The international standard for implementing an Information Security Management System (ISMS), ISO/IEC 27001, is explicitly based on the Plan-Do-Check-Act (PDCA) process model. This model provides a framework for continuous improvement. The organization must: Plan (establish the ISMS), Do (implement and operate the ISMS), Check (monitor and review the ISMS), and Act (maintain and continually improve the ISMS). This iterative cycle is fundamental to managing information security risks effectively in a changing environment.

A. SMART (Specific, Measurable, Achievable, Relevant, Time-bound) is a mnemonic for defining objectives, not a process model for a management system.

B. PCI-DSS is a specific security standard for the payment card industry, not a universal process model for implementing an ISMS.

C. ROI (Return on Investment) is a financial metric used to evaluate the profitability of an investment, not a management system process model.

1. International Organization for Standardization. (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Section 4.4, "Information security management system," and the introduction (Clause 0.4) explicitly state the ISMS adopts the PDCA model.

2. Calder, A., & Watkins, S. G. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002. Kogan Page Publishers. Chapter 10 details the application of the PDCA cycle to the ISO 27001 implementation process.