Which framework provides a comprehensive approach to managing information security within an organization?

Correct answer: ISO/IEC 27001

Option B is correct because ISO/IEC 27001 is an internationally recognized standard specifically designed to establish, implement, maintain, and continually improve an Information Security Management System (ISMS), providing a comprehensive and certifiable framework for managing information security risk across an organization. Option A is incorrect because COSO is a framework focused on enterprise risk management and internal financial controls, not information security management. Option C is incorrect because ITIL is a framework for IT service management best practices and does not specifically govern information security programs. Option D is incorrect because COBIT is primarily a governance and management framework for enterprise IT, covering a broader IT governance scope rather than being dedicated to information security.