Bill has been hired as a penetration tester and cyber security auditor for a major credit card company. Which information security standard is most applicable to his role?

FISMA (Federal Information Security Management Act) applies to U.S. federal government agencies and their contractors, not to private-sector credit card companies.

HITECH governs the security and privacy of electronic protected health information in the healthcare sector, not payment card data.

PCI-DSS (Payment Card Industry Data Security Standard) was established by the major card brands and explicitly requires regular penetration testing and security audits for any entity that processes, stores, or transmits cardholder data. As an auditor and penetration tester at a credit card company, Bill's entire engagement scope is defined and mandated by PCI-DSS requirements. No other listed standard specifically addresses payment card security obligations.

The Sarbanes-Oxley Act mandates financial reporting controls and corporate governance for publicly traded companies but does not specifically address payment card data security or penetration testing requirements.