Customers are required to enforce all mandatory controls. However, advisory controls help organizations reduce the attack surface and vulnerabilities, catching anomalous actions in systems alongside planning for incident response & information sharing. After completing risk assessments, these controls should get ideally selected.