Documentation that formally defines the security functions of a system or product against which its evaluation is performed. Note: A System Electronic Information Security Policy forms the basis of the evaluation baseline for a system.