The CSCs are not mandatory, but they are considered best practices for securing digital assets. Organizations that implement the CSCs are likely to be better protected against cyber threats and may be better equipped to comply with industry-specific regulations and standards.