A standard requires multifactor authentication; a document explains the enrollment steps. What is the second document?

1. Risk appetite statement
2. Threat intelligence feed
3. Policy exception
4. Procedure