Although the latitude granted to business units varied , providing both policies and guidelines allowed business units to tailor the guidelines to their own individual unit 's information protection needs .
The government was the first to set out both the guidelines and the policies for the business units .