Which policy element is mandatory?

• A. Standards
• B. Guidelines
• C. Both A and B
• D. Neither

Answer: (A)

Standards are the enforceable rules in policy documents. They define the exact controls, configurations, or behaviors that must be followed and are subject to audit or compliance checks. Guidelines are recommended practices that help achieve security goals but aren’t mandatory unless an organization elevates them into a formal standard. That’s why standards are the mandatory element. For example, requiring multi-factor authentication for all remote access is a standard, while recommending MFA as a best practice is a guideline.