A security manager is deciding which regulatory frameworks the security program must formally address. The company processes EU citizens' data, accepts credit card payments, and operates in the US healthcare sector. Which combination of frameworks is directly applicable?

• AGDPR (EU personal data), PCI DSS (payment card data), and HIPAA (US healthcare data), each governing a distinct data category the company actually handles
• BOnly ISO 27001, since it is the single global standard covering every regulation
• CNone of these apply since the company is not headquartered in the EU
• DOnly SOC 2, since it is required for all US companies by default