After deciding on risk treatment options, the organization selects specific controls from Annex A of ISO 27001. This annex provides a catalog of one hundred fourteen (114) control objectives & controls grouped