Which of the following are the rules by which an organization operates?

Acts are legislative or regulatory laws passed by governmental bodies - they are external legal requirements, not internal organizational operating rules.

In information security and governance, a policy is a formal set of rules and requirements established by an organization to govern behavior, operations, and decision-making. Policies are authoritative documents that all staff must follow and serve as the foundation for standards, procedures, and guidelines. They reflect management intent and organizational values.

Rules are specific, narrow directives derived from policies - they are subordinate to policies and do not represent the overarching framework by which the whole organization operates.

Manuals are reference documents that describe how to perform tasks or use systems - they are procedural in nature and subordinate to policies.