The 2022 revision reduced the number of Annex A controls from 114 to 93 and reorganised them into four themes. For an SME, the practical implication is that a proportionate control set is genuinely defensible.
Focus areas that matter
Access control, backup, incident response and supplier security are the four areas that will always be examined closely. Get these right first and the rest of the system tends to follow.