Where should you look first for assessment criteria and methodologies?

A company has asked you to develop a framework for assuring trust in the VDC. An assessment
methodology is to be part of the framework.
Where should you look first for assessment criteria and methodologies?

A.
Company mandate documents

B.
International standards bodies

C.
Internal IT department

D.
Industry best practices