A security manager is organizing the company's governance documentation. One document states: 'All company laptops must use AES-256 full-disk encryption.' The manager wants to file this document under the correct governance category. Which type of document does this statement represent?