ISO 27001 Gap Assessment: Steps and Deliverables

An ISO 27001 gap assessment compares your current controls and documents with the standard's clauses and Annex A control set, then delivers a prioritised remediation plan. It prepares a company for a certification audit, but it is not itself a certificate and no assessment can promise that one follows.

What is an ISO 27001 gap assessment?

ISO/IEC 27001 is the international standard for an information security management system (ISMS): a documented, risk-based set of policies, processes and controls, maintained and improved rather than installed once. Certification is issued by an accredited certification body after its own audits; the standard itself is bought from ISO and its requirements are what every assessment measures against. If a customer or a tender now asks about information security, send your current policies and we will quote a gap assessment against the standard: request a quote.

A gap assessment answers one question honestly: how far is the organisation from meeting those requirements today? It reviews what exists — documents, actual practice, technical configuration — and records the differences as findings against the clauses of the standard (clauses 4 to 10 carry the management-system requirements) and against the Annex A control set, which in the 2022 version contains 93 reference controls grouped by theme.

Three clarifications that save confusion later:

It is a readiness exercise, not an audit. No accreditation, no certification decision, no formal non-conformity with a certification body's numbering. What it produces is a working plan.

Scope is chosen, not imposed. ISO 27001 does not require certifying the whole organisation: scope can be a business unit, a location, a product line or a set of systems, provided the boundary is defined and justified. Most companies scope narrowly first — a decision that halves the assessment's cost and the certification's, and one worth settling before anyone reviews a single document.

It is honest about evidence. A document that says one thing and a practice that does another is recorded as it is, because the certification auditor will find the same difference later, at a worse moment.

The assessment process

The six steps below are what a working assessment looks like. The output column is the point of the table: each step should produce an artefact you keep, not an impression:

Table A: step | what happens | output

Step	What happens	Output
Scoping	Agree the ISMS boundary: which locations, departments, systems and data are in, and why; identify interested parties and their requirements	Scope statement with justification, ready to reuse in the Stage 1 audit
Document review	Read the existing policies, procedures and records against clauses 4–10 and Annex A; check whether documents describe reality or aspiration	Document inventory with a status per item: exists / partial / absent, with the evidence seen
Interviews	Talk to the people who run the processes — IT, HR, operations, finance, management — and compare answers across roles; contradictions between two departments are findings too	Interview notes per process, with practice-vs-document differences recorded
Technical checks	Sample the actual configuration: access lists, logging, backup jobs and restore evidence, patch status, physical access — sampled, not a penetration test	Check results per control area, with samples and dates so a result can be re-verified
Rating	Score each finding by severity and effort; severity follows the risk to the organisation rather than the control's position in Annex A	Gap register: clause or control, current state, finding, severity, suggested owner
Report and roadmap	Assemble findings into a report and sequence the work: quick wins, structural items, and the documents that must exist before the Stage 1 audit	Gap analysis report, remediation roadmap with priorities, draft Statement of Applicability

A note on method: the standard does not prescribe how a gap assessment is conducted, so providers differ. What separates a useful one from an expensive one is the evidence discipline — findings tied to something a certification auditor could re-check — and the register that follows afterwards. The governance and audit questions around security work are treated on the IT audit and consulting page, and the wider context of securing the infrastructure behind the ISMS sits on the digital infrastructure page.

Deliverables

Four artefacts define a serious assessment. If a proposal does not name all four, ask why:

Gap analysis report. The narrative: scope reviewed, method, findings by clause and control area, and an executive summary a managing director can read in ten minutes. The report explains the differences; it does not merely list them.

Gap register. The working database: every finding with its clause or Annex A reference, current state, severity and priority. The register is what the project runs on afterwards — it converts the report from advice into a backlog with owners.

Remediation roadmap. Findings sequenced into a plan: what must exist before the Stage 1 audit, what belongs in the first months of the ISMS, and what can wait. The sequence respects dependencies — you cannot review access quarterly until access lists exist.

