The auditor leans across the table and asks one simple question. Can you show me last quarter’s access review? Your IT lead opens three folders or an old inbox. Ten minutes pass in silence. The auditor then writes a major nonconformity into the report.
An ISO 27001 gap analysis compares your current security practices with the requirements of ISO/IEC 27001:2022 to identify absent controls, poor procedures and undocumented policies. Use the Smithers ISMS Pre-Assessment Guide to tick off standard requirements like a checklist
In this guide, we will explain the iso 27001 gap analysis, how you can find your weak spots, the cost, how you can improve it, and seven steps from blind spot to clear plan.
What Is an ISO 27001 Gap Analysis?
An ISO 27001 gap analysis is a structured check of your information security management system (ISMS) against the standard. It covers the mandatory clauses 4 to 10 and the 93 controls in Annex A. The result is a scored list of gaps and a dated plan to close them. If you want to read iso 27001 in detail, you can check out this guide. What is ISO 27100?
Gap Analysis, Risk Assessment or Internal Audit?
Many people often mix up the three checks below. Each one is a different question and has a different purpose. So each one gives you a different result.
Only the gap analysis is optional. However, it makes the two mandatory checks far easier to pass.
The Gap You Never Saw Costs the Most
A hidden gap always costs more than a gap you find early. The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses faced a breach or attack in the past 12 months. That figure equals about 612,000 firms. Could your business be one of them next year?
The same survey shows all the weak spots at the top. Only 31% of UK businesses give a board member formal responsibility for cyber security. Supply chain checks also lag behind. Both areas sit at the main part of ISO 27001, in Clause 5 and in the supplier controls of Annex A.
Detailed audits exactly tell the same things. A missed gap often turns into a major nonconformity at the Stage 2 audit. The certification body then holds back your certificate until you fix it. Meanwhile, the tender deadline for your next big client passes. A certified rival then wins the deal.
When Should You Run One?
You should run a gap analysis at four key moments. Each moment changes what your ISMS must cover.
- Before you build an ISMS from scratch
- Six to eight weeks before your Stage 1 audit
- After a big change, such as a merger, a cloud move or adding new products
- Once a year, as part of your management review
You should replace it today. The old version listed 114 controls. It has 93 controls spread out in four themes for 2022. The transition deadline also passed on 31 October 2025.
Your Kit Before Day One
A good gap analysis starts with the right kit on the desk. You should gather five items before the first interview.
- A licensed copy of ISO/IEC 27001:2022 and its 2024 amendment
- A one-page scope note, signed by a director
- A list of every current policy, procedure and record
- Your asset register and supplier list
- A short list of people to interview from IT, HR, finance and operations
Many gaps sit in leaver processes, contracts and supplier payments, not in servers. You can also take a free GRC Index assessment for a quick baseline score before day one.
Seven Steps From Blind Spot to Clear Plan
These seven steps will help you turn an undefined worry into a concrete plan. You should follow them in order. Each step feeds the next one. Steps 1 to 4 find the gaps. Steps 5 to 7 prove, score and close them.
Some gaps turn up in almost every grc assessment. You should also check the five areas below first.
The 11 New Controls Most Teams Miss
Acording to the 2022 update it added 11 brand-new controls. Old checklists skip every one of them.
Step 1. Draw the Boundary Line
Your scope sets the sites, teams, systems and data inside the ISMS. Clause 4.3 asks you to record it. For instance, A SaaS firm in London, might cover only its platform team and its AWS estate. Each exclusion and its rationale should be detailed.
Step 2. Pull Every Document Onto One Desk
You should must have every policy, logins, and record into one shared folder. Scattered files like non-contiguous, fragmented files, hide gaps and waste days. Next, write down the date and who owns each file. A policy with no review for two years is a gap in its own right.
Step 3. Walk Clauses 4 to 10, Line by Line
Clauses 4 to 10 form the management system itself. They cover context, leadership, planning, support, operation, performance evaluation, and improvement. Auditors test these clauses before they test any control. Before that you should ask three simple questions for each one. Do we have it? Do we use it? Can we prove it?
