ISO 27001 gap analysis: how to find out how far your ISMS is from the standard
An ISO 27001 gap analysis (or initial self-assessment) compares what the organization already does in information security with what ISO/IEC 27001:2022 requires. You review every requirement of clauses 4 to 10 and each of the 93 Annex A controls, mark it as compliant, partial or non-compliant, record the evidence that exists today, and the result is a compliance percentage by area plus a list of gaps that becomes the project plan. The standard does not require it, but it is the first step of almost every implementation.
Is a gap analysis mandatory for ISO 27001?
No. No clause of ISO/IEC 27001:2022 asks for a gap analysis, and the certification body will not review it as mandatory documented information. Organizations do it because it answers three questions before spending time and money: how much is missing, what comes first, and how long the project may take.
It also works as a baseline. Repeated a few months later, the same file shows top management how far the ISMS has progressed without a separate report. If the organization already runs another ISO management system (for example ISO 9001), several requirements of clauses 4 to 10 can be extended instead of built from scratch.
What is reviewed: clauses 4 to 10 and Annex A
The NexoDocs kit self-assessment (ISMS-GAP-01) splits the standard into two sheets. Questions and control titles are our own wording and for reference only: the standard is cited by clause and control number, not copied.
| Part of the standard | What is checked | Rows in the self-assessment |
|---|---|---|
| Clause 4 · Context | Internal and external issues (including the climate change question from Amd 1:2024), interested parties, scope, management system | 5 |
| Clause 5 · Leadership | Top management commitment, information security policy, roles and authorities | 3 |
| Clause 6 · Planning | Risks and opportunities, risk assessment and treatment, Statement of Applicability, objectives, changes | 7 |
| Clause 7 · Support | Resources, competence, awareness, communication, documented information | 5 |
| Clause 8 · Operation | Operational control, performing risk assessment and risk treatment | 3 |
| Clause 9 · Performance evaluation | Monitoring and measurement, internal audit programme and execution, management review | 4 |
| Clause 10 · Improvement | Continual improvement, nonconformities and corrective action | 2 |
| Annex A · 93 controls | Organizational (37), people (8), physical (14) and technological (34) | 93, with an «Applicable?» column |
That is 29 questions for the clauses and 93 for the controls. The file flags the 11 controls that were new in the 2022 edition, such as threat intelligence (5.7), information security for cloud services (5.23), configuration management (8.9), data leakage prevention (8.12) and secure coding (8.28): they are usually the most common gaps in organizations moving from the 2013 edition.
ISO 27001 ISMS documentation toolkit
84 files to document your ISMS based on ISO/IEC 27001:2022.
See the full toolkitHow to run a gap analysis step by step
- Set a provisional scope: which processes, sites, systems and services are in. Without a scope, the assessment mixes in things that will later be left out.
- Bring in the people who know how things really work: the ISMS manager, IT, the owners of the main processes, HR and, if there is one, legal or compliance.
- For clauses 4 to 10, choose one of three statuses for each question: compliant, partial or non-compliant. There is no «not applicable» option because these clauses cannot be excluded.
- For Annex A, first state whether the control applies (a preliminary decision) and then its status. The final decision is made later, in the Statement of Applicability.
- Record the current evidence: document, record, ticket or configuration. If you cannot show it, mark «partial» even if the activity takes place.
- Review the summary: percentage by area, requirements not yet assessed and controls marked as not applicable.
- Move the red gaps into the project plan with an owner and a date, starting with clauses 4 to 6, which everything else depends on.
How compliance is scored
In the template, each row adds a score based on its status, and the percentage for each area is the average of the rows assessed:
| Status | Score | When to use it |
|---|---|---|
| Compliant | 100% | Exists, is documented where needed and is applied, with evidence |
| Partial | 50% | Incomplete, undocumented or without records to prove it |
| Non-compliant | 0% | Not done, or no evidence at all |
| Not applicable (Annex A only) | Left out of the average | Control excluded on a preliminary basis, to be justified later in the Statement of Applicability |
Example: if clause 7 (5 questions) has 2 compliant, 2 partial and 1 non-compliant, the result is (100 + 100 + 50 + 50 + 0) / 5 = 60%. The summary uses a traffic light: red below 50%, yellow from 50 to 79% and green from 80%. Rows not yet assessed do not count towards the percentage, which is why the summary shows separately how many are still pending.
What to do with the result
- Prioritize by dependency, not by ease: without context (4.1), scope (4.3) and a risk methodology (6.1.2) you cannot choose controls properly.
- Use the preliminary Annex A status as a draft of the Statement of Applicability, but confirm it with the risk assessment.
- Group the gaps into work packages (governance, risk, policies and controls, people, suppliers, evaluation and improvement) and put them in the plan with dates.
- Estimate the timeline from the result: many red areas in clauses 4 to 10 usually extend the project more than a few pending technical controls.
- Repeat the self-assessment before the certification audit and compare it with the internal audit (9.2): a self-assessment tends to be optimistic.
Common mistakes
- Marking «compliant» because «we do it», with no evidence to show.
- Using «not applicable» for clauses 4 to 10, which cannot be excluded.
- Excluding Annex A controls for convenience, unrelated to the risks: it will not hold up in the Statement of Applicability.
- Running it only from IT, without HR, procurement or the process owners.
- Leaving it in a drawer: if it does not become a plan with owners and dates, it is useless.
Template: the gap self-assessment in the ISO 27001 toolkit
The NexoDocs ISO 27001 toolkit includes the ISMS-GAP-01 self-assessment: a macro-free Excel file with the 29 questions for clauses 4 to 10 and the 93 Annex A controls already loaded, the evidence an auditor usually asks for and the kit document that covers each row, a status drop-down, automatic scoring and a summary by area with a traffic light. It takes one to two hours to complete. It is the first task of the project plan with a Gantt chart (ISMS-PRJ-01) in the same kit, and its result feeds the risk assessment and the Statement of Applicability. If you want to see the format first, you can download the free internal audit checklist sample.
Next step
Try it free or go straight to the complete solution.
ISO 27001 ISMS documentation toolkit
84 files to document your ISMS based on ISO/IEC 27001:2022.
See the full toolkit
Free sample
Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.
Get the free sampleFrequently asked questions
How long does an ISO 27001 gap analysis take?
Completing the template takes one to two hours with the right people in the room. Gathering and reviewing the evidence behind each answer can take a few more days in a mid-sized organization.
What is the difference between a gap analysis and an internal audit?
A gap analysis is a self-assessment for planning, with no mandatory format. The internal audit (clause 9.2) is mandatory, is carried out by objective and impartial people under a defined programme, and its findings are recorded as nonconformities or observations.
Is it useful if we are moving from ISO 27001:2013?
Yes. It is a good way to prepare the transition: the file flags the controls that are new in the 2022 edition and the climate change question from the 2024 amendment, which are what is most often missing.
Does a gap analysis replace the risk assessment?
No. The gap analysis measures the status of requirements and controls; the risk assessment (6.1.2) is mandatory and is what justifies which controls are applied.
Does a 100% score mean we will pass the audