________ are mandatory.

• A. Standards
• B. Guidelines
• C. Both A and B
• D. Neither A nor B

Answer: (A)

Standards establish the formal, mandatory requirements that organizations must meet to ensure consistent security controls. Guidelines are advisory and recommended practices, not enforceable unless an organization chooses to adopt them as policy. Because mandatory compliance is associated with standards, the correct fill is standards. The idea that guidelines are mandatory or that both or neither are correct doesn’t fit typical governance and compliance distinctions, since guidelines remain optional unless specifically adopted.