What term is used to describe a benchmark used to make sure that a system provides a minimum level of security across multiple applications and across different products? configuration control functional policy baseline authorizing official (ao)?