Gap Analysis
A gap analysis tells you how far your current arrangements are from what a standard requires, and what it will take to close the distance. For most organisations considering ISO 27001, it is the right first step.
Led by Levent Şakar, IRCA-certified ISO 27001 and ISO 9001 Lead Auditor.
ISO 27001 gap analysis
I review your management system and controls against ISO/IEC 27001:2022 and set out, in plain terms, what is missing, why it matters and what would close it. You end up with a clear view of the work ahead and a realistic estimate of what certification will take.
| Standards | ISO/IEC 27001:2022, ISO/IEC 27701, UK GDPR, NCSC Cyber Assessment Framework and other management system standards |
|---|---|
| Typical timescale | Four to seven days of work, depending on size and scope, usually completed within two to three weeks. |
| Fee | Fixed, agreed after a short scoping call. |
Gap analysis report Illustrative example
Clause 9.2 Internal audit
| Finding | No internal audit has been carried out against the current scope. |
|---|---|
| Why it matters | An internal audit and a management review need to be complete before the certification audit. |
| Action | Plan and complete an internal audit, then record the results for management review. |
Essential for certification
Clause 5.2 Information security policy
| Finding | The policy is approved and communicated, but the wording is dense and hard for staff to apply. |
|---|---|
| Why it matters | A policy people cannot follow does not change how they work. |
| Action | Shorten it and add a one-page summary for staff. |
Good practice
Every gap in the report is set out this way and marked as essential or good practice.
Who it's for
- Organisations considering ISO 27001 for the first time
- Organisations that started an implementation and want an objective view of progress
- Organisations asked by a customer or tender to show where they stand
What it covers
- The management system requirements in Clauses 4 to 10
- The 93 controls in Annex A, reviewed against how your organisation actually operates
- Existing policies, procedures and records
- Short interviews with the people responsible for key areas
What you receive
- A written report setting out each gap, why it matters and what would close it
- A prioritised action plan, separating what is essential for certification from what is good practice
- A realistic estimate of effort and timescale to certification readiness
- A walkthrough of the findings with your team
Other reference standards
The same approach works against other criteria. The report format stays the same, so results are easy to compare.
ISO/IEC 27701
A review of your privacy management against ISO/IEC 27701. Since the 2025 edition the standard can be certified on its own, so the review works whether or not you hold ISO 27001.
UK GDPR
A structured review against UK GDPR and the Data Protection Act 2018, including the changes introduced by the Data (Use and Access) Act 2025.
NCSC Cyber Assessment Framework
A review against the outcomes in the Cyber Assessment Framework, for organisations asked to show how they meet it.
Gap analyses against ISO 9001 and ISO/IEC 20000-1 are also available.
Where it ends. A gap analysis is an assessment and a report. Putting the actions in place is separate work, which your team can carry out or I can support through Management System Implementation.
Not sure a gap analysis is the right first step?
A short call is usually enough to confirm where to begin.