ISO 27001 Gap Analysis: Template and How to Run One

How to Run a Gap Analysis

1. Confirm scope and interested parties — products, sites, cloud accounts, shared services.
2. Collect artefacts — policies, diagrams, access reviews, incident records, vendor contracts, prior audit reports.
3. Interview owners — security, IT, HR, legal, product, facilities.
4. Score clauses and control themes — e.g. Met / Partial / Missing / Not applicable (with justification).
5. Record evidence references — link each score to a document, ticket, or “none found”.
6. Prioritise remediation — risk, customer commitments, and audit blockers first.
7. Brief leadership — effort, budget, and target certification window (as a plan, not a guarantee).

Suggested Scoring Legend

HTML Template Sections (Copy into Your Tracker)

Use these columns in a sheet or in CSA:

Expand rows for Annex A themes that matter to your scope (organisational, people, physical, technological) without treating a website table as a complete control catalogue.

From Gaps to Roadmap

• Group findings into policy, process, and technical workstreams.
• Link high-risk gaps to your risk assessment.
• Schedule an internal audit once major design gaps close.

How CyberSilo Helps

• Facilitated ISO 27001 gap workshops and written reports
• Remediation coaching into CB-ready evidence
• CSA to track owners, due dates, and proof

Frequently Asked Questions

Is a gap analysis the same as a certification audit?

No. A gap analysis is a readiness exercise you control. A certification audit is performed by an accredited certification body against the standard and your declared scope.

Do we need to score every Annex A control ID?

You should cover applicable Annex A themes and clause requirements relevant to your scope. Listing every control ID in a blog template is not required; prioritise high-risk and high-effort gaps first.

How long does a typical gap analysis take?

For a mid-sized scope, a typical market estimate is one to four weeks of workshops and evidence review, depending on maturity and document availability. This is a planning range, not a fixed rule.

Related ISO 27001 Resources

Checklist · ISMS scope · Internal audit · Policies · ISO 27001 hub · CSA