The company formally identifies and manages its external attack surface to reduce the risk of exploitation
Sekit's Exposure management policy, one of A.5.1's topic-specific policies, states that the company maintains a view of everything it exposes to the internet and trims what has no business need.
This policy facet commits to maintaining a view of everything exposed to the internet and reducing exposure without business need, the exposure-management leg of A.8.8.