Which of the following is MOST likely to be discretionary?

Policies and standards are mandatory controls, whereas guidelines are advisory statements “intended to provide assistance… but are not compulsory.” Thus guidelines are the element most likely to be discretionary.

A: Policies are high-level mandatory directives. B: Procedures give step-by-step mandatory instructions. D: Standards specify compulsory minimum requirements or benchmarks.

• NIST SP 800-12 Rev. 1, An Introduction to Information Security, §3.1.3, p. 26: “Guidelines are recommended, not mandatory.”

• MIT OCW 6.805/6.806 “Foundations of Information Policy,” Lecture Notes 7, slide 14: distinguishes mandatory policies/standards from discretionary guidelines.