Read these in order and you will follow the sequence a real certification project takes, from understanding the standard to checking your own system.
Start with what the standard requires and how certification runs.
Everything else depends on the risk assessment, so it comes next.
Turn the results into decisions, owners and dates.
Record which controls you apply, and why.
Know what the controls are protecting.
Show that the controls keep working.
Find the problems before the certification auditor does.
