Although the latitude granted to business units varied, providing both policies and guidelines allowed business units to tailor the guidelines to their own individual unit's information protection needs.