which extent it should be applied?

Which standard prescribes a risk assessment to identify whether each control is
required to decrease risks and if so, to which extent it should be applied?

A.
ISO 27001

B.
ISO 27002

C.
ISO 17799

D.
HIPPA

E.
ISO 9000