The organization defines security configuration checklists to be used to establish and document configuration settings for the information system technology products employed.