________ are discretionary.

• A. Standards
• B. Guidelines
• C. Both A and B
• D. Neither A nor B

Answer: (B)

Guidelines are discretionary because they are advisory recommendations rather than mandatory requirements. In policy frameworks, standards specify mandatory controls that must be implemented, while guidelines provide flexible guidance that can be adapted or even set aside after considering risk, cost, and context. For example, a standard might require encryption for data at rest across the organization, while a guideline might suggest evaluating encryption options and using strong algorithms where appropriate. Because of their advisory nature, guidelines can be customized to fit the situation, making them discretionary. Therefore, the statement points to guidelines, not standards. Standards are mandatory, so they are not discretionary.