Which of the following is NOT one of the official risk rating categories?

The goals of DLP solution implementation include all of the following, except:

All policies within the organization should include a section that includes all of the following, except:

Countermeasures for protecting cloud operations against internal threats include all of the following except:

With the rapid emergence of cloud computing, very few regulations were in place that pertained to it specifically, and organizations often had to resort to using a collection of regulations that were not specific to cloud in order to drive audits and policies.
Which standard from the ISO/IEC was designed specifically for cloud computing?