A national government passes a new data protection regulation that legally requires all companies to notify affected individuals within 72 hours of a data breach. The security manager at a mid-sized firm must ensure the organization can meet this obligation. Which governance document should the manager create or update FIRST to translate this legal requirement into a mandatory internal directive for the whole organization?