A SOC lead is tasked with building a hardening standard for the organization's general-purpose Linux and Windows servers. Management wants the standard to be based on a recognized, authoritative U.S. federal source that provides broad guidance on securing server operating systems, including installation, configuration, and maintenance practices, rather than a single vendor's product manual. Which resource should the SOC lead reference to develop this general server hardening guidance?