Step 4. Test All 93 Annex A Controls
Annex A holds 93 controls in four themes. The split is 37 organisational, 8 people, 14 physical and 34 technological controls. You should mark each control as in place, partial or absent both. Then you should note the evidence behind each mark.
Step 5. Hold the Paper Up Against Real Practice
A policy on paper proves very little. The auditors talk to staff about daily work. They also sample real records. So you should ask a new starter about the password rule. Does the answer match the policy?
Step 6. Paint Each Gap Red, Amber or Green
A RAG score turns a long list into a clear picture. Red means absent, or a likely major nonconformity. Amber means partial, or in place with no proof. Green means in place, with evidence. You can also add a maturity score from 0 to 5 to track progress over time.
Step 7. Turn Gaps Into a Dated Action Plan
Every red and amber gap needs an owner, a fix and a deadline. You should close red gaps first and amber gaps next. Quick wins, such as a policy sign-off, build early momentum. After all, a plan with no dates is only a wish list.
Where Weak Spots Hide
Some gaps turn up in almost every grc assessment. You should also check the five areas below first.
One Gap Register Row, Filled In
Each row in a gap register should tell a full story. Here is an example of how to fill in the access review gap from the first scene.
You can see the detail in the second column. A note such as “access issue” gives the owner no clear task. A precise row lets the owner act on day one.
The Climate Line Hidden in Clause 4
ISO added two short lines on climate change in February 2024. Clause 4.1 now asks you to decide if climate change is a relevant issue. Clause 4.2 adds a note on climate needs from interested parties. A flood risk at your data centre is one os the clear example. Auditors expect a short, recorded decision either way.
A Statement of Applicability Full of Holes
It has a list of all 93 controls in the Statement of Applicability (SoA). It shows which controls apply, why, and how you meet them. Clause 6.1.3 makes it mandatory. A thin SoA with blank reasons often draws the auditor’s first question.
Access Reviews With No Paper Trail
Control 5.18 covers access rights. Many companies remove leavers on time. However, they keep no record of the review. No record means no proof for the auditor, just like the scene at the top of the page.
Suppliers Nobody Checked
Controls 5.19 through 5.22 set up the rules for keeping information secure when working with suppliers and other external parties. These controls teach an organization how to make policies, negotiate security terms in contracts, handle technology supply chains, and keep an eye on vendor services. Weak supplier checks remain a common gap across UK firms.
What Your Gap Report Should Look Like
Your gap report should read like a map, not a novel. A board member should grasp the result in two minutes. That's why the RAG monitor should be on the first page.
The RAG dashboard sits near the top. Your board then sees the verdict before the detail.
A result of 61 green, 22 amber, and 10 red controls tells a clear story at a glance. It also shows the board where the budget must go first.
DIY or Outside Help: Which Fits You?
Your own team knows the systems well. However, people rarely spot flaws in their own work. An outside view removes that blind spot.
GRC Index runs an independent GRC assessment across six domains. It gives your board one score from 0 to 100, a maturity level and a domain-by-domain view of your gaps. You can then hand that view to a consultant and cut their days on site.
How Long Does It Take, and What Does It Cost?
Most SMEs finish a gap analysis in one to four weeks. Size, scope and the state of your documents drive the timeline. Consultants on the UK Government’s G-Cloud 14 marketplace list ISO 27001 gap and readiness work at £850 to £1,450 a day. The table below turns those day rates into rough budgets.
Your own staff time adds to the bill. A tight scope and a tidy document folder save consultant days. A free baseline score also shows where to spend paid time first.
Five Mistakes That Hide Your Gaps
The same five errors appear again and again. Each one lets a real gap slip past you.
- An old 2013 checklist. It misses all 11 new controls and the climate line in Clause 4.
- Paper-only checks. A signed policy proves little about daily practice.
- IT works alone. Gaps in HR, legal and supplier contracts stay out of sight.
- Vague gap notes. A note such as “access issue” gives the owner no clear task.
- No dates on the plan. Gaps with no deadline stay open until the audit.
Your weak spots exist today, found or not. The real question is who finds them first, you or your auditor. You can get your free GRC Score in a few minutes. You can also talk to the GRC Index team about your ISO 27001 readiness.
.jpg)
