GRC · Specialist service
ISO/IEC 27001 audit and ISMS gap analysis
Before implementing an ISMS, it helps to know which requirements are already met. Gap analysis establishes the current state and helps plan the work needed to reach the intended objective.
Service scope
ISO/IEC 27001 gap analysis
We assess the organisation’s readiness for ISO/IEC 27001 within the agreed management system scope. We analyse decision-making, risk management, documentation and available evidence that processes are being carried out. We distinguish arrangements working in practice from statements that still require implementation or verification. The result is a gap map showing significance, dependencies and recommended remediation. The service helps establish a realistic project scope without assuming that everything must be built from scratch.
ISMS scope and context
We review system boundaries, relevant processes and interested parties’ expectations. We check whether the scope reflects the organisation’s actual dependencies.
Governance and risk
We assess roles, security objectives, risk assessment methods and approval of actions. We verify how decisions connect to control selection.
Documentation and evidence
We analyse policies, procedures, registers and process records. We check whether the Statement of Applicability is consistent with its justifications and the actual implementation status.
Performance evaluation and improvement
We review measurements, internal audits, management reviews and corrective actions. We identify missing evidence needed to assess how the system operates.
Project deliverables
What will your team receive?
- A matrix of requirements, evidence and identified gaps.
- A readiness report for the defined ISMS scope.
- An alignment plan with priorities and dependencies.
- A list of decisions required from management.
Delivery conditions
What do we agree before starting?
- A preliminary system scope and assessment objective.
- Access to current documentation and evidence of its use.
- Participation by process owners and the person responsible for the ISMS.
How we work
From understanding the need to verifying the result.
Agreeing the assessment basis
We confirm the ISMS scope, applicable edition of the standard and available materials. We prepare an interview and verification plan.
Assessing implementation
We compare documentation with practice and evidence. We clarify discrepancies with the responsible people.
Planning gap closure
We establish dependencies between actions and their completion criteria. We present findings to management.
Clear responsibilities
What is already included, and what do we extend?
A gap analysis of the entire ISMS is a separate GRC project. SOC/NOC reports and delivery evidence can support the assessment, but a basic Enterprise review does not replace an organisational compliance audit.
Reference points: ISO/IEC 27001. Requirements and their applicability are established for the individual organisation.
Before making a decision
Questions about ISO/IEC 27001 gap analysis
Is gap analysis a certification audit?
No. It assesses readiness and provides the basis for an action plan. A separate, independent certification body makes the certification decision.
Can we start without complete documentation?
Yes. Documentation gaps form part of the assessment. What matters is access to people and information showing how the organisation actually runs its processes.
How does gap analysis differ from an internal audit?
Gap analysis primarily helps plan alignment. An internal audit assesses an operating ISMS against adopted criteria and the audit programme.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.