Security configuration standards are formally defined and required for all system types
Sekit's Configuration management policy, one of the topic-specific policies A.5.1 expects, sets security configuration standards for each system type, covering at minimum operating systems, cloud services and network devices.
Written security configuration standards for each system type, operating systems, cloud services, network devices, is the policy expression of A.8.9's requirement.