An information security manager is rolling out a new server hardening initiative across the enterprise. Each business unit currently deploys servers using its own configuration, resulting in inconsistent security settings. To ensure consistent, measurable security across all systems while allowing verification of compliance, what should the security manager establish FIRST?