I work with a small company and we've just completed RR. This took us to the SoA. I can see 54 controls to address. My gut feeling is that this is not enough to achieve the certification. What are your thoughts/experiences here, please?
Our experience shows us that companies typically have ca 80 controls implemented before the start of an ISO 27001 project, and then they have ca 20 to 30 controls to implement during the project.
Once you go through the Statement of Applicability to start determining whether particular controls are applicable, you will take into account not only the risks, but also legal and customer requirements, as well as common sense - e.g. if backup control was not selected, you will most likely mark it as applicable.