Approved security configuration standards are formally defined for all device types used by the company
Sekit's Configuration baselines policy is part of A.5.1's topic-specific policy layer: it sets a management-approved configuration standard for every device type, reviewed at least once a year.
A written, management-approved configuration standard for every device type, reviewed at least annually, is the written-baseline leg A.8.9's requirement is built around.