Documented procedures and rules to protect the confidentiality, integrity, and availability of data and resources.