Security and privacy of/on information systems are two entities that requires lawful regulations. Which of the following regulations defines security and privacy controls for Federal information syste

NIST SP 800-53 'Security and Privacy Controls for Information Systems and Organizations' is a publication by the National Institute of Standards and Technology that provides a comprehensive catalog of security and privacy controls specifically designed for federal information systems. It is mandated under FISMA for U.S. federal agencies and serves as the authoritative framework for assessing and selecting controls to manage risk. No other listed regulation fulfills this specific federal mandate.

PCI-DSS (Payment Card Industry Data Security Standard) governs the protection of cardholder data for organizations that process card payments, not federal information systems.

EU Safe Harbor was a framework governing the transfer of personal data between the European Union and the United States for commercial entities, not a federal systems security control standard.

HIPAA (Health Insurance Portability and Accountability Act) establishes privacy and security rules for protected health information in the healthcare industry, not for federal information systems broadly.