The SoA has 93 Annex A controls and I’ve stalled staring at it. Do we really have to implement all 93? How do people get through this without losing weeks?
You do not have to implement all 93. The SoA’s job is to record, for each control, whether it applies to you and why: “applicable and implemented”, “applicable and planned”, or “not applicable because…”. A justified “not applicable” is a perfectly good answer an auditor will accept.
The trick is to drive it from your risk assessment, not the other way round. Work through your risks, and each one points at the controls that treat it. Those are your applicable controls. The rest you justify out with a short reason. That turns a wall of 93 into the controls that treat your actual risks, plus a set of one-line justifications for the rest.
Don’t over-engineer the applicable ones either. The control has to be proportionate to the risk, not gold-plated.