Why it matters
Undocumented, drifted configuration is where a lot of real-world outages and security gaps quietly originate.
How a self-led small team implements it
Infrastructure-as-code (even basic Terraform/config scripts) is strong evidence here if you already use it.
What auditors expect to see
Configuration baselines, infrastructure-as-code repository.
Track A.8.9 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS