The document that says how you implement each control. Auditors test against this, keep it honest, keep it current.