A recent audit found that an organization's new user accounts are not set up uniformly. Which of the following is MOST important for the information security manager to review?

Security policies are high-level statements of intent and objectives, providing the "what" and "why," but typically lack the specific, mandatory instructions for uniform setup.

Automated controls are implementations of policies and standards, but reviewing the controls themselves without understanding the underlying documentation might not fix the root cause of non-uniformity.

Guidelines offer recommendations and best practices, which are helpful but not mandatory and thus do not enforce uniformity as effectively as standards.

Standards specify mandatory, repeatable actions and configurations that ensure consistency, like a uniform user account setup, making them the most critical document to review when non-uniformity is discovered. Adherence to established standards ensures that all new accounts meet a defined baseline of security and configuration.