An information security officer at a credit card transaction company is conducting a framework-mapping
exercise with the internal controls. The company recently established a new office in Europe. To which of the
following frameworks should the security officer map the existing controls? (Choose two.)


A. ISO
B. PCIDSS
C. SOC
D. GDPR
E. CSA
F. NIST