Technical controls fill the security gaps that fall on the company's side of the cloud shared responsibility boundary
The technical facet enables the customer-side of the cloud boundary to be defended in practice, with tenant hardening, backup, and logging that no provider certificate replaces.
Deploying tenant hardening, backup, logging and secure configuration for everything on the company's side of the cloud boundary applies A.8.9's discipline to shared-responsibility gaps specifically.