In developing its cyber protection systems, XYZ Co$.($a company doing business exclusively in the United States$)$ leverages guidance from the COSO ERM and Internal Control frameworks. Which one of the following resources should XYZ reference to further ensure standards are kept up to date?

Guidance from the General Data Protection Regulations.

Guidance from the Personal Information Protection and Electronic Documents Act.

Guidance from the National Institute of Standards and Technology.

Guidance from the Federal Law on the Protection of Personal Data Possessed by Private Persons.