A multinational manufacturing company that also runs an e-commerce site is preparing for a formal certification that demonstrates it has a systematic, auditable Information Security Management System (ISMS) covering risk assessment, controls, and continual improvement across all business units. The board wants a globally recognized standard that is not tied to any single industry vertical. Which standard best fits this requirement?