A new CISO discovers that engineers configure firewalls inconsistently, each interpreting the high-level acceptable-use policy differently. The CISO wants to publish a document that specifies the exact, step-by-step commands and settings staff must follow to harden the firewalls, leaving no room for interpretation. Which type of governance document should the CISO create to meet this need?