ISO 27001 Gap Analysis
Assess your current information security management system against ISO/IEC 27001:2022 Clauses 4–10 and all 93 Annex A controls to identify gaps before your certification audit.
ISO 27001 Gap Analysis
ISO/IEC 27001:2022 gap analysis workbook covering clauses and Annex A controls, with gap analysis guidance.
- 2 editable files · 1 Word · 1 Excel
- Instant download after payment, plus an email copy of your links
- Single-organisation licence: use across all your sites and staff
- 90-day money-back guarantee
See every file in the download (2)
- Gap AnalysisExcel
- Gap Analysis GuidanceWord
What the ISO 27001 Complete ISMS Toolkit adds
This product is the file set listed above. The live audit dashboard and the sample documents below come with the ISO 27001 Complete ISMS Toolkit, which also contains everything in this product.
Try the live audit dashboard
The Excel audit checklist below is part of the ISO 27001 Complete ISMS Toolkit, not of this product. Change an answer to see how it scores.
The full Excel checklist scores all 123 questions automatically, with charts, a root-cause chart and a readiness dashboard.
Preview sample documents
Sample pages from the ISO 27001 Complete ISMS Toolkit, showing the structure and writing style.
Information Security Management System Manual
Section 6.1 — Actions to address risks and opportunities
6.1.2 Information security risk assessment
The organization runs a defined and repeatable process for assessing information security risk. The criteria for performing assessments and for accepting risk are set out in advance, so that repeated assessments give consistent and comparable results.
Risks to the confidentiality, integrity and availability of information within scope are identified. Each risk is given an owner, analysed for likelihood and consequence, and weighed against the acceptance criteria to set its priority for treatment.
6.1.3 Information security risk treatment
For each risk that needs treatment, a treatment option is selected — modify, retain, avoid or share — and the controls required to deliver it are determined. The chosen controls are checked against the reference set in Annex A to confirm nothing has been missed, and the outcome is captured in the Statement of Applicability.
Instant download · editable Word, Excel & PowerPoint · 90-day money-back guarantee
What Is a Gap Analysis?
A gap analysis compares your organisation's current practices against the requirements of ISO 27001. It highlights where you already conform, where partial implementation exists, and where significant gaps need to be addressed before you can achieve certification.
Running a gap analysis early in your implementation project helps you prioritise effort, allocate resources effectively, and set a realistic timeline for certification readiness.
What's Included
- 30 clause-by-clause requirement rows covering Clauses 4 through 10
- 93 Annex A control rows, one for each control, for 123 rows in total
- Status column to record each row as Y, Partial or N
- Evidence / Notes and Action Required columns against every row
- Single-sheet Excel layout with filters and a frozen header row
- Gap analysis guidance (Word) on running the assessment and building an action plan
How to Conduct the Gap Analysis
- Gather existing documentation — collect current policies, procedures, risk registers, and audit reports
- Assess each clause — rate your conformity level for every requirement in Clauses 4 to 10
- Evaluate Annex A controls — determine the implementation status of each applicable control
- Identify priority gaps — focus on high-risk areas and requirements that need the most work
- Create an action plan — assign owners, set deadlines, and track progress towards closing each gap