which of the following documents an organization’s rules for using a vpn?