What are the three types of compliance that the Open Source Security Testing Methodology Manual (OSSTMM) recognizes?

"Performance" is not a compliance category recognized by OSSTMM; performance relates to operational metrics rather than a compliance obligation type.

"Audit" is a process used to verify compliance, not a type of compliance itself within the OSSTMM framework.

"Industry" is not a distinct OSSTMM compliance category; industry-specific requirements would fall under either legislative or standards-based compliance depending on their source.

According to the OSSTMM framework, legislative compliance refers to laws and government regulations that must be followed, contractual compliance refers to obligations defined in agreements between parties, and standards-based compliance refers to adherence to published technical or procedural standards. These three categories collectively define the full scope of external compliance requirements an organization faces.