Independent third-party auditors conducting data security audits must, at a minimum, hold one of the following qualifications:

(1) American Institute of Certified Public Accountants (AICPA);

(2) Certified Information Security Auditor (CISA/ISACA);

(3) ANSI-ASQ National Accreditation Board (ANAB); or

(4) Other nationally recognized information technology auditing certification.

(5) An internal audit organization that can attest it conforms with the international standards for the professional practice of internal auditing.