A Chief Information Security Officer (CISO) needs to create a policy set that meets international standards for data privacy and sharing. Which of the following should the CISO read and understand…

PCI DSS is a payment card industry security standard scoped specifically to organizations that handle cardholder data, not a broad international data privacy regulation.

The General Data Protection Regulation is an EU law that establishes the international standard for how personal data must be collected, stored, processed, and transferred across borders. Any organization handling the personal data of EU residents or operating internationally must align its data policies with GDPR principles such as lawful basis, data minimization, and data subject rights. A CISO writing policies intended to meet international standards must understand GDPR as the governing framework.

NIST publishes cybersecurity frameworks and guidelines primarily for US government and voluntary private sector use and does not constitute an international data privacy law.

ISO 31000 is an international risk management framework standard that addresses organizational risk processes broadly and does not govern data privacy or data sharing specifically.