Policies, procedures, and guidelines that represent the ideal security state of the organization. This is the basis for all security work within the project portfolio and the roles and responsibilities