A medium-sized company has recently launched an online product catalog. It has decided to keep
the credit card purchasing in-house as a secondary potential income stream has been identified in
relation to sales leads. The company has decided to undertake a PCI assessment in order to
determine the amount of effort required to meet the business objectives. Which compliance
category would this task be part of?

A.
Government regulation

B.
Industry standard

C.
Company guideline

D.
Company policy