Bill has been hired as a penetration tester and cyber security auditor for a major credit card company. Which information security standard is most applicable to his role?

FISMA (Federal Information Security Modernization Act) applies to US federal government agencies and their contractors, not a private credit card company.

The Sarbanes-Oxley Act (SOX) primarily focuses on financial reporting and corporate governance to prevent fraud for publicly traded companies, rather than being a specific information security standard for cardholder data.

HITECH (Health Information Technology for Economic and Clinical Health Act) is specific to the protection of Protected Health Information (PHI) in healthcare organizations, which is not applicable to a credit card company.

The Payment Card Industry Data Security Standard (PCI-DSS) is the definitive information security standard specifically designed to protect cardholder data for organizations that process, store, or transmit credit card information. For a major credit card company, adherence to PCI-DSS is mandatory, and penetration testing is a required control to ensure the security of cardholder data environments.