A pharmacy that accepts Medicare/Medicaid and also takes credit cards should include which regulatory factors...

Scoping an assessment involves identifyingregulatory factorsthat apply to an organization’s operations. In this case, the entity is a pharmacy that acceptsMedicare/Medicaidand processescredit cards. Medicare/Medicaid participation introduces obligations underCMS Minimum Security Requirements (High), which adds federal requirements specific to healthcare entities working with Centers for Medicare and Medicaid Services. Credit card acceptance triggers applicability of thePayment Card Industry Data Security Standard (PCI-DSS), a widely recognized standard for protecting cardholder data. Additionally, pharmacies often fall under theFTC Red Flags Rule, which applies to organizations that maintain consumer accounts and must protect against identity theft. By contrast,FISMAapplies to federal agencies or contractors, not pharmacies, andFedRAMPapplies only to cloud service providers working with the federal government. Therefore, the correct set of regulatory factors isFTC Red Flags Rule, PCI-DSS, and CMS Minimum Security Requirements (High).