________ are prescriptive statements about what companies should do and are put together by trade associations and government agencies.

• A. Best practices
• B. Recommended practices
• C. Both A and B
• D. Neither A nor B

Answer: (B)

The concept is about formal guidance that tells organizations what they should do. The correct term is “recommended practices.” These are specific actions or steps proposed by trade associations and government agencies to standardize and guide security and compliance efforts. They’re prescriptive in nature, outlining what to implement, but they’re guidance rather than mandatory laws, so organizations adopt them to demonstrate due care or align with industry norms.

Best practices, while similar and often widely accepted, are typically developed by industry groups as aspirational benchmarks rather than official guidance issued by authorities. The idea that both would be prescriptive and produced by those bodies isn’t accurate in this context, and choosing neither isn’t correct because there is a recognized category that fits the description.