Raul works for a small consulting firm that assists medical organizations, such as quick care facilities, and health professionals, such as doctors' offices or alternative care providers, to establish, update, and manage their IT systems. He regularly works with patient databases and must ensure that his clients' networks and other IT resources comply with strict government regulations. Raul's boss, Cheri, recently asked him to assist in upgrading their firm's data center. The CEO has decided they need to take a major step towards a more cloud$-$centric business model and asked Raul how the company can ensure that their cloud provider meets industry standard requirements for data security, service availability, and confidentiality.

Which standard should Raul recommend they use to compare security ratings of various CSPs$?$