A set of rules or guidelines governing IT operations, security, and compliance.