ISO/IEC 27001 · Gap assessment
Know the real ISO 27001 gaps before building the programme.
A useful gap assessment does more than mark requirements “met” or “not met”.
What good looks like
A gap assessment should show
- What requirement applies
- What currently exists
- What evidence supports it
- What is missing
- Why the gap matters
- What must change
- Who owns the action
- When it should be completed
Worked example
What one gap entry looks like
Each material gap is recorded with enough detail to act on.
Illustrative template — not client evidence
| Field | Illustrative entry |
|---|---|
| Gap ID | GAP-EX-001 |
| Requirement ID | REQ-EX-001 |
| Requirement Type | ISO Clause |
| Source / Clause | Example reference |
| Current State | Example process exists but operating evidence is incomplete. |
| Required State | Defined, operated and evidenced process appropriate to context. |
| Evidence IDs | EV-EX-001 |
| Gap Statement | Evidence trail does not demonstrate consistent operation. |
| Risk IDs | RISK-EX-001 |
| Remediation Action | Define cadence, owner, evidence-retention method and validation. |
| Owner | Example Owner |
| Priority | High |
| Status | Open |
Deliverables
Typical outputs
- Confirmed assessment scope
- Clause 4–10 gap analysis
- Risk-management review
- Statement of Applicability readiness review
- Annex A control and evidence review where relevant
- Priority remediation register
- Dependencies
- Implementation roadmap
What it is not
A gap assessment is not:
- A certification audit
- A guarantee of certification
- A substitute for operating evidence
- A checklist-only exercise
Start with a focused discovery conversation
Tell us what you are trying to achieve, what is driving the requirement and where you are today. We use the first discussion to clarify scope and next steps, not to force a predefined package.