Which policy element is discretionary?

• A. Standards
• B. Guidelines
• C. Both A and B
• D. Neither

Answer: (B)

Discretion in policy elements comes from whether compliance is required or left to judgment. In security policy frameworks, standards establish mandatory requirements that must be followed, while guidelines are recommended practices that teams can choose to implement or adapt based on context, resources, and risk. This makes guidelines the discretionary element: they guide behavior without enforcing it. A standard might require MFA for remote access, which is a non-discretionary mandate; guidelines would suggest MFA as a best practice but not require it in every situation. Therefore, the discretionary element is guidelines.