CIS controls and Risk Assessment

Hi,
If you use CIS IG1 for a small company, do you first start with the risk management? Or since the most critical controls are already selected in priority you don't need to do that.
If you do which framework would you use. Nist RMF might be too complex. CIS RAM?

Would you do assessment after you have deployed controls 1 and 2?

Regards

assessment cis cis controls controls critical cybersecurity don framework management nist risk risk assessment risk management rmf start