An audit against the __________ will demonstrate that an organization has a holistic, comprehensive security program. Response:

SAS 70 was an auditing standard focused on internal controls at service organizations, primarily for financial reporting, and has been superseded.

SSAE 16 superseded SAS 70 and is primarily focused on financial reporting controls at service organizations, not a holistic security program.

A SOC 2, Type 2 report evaluates a service organization's controls related to security, availability, processing integrity, confidentiality, or privacy over a period, but it is a report on controls, not a certification for a holistic security program itself.

ISO 27001 is an internationally recognized standard for information security management systems (ISMS), requiring an organization to implement a comprehensive framework for managing information security risks. Achieving ISO 27001 certification validates that an organization has established, implemented, maintained, and continually improved a documented ISMS across all relevant areas.