A security engineer has been tasked with hardening a fleet of newly deployed Ubuntu Linux servers before they enter production. Management wants the configuration baselines to follow an industry-recognized, consensus-developed standard that provides specific, prescriptive configuration settings and is freely available for reference. Which resource should the engineer use to obtain these prescriptive hardening guidelines?