Every control, in full
The official minimum requirement of each control, broken into the individual statements an assessor would check one by one.
What to do, and when
Work is ranked by how much it unblocks, how early its phase falls, how much of it is still open, and how little it costs to start.
Work you have already done
Section 1 of the Annex aligns the baseline with CIS Controls v8.1 IG1 and the NIST Cybersecurity Framework. The ISO 27001 column is added here as a convenience for entities already certified.