Both answers above are bang on the money, but I'd just like to add the following caveat. I run a regulatory services company and I got us certified to ISO 27001. The one thing I would communicate to anybody thinking of becoming certified is to remember that being certified to a standard is not like acquiring a magic talisman that wards off all evil (and lawsuits). Because these standards are not compulsory and the certification is voluntary, your protection in court against legal redress always boils down to due diligence.
In other words, if a magistrate thinks that you've given confidential information undue exposure then you are going to be screwed, regardless of whether you have ISO 27001 or not. However the point of certification, and this is really important to remember, is that to get it you must be totally methodological and careful and list all of your liabilities, and assess them, and address these with remedial actions. This means that at the end of the certification process your company is going to be a lot more vigilant and 'hardened' to borrow a sysadmin term.
I'm biased towards ISO 27001 as opposed to SOX etc. because it's generally accepted that the ISO covers the requirements for practically all the other standards. PCI has a few quirks, such as separation of processing facilities and other standards may be prescriptive about particular things, but you can still impliment these within an ISO framework, and you'll probably do a better job of it at the same time.
One final point that has also been mentioned tangentally already, is that a good risk-assessment based system will save you money. Before I started doing it, I wanted the most expensive firewall, the smartest card reader, the perfect multi-site failover and would sweat over specifications. But when you've done a proper risk assessment, you start to realise that actually you are never going to totally remove risk, so by the law of diminishing returns you are better off spending your money wisely than aiming for the ultimate protection. At the end of the day, one you're biggest vulnerabilities is your employees. So save your company money and organise some staff training sessions.