Official, documented rules about how a Merchant’s security systems and process/procedures are to operate, what tools should be used, how they should be used, what actions are NOT allowed, and so on.