Which of the following is NOT listed as a source of industry-accepted system hardening standards?

• A. Center for Internet Security (CIS)
• B. International Organization for Standardization (ISO)
• C. SysAdmin, Audit, Network, Security (SANS) Institute
• D. National Aeronautics and Space Administration (NASA)

Answer: (D)

Grasping where security baselines come from helps you see what practitioners rely on to harden systems consistently. The widely recognized sources for industry-accepted system hardening standards include the Center for Internet Security, which publishes detailed benchmarks for configuring operating systems and applications; ISO, which provides broad security management standards like ISO/IEC 27001; and the SANS Institute, known for its Critical Security Controls and practical hardening guidance. These bodies are commonly cited across many industries as reputable, actionable benchmarks.

NASA, while a credible source with valuable guidelines for its own programs, is not generally cited as a universal source of industry-accepted system hardening standards used across diverse organizations. That’s why it’s the one that doesn’t fit with the others.