Risk register versus Statement of Applicability - number of controls

Our experience shows us that companies typically have ca 80 controls implemented before the start of an ISO 27001 project, and then they have ca 20 to 30 controls to implement during the project.

 Once you go through the Statement of Applicability to start determining whether particular controls are applicable, you will take into account not only the risks, but also legal and customer requirements, as well as common sense - e.g. if backup control was not selected, you will most likely mark it as applicable.

This article will provide you a further explanation about SoA:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/