Scenario: an Organization Has Made a Decision to Address Information

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years. The organization has already been subject to a significant amount of credit card fraud. Which of the following is the MOST likely reason for this fraud?

A) Lack of compliance to the Payment Card Industry (PCI) standards
B) Ineffective security awareness program
C) Lack of technical controls when dealing with credit card data
D) Security practices not in alignment with ISO 27000 frameworks