Im struggling to understand in which order I should implement the ISO 27002 controls. I was thinking about using the CIS Top 20 to help but what is the best route?
This really doesn't have a straight forward answer, as it depends on your organization. It's important to remember that 27002 is simply a guideline for IS. It does not have a certification, nor do you have to meet each control. It is just a suggestion of things you should consider.
In most cases, you need to implement some sort of security policies so that you can implement everything else. Obviously, those policies can and will change as you implement other controls. For many organizations, the focus is on access control after some sort of baseline policies are in place. This includes all of your password policies and role based access to your network.
Evaluate your priorities. Your organization may have company policies in place that can guide you with this task. For example, you may be keeping customer information and your organization places importance on this. Other places to start are IP or infrastructure. If you understand what your corporate assets are, this makes the job easier. Performing a security assessment helps as well. A good assessor will set priorities for you that will guide you in your implementation.