What are the three types of compliance that the Open Source Security Testing Methodology Manual (OSSTMM) recognizes?

Performance and audit are not recognized compliance categories in the OSSTMM framework - performance is a quality metric and audit is a process, not a compliance type.

While regulatory is a related concept, OSSTMM specifically uses 'legislative' rather than 'regulatory,' and this option omits contractual compliance entirely.

Contractual and regulatory appear in this option, but OSSTMM does not use 'industry' as a compliance category - it uses 'standards based' as the specific third type.

According to the OSSTMM, the three recognized compliance categories are legislative (laws and government mandates), contractual (obligations agreed upon between parties), and standards based (adherence to published industry or technical standards). These three categories encompass all external requirements an organization may face during security testing.