How often should the SSAE16 report of your vendors be reviewed?

Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
This global retail company is expected to accept credit card payments. Which of the following is of MOST concern when defining a security program for this organization?

Which of the following provides an audit framework?

As the CISO you need to write the IT security strategic plan. Which of the following is the MOST important to review before you start writing the plan?

Which of the following most commonly falls within the scope of an information security governance steering committee?