The Chief Information Security Officer $($CIO$)$ at a large company would like to gain an understanding of how the company's security policies compare to the requirements imposed by external regulators. Which of the following should the CISO use?