific code of practice for information security.

1. International Organization for Standardization (ISO). (2022). ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls. Geneva, Switzerland: ISO.

Reference: The introduction and scope sections of the standard describe it as a reference set of generic information security controls and implementation guidance. The historical title of the standard (ISO/IEC 27002:2013) was "Code of practice for information security controls," which directly answers the question.

2. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page.

Reference: Chapter 10, "ISO 27001 and ISO 27002," explicitly states, "ISO 27002 is a code of practice – a generic, advisory document, not a formal specification against which organizations can be certified" (p. 135).

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Reference: Chapter 2, "The ISO 27001 family of standards," describes ISO/IEC 27002 as the "code of practice for information security controls, providing guidance on the implementation of the controls listed in Annex A" (p. 12).

4. University of Alabama in Huntsville. (n.d.). UAH Information Security Management Program (ISMP) based on ISO 27002.

Reference: The program documentation states, "The University of Alabama in Huntsville (UAH) Information Security Management Program (ISMP) is based on the International Organization for Standardization (ISO) 27002, a code of practice for information security." This demonstrates its use as a foundational code of practice in an academic institutional setting.