A new information security manager is organizing the company's governance documents. She finds a document that states: 'All employee passwords must be at least 14 characters long, contain three character types, and expire every 90 days.' Which type of governance document is this?