A security manager wants to establish clear expectations for how employees may use company laptops and email, so that if misuse occurs, the organization can point to a written expectation that guided user behavior. Which type of security control BEST describes publishing an acceptable use policy for this purpose?