"To work in the network systems development and support area, employees must hold at least one industry-recognized network security credential." Would this be considered a policy or a guideline?