Basically they're talking about drafting "enforceable codes of conduct", which smells a lot like what PCI Compliance is for credit card numbers. Anybody who's dealt with that can tell you is a clear set of easily-implementable rules that in no way requires you to spend gobs of money on consultants. </sarcasm>