BotanéBloom transitioned to a digital-first business model.

The Payment Card Industry Data Security Standard (PCI DSS) is the globally recognized framework specifically designed to protect cardholder data and ensure secure handling of credit card transactions. The scenario explicitly mentions requirements such as encrypting cardholder data, limiting access to cardholder information, and maintaining a secure network — these are hallmark requirements of PCI DSS (Requirements 3, 7, and 1 respectively). GDPR is a data protection regulation covering personal data broadly, not specifically payment card data. ISO/IEC 27701 is a privacy information management extension for ISO/IEC 27001. Only PCI DSS mandates specific technical and operational controls for organizations that store, process, or transmit cardholder data, making it the correct framework for BotanéBloom ' s online payment security compliance program.

================