premise: Although the latitude granted to business units varied, providing both policies and guidelines allowed business units to tailor the guidelines to their own individual unit's information protection needs.
hypothesis: The government was the first to set out both the guidelines and the policies for the business units.