In an organization using PCI-DSS as its as its control framework, the conclusion of a recent risk assessment stipulates that additional controls not present in PCI-DSS but present in ISO 27001 should be enacted. What is the best course of action in this situation?
A. Adopt ISO 27001 as the new control framework
B. Retain PCI-DSS as the control framework and update process documentation
C. Add the required controls to the existing control framework
D. Adopt NIST 800-53 as the new control framework