User
What do we do with the controls that we don't yet know how to implement but think are important? Only mention a policy that we will write, or a task that we need to re-work an existing policy?
Experta
It is probably a better approach to mention a policy that you might write, especially if it is recommended by default. If it turns out that you don't need a policy, then later on simply update the SoA with the task or text description instead of the policy.