How to run an ISO 27001 gap analysis

What a gap analysis is, and what it is not

A gap analysis is a planning tool. You run it early, before the management system is fully built, to see how far you already are and to scope the work ahead. It is deliberately informal: your own team can run it, and its only job is to produce an honest map of where you conform and where you do not.

It is not the same as three things people often confuse it with. It is not an internal audit, which the standard requires once your system is running and which must be conducted objectively and impartially (by an internal or external auditor who does not check their own work) to confirm that the system conforms and works. It is not a risk assessment, which evaluates your information-security risks against defined criteria and, through risk treatment, drives which controls you need (the two feed each other). And it is not the certification audit itself, the Stage 1 and Stage 2 assessment carried out by a certification body (choose an accredited one for the strongest recognition). Think of the gap analysis as the map you draw before the journey, not the inspection at the end of it.

How to run an ISO 27001 gap analysis, step by step

1. 1

   Fix the scope before you measure anything

   Decide which parts of the organization, which locations, which services and which information the management system covers, and write the boundary down. This is what clause 4 asks for: an understanding of the internal and external factors and the interested parties whose expectations shape the system. Since Amendment 1:2024, clause 4 also asks you to consider whether climate change is a relevant issue and whether interested parties have climate-related requirements, so note that while you scope. A gap analysis run against a fuzzy scope produces gaps you cannot act on, because you never agreed what was in and what was out.

2. 2

   Collect what already exists

   Pull together the policies, procedures, risk records, asset inventories, supplier contracts, access-control settings and past incident notes you already have. Most organizations are further along than they assume: a gap analysis is as much a stock-take of the evidence you can already point an auditor at as it is a hunt for what is missing. Gathering this first stops you recording a gap that a document in another team already closes.

3. 3

   Assess the management-system clauses (4 to 10)

   Work through the requirements the standard places on the management system itself, across clauses 4 to 10: the organization's context and interested parties, direction and ownership from senior management, risk assessment and security objectives, resources and competence, documented information, planning and controlling the day-to-day security work, measuring whether the system works and running an internal audit, and handling problems and improving. A certification auditor can raise nonconformities against these clauses just as readily as against the Annex A controls, so give them equal weight rather than treating them as an afterthought. Our free checker breaks these clauses into eleven self-scored areas if you want a fast first pass.

4. 4

   Assess the Annex A controls

   Go through the 93 controls in Annex A of ISO/IEC 27001:2022, grouped into four themes: organizational (37), people (8), physical (14) and technological (34). For each control, make two separate decisions. First, is the control necessary? Necessity comes from your risk treatment (the controls you chose to address your risks) and from any legal, regulatory or contractual obligations, not from scope alone, so Annex A is a checklist you compare those decisions against rather than the starting point. Second, where a control is necessary, is it fully implemented, partly in place, or absent? Record the evidence that would demonstrate it. Keeping necessity and implementation as distinct judgements is what later lets you write a defensible Statement of Applicability.

5. 5

   Record every gap with a status and the evidence it expects

   Capture a plain verdict for each item, but use the right scale for each half. The clauses 4 to 10 all apply and cannot be excluded, so record each as conforming, partly conforming, or not in place. For the Annex A controls, record whether the control is necessary and, where it is, its implementation status (implemented, partial, or absent). Add a one-line reason and the evidence an auditor would expect to see. The evidence note is the part teams skip and the part that makes the analysis useful: a gap recorded without what would close it is a worry, not a task. A simple spreadsheet with one row per requirement or control and these columns is enough to start.

6. 6

   Prioritize by risk and effort, then build a remediation plan

   Rank the gaps three ways: how much risk each one exposes, whether it blocks certification, and how quickly it can be closed. Give each gap an owner and a target date. The quick, low-risk fixes clear the board and build momentum; the slow, high-risk ones need to start early. This ranked, owned list is what turns a gap analysis from a document into a remediation project with a schedule.

7. 7

   Feed the results into your Statement of Applicability and re-check before Stage 1

   Turn the necessity decisions from step 4 into a Statement of Applicability. It records the controls you have determined are necessary (including any you use that sit outside Annex A), why each is necessary, its implementation status, and a justification for every Annex A control you leave out. That document is a certification requirement in its own right, and our free Statement of Applicability generator gives you a starting scaffold. Once remediation is under way, run the gap analysis again against the same scope, so you walk into the Stage 1 certification audit already knowing what an auditor will find.

Five mistakes that make a gap analysis useless

• Skipping the clauses

  Assessing only Annex A and ignoring clauses 4 to 10. The Stage 1 audit is largely a documentation review of exactly those clauses, so the gaps you skip are the ones you meet first.

• Recording gaps without expected evidence

  A verdict of “absent” with no note on what would close it is not actionable. Every gap needs the evidence an auditor would want to see attached to it.

• Analysing against an undefined scope

  If you have not agreed what the ISMS covers, every control is ambiguous. Fix the scope first, then measure against it.

• Treating applicability and implementation as one question

  “Does this control apply?” and “is it in place?” are separate judgements. Collapsing them produces a Statement of Applicability you cannot defend.

• Doing it once and never again

  A gap analysis at the start is a baseline. Re-running it after remediation, before Stage 1, is what tells you whether the work actually closed the gaps.

Frequently asked questions