Which standard provides guiding principles for the governance of IT, emphasizing board and senior management accountability for IT?

• A. ISO/IEC 38500
• B. COBIT 2019
• C. ISO 27001
• D. PCI DSS

Answer: (A)

Guiding IT governance with clear accountability for the board and senior management is the focus here. ISO/IEC 38500 provides those guiding principles, outlining how a governing body should direct, monitor, and control IT to ensure it delivers value, manages risk, and uses resources responsibly. It emphasizes responsibilities at the top levels—setting direction, ensuring alignment with strategy, and overseeing performance and conformance—so governance is anchored in leadership.

COBIT 2019 is a comprehensive framework with detailed governance and management processes, but its emphasis is on the practical implementation of IT governance across the organization rather than the board’s guiding principles themselves. ISO 27001 targets information security management systems and how to protect information assets, not the overarching governance structure. PCI DSS focuses on securing payment card data, a specific security standard rather than governance at the board level.

So the best fit for emphasizing board and senior management accountability in IT governance is ISO/IEC 38500.