...
When first starting out, or setting up an ISMS, the number of controls you need to implement may be overwhelming. It might be advisable to focus on the controls necessary to address the most important risks, or provide the greatest reduction in risk, and then come back to other controls at a later stage. It is not necessary to get things complete or perfect at the outset. This is what continual improvement is for.
Presentation / A framework for linking controls to risk
...