A voluntary code is a non-binding set of security standards or best practices that organizations can choose to follow. Unlike a law or regulation, it generally does not create legal duties by itself, though contracts or other rules may make particular requirements enforceable.
In cybersecurity, voluntary codes can guide software vendors on practices such as secure development, vulnerability handling, and timely updates. They give organizations a shared baseline and can help buyers assess suppliers, but adoption and enforcement may vary. Policymakers may consider whether voluntary guidance is sufficient or whether stronger legal requirements are needed to change security incentives.