...
Most organisations will chose Annex A as their normal set of controls, with additional controls chosen for particular business requirements.
Prioritisation/Triage
When first starting out, or setting up an ISMS, the number of controls you need to implement may be overwhelming. It might be advisable to focus on the controls necessary to address the most important risks, and then come back to other controls at a later stage.
Presentation / A framework for linking controls to risk
...