Draft Statement of Applicability (SoA). The document that lists every Annex A control, whether it is applicable and why, and how it is implemented. A draft SoA prepared during the assessment is the single largest time-saver in the certification project, because the alternative is writing 93 decisions from a blank page under deadline.

Deliverables arrive in written form and belong to the buyer. A provider who will not show a sample report before signature is telling you something about the report.

What the assessment is not

Being precise about this saves arguments later:

It is not a certificate. Only an accredited certification body, working to ISO/IEC 17021 and the certification body's own accreditation, can certify an ISMS. An assessment is advisory work; its findings have no standing with a certification body, and no assessment outcome guarantees certification — an organisation can pass its assessment and still fail its Stage 2 audit on findings the auditor develops independently.

It is not an internal audit. The standard requires internal audits and a management review as part of running the ISMS; those are obligations inside the system, performed later, and the assessment is the work that gets you to the point where they can happen.

It is not a security test. Sampling configuration is part of it; a penetration test or a full technical audit is a different engagement with different scope and depth.

It is not a legal opinion. ISO 27001 and data protection law overlap but are different instruments — see the FAQ below — and neither an assessment nor its report substitutes for advice from a qualified legal or data protection adviser.

It is not a promise about certification. Any provider implying guaranteed certification, quoting a success rate, or suggesting a relationship with a certification body that decides independently should be treated as a warning sign, not a selling point. Independence is the product.

Preparing for the certification audit

The assessment's real value shows in the certification project that follows. How the two connect:

Stage 1 checks the documentation and the scope: the ISMS scope statement, the risk assessment and treatment, policies, the Statement of Applicability, internal audit records and management review records. Most Stage 1 findings are missing or stale documents, which is exactly what the assessment's document review and draft SoA produce.

Stage 2 checks implementation and practice: whether the controls operate as documented, sampled across the scope. The interview and technical-check work of the assessment rehearses this — a team that has already answered questions about its access reviews and incident handling does so calmly in the audit.

Surveillance and recurrence follow certification, so the roadmap must build an operating system, not a document set: access reviews that recur, incidents that are recorded, training that is logged, backups that are restored and tested. An ISMS built to pass one audit collapses in the first surveillance.

Practical preparation points the assessment usually surfaces: who owns each control area internally, whether management review is a real meeting or a signature, whether internal auditors are independent of what they audit, and how records are kept between audits. For a company doing this for the first time, the surrounding IT questions — logging, access management, backup discipline — are treated on the digital infrastructure page, and vendor and data handling duties on the IT outsourcing page.

Common gaps

The findings that recur across small and mid-sized companies, in rough order of how often they appear:

Asset inventory. No current list of systems, devices and data with owners. Almost every other control depends on knowing what exists, which is why this is usually the first roadmap item.

Risk assessment method. Either absent or inherited from a template without an organisational rationale; the certification auditor asks how risks were identified and treated, and "the consultant wrote it" is not an answer that survives.

Supplier management. No register of which suppliers touch company data, no security requirements in supplier agreements, no review cycle. For companies working with development partners, this gap sits directly on top of the contract questions treated on the IT outsourcing page.

Access reviews. Accounts granted at joining and never reviewed; leavers found in the access list; administrator rights held by people who left the role. Reviews that exist on paper but have no records are half a finding.

Incident handling. No defined process, no contact list, no recording of incidents that did happen. Incidents the company forgot it had are the ones that become findings in the audit.

Awareness training. A one-off onboarding slide instead of a recurring programme with records. The standard asks whether people are aware of their obligations; a dated attendance list answers that question.

Backup testing. Backups configured and never restored. A restore that has never been attempted is an untested control, and the assessment's technical check usually asks for evidence of a restore rather than a screenshot of a schedule.

How to choose a provider

Three questions separate a rigorous assessment from an expensive review:

Independence. The assessor must have no stake in the certification decision — assessors do not certify, certification bodies do, and a provider promising both is describing a conflict, not a service. Independence also covers the assessor having no product to sell afterwards: an assessment that recommends your platform is a sales document with findings attached.

