A cloud security architect is procuring a hardware firewall appliance to protect the perimeter of a new private cloud data center. Corporate policy requires that any security product selected must have been independently evaluated for the trustworthiness of its security functions against a standardized, internationally recognized assurance framework, so the assurance rating can be compared across vendors from different countries. Which certification or standard should the architect require the vendor to provide?