During a governance review, an IS auditor examines a document that states, 'All remote access must use multifactor authentication configured with a minimum of two distinct factor types.' The organization's leadership wants to understand where this document fits within its IT governance document hierarchy. How should the auditor most accurately classify this document?