Method. Ask for the method before the proposal: how scoping is agreed, how findings are rated, what evidence is required per control area, and what deliverables arrive. A method written down in advance is what makes the findings defensible to a certification auditor later.

Sample report. The single best test. A redacted gap register and a report show exactly what you will receive: whether findings are tied to clauses with evidence, whether severities are reasoned, and whether the roadmap is a sequence or a wish list.

Two practical extras for companies in Türkiye: confirm whether the assessor works with standards and certification bodies familiar to your target market's customers, since client requirements often name specific schemes; and confirm the working language for interviews and documents, because findings must be usable by the teams that will fix them. The vendor RFP checklist gives the general method for scoring such a purchase, and the IT audit and consulting page covers the wider advisory context.

Frequently Asked Questions

How long does a gap assessment take?

It depends on scope, and anyone quoting a duration before scoping is guessing. The drivers are the size of the scope — number of locations, systems and processes in the boundary — the state of the documentation, and how many people must be interviewed. A single-department scope with existing policies is a different engagement from a multi-site scope starting from nothing; the honest answer comes after the scoping conversation, in writing.

Do we need ISO 27001 to sell?

Usually it is a customer requirement rather than a legal one: tenders, large accounts and regulated buyers increasingly ask for certification, particularly in software and services. The practical answer is to check your own pipeline — if two serious prospects have asked, the business case exists; if none has, the case rests on risk reduction rather than revenue. The standard does not require certifying the whole organisation, so a scoped certification can serve the customer-facing part of the business first.

What is the Statement of Applicability?

The document that lists every Annex A control, states whether it is applicable to your scope and why, and describes how it is implemented. It is required by the standard and reviewed by the certification body; it is also the most efficient artefact to prepare early, because it forces the control decisions into writing once instead of under audit pressure. A draft SoA is one of the four assessment deliverables above.

How are gaps rated?

By severity and priority, with severity tied to the risk to the organisation rather than the control's position in the standard. A usable rating explains itself: what could happen if the gap stays, who or what is exposed, and what it takes to close it. Ratings that only rank items "high/medium/low" without reasons produce arguments later; ratings with a written rationale produce a roadmap people follow.

Can a gap assessment replace an audit?

No. The internal audit and management review are obligations inside the ISMS, and the certification audit belongs to an accredited certification body. A gap assessment precedes both and helps with both, but it carries no audit standing — that is the "not a certificate" line above, and any provider blurring it should be asked to clarify in writing.

Partly overlapping, not the same. ISO 27001 is a management-system standard for information security and touches data protection only where security controls protect personal data; KVKK and GDPR set legal duties — lawful basis, data subject rights, breach notification, transfer rules — that an ISMS can support but does not satisfy by itself. Many companies run both programmes with shared artefacts, and the legal questions stay with a qualified adviser; the KVKK/GDPR duties around vendors and hosting are treated on the IT outsourcing page.

Sources and standards

The standard itself is ISO/IE 27001, published by ISO (https://www.iso.org); the requirements assessed are clauses 4–10 and the Annex A control set, which contains 93 reference controls in the 2022 version. Certification is performed by accredited certification bodies working under ISO/IEC 17021; this page makes no certification claim of any kind.
Process, deliverables and common-gap statements follow practitioner practice for gap assessments generally (scoping, document review, interviews, technical sampling, severity-rated gap register, remediation roadmap, draft Statement of Applicability); no durations, costs or success rates appear on this page.
Certification-process statements (Stage 1 documentation audit, Stage 2 implementation audit, surveillance) follow the standard's published certification framework; confirm current rules with the certification body you choose.
No claim that WorldwideTradeX is ISO 27001 certified or accredited, and no guarantee of certification, appears anywhere on this page; data protection duties are named, not interpreted — confirm the applicable regime with a qualified adviser.

To discuss the scope of a gap assessment and what it can and cannot promise, contact us or call +90 505 679 78 03.

IT audit and consulting · Digital infrastructure · IT outsourcing from Türkiye · Vendor RFP checklist · Request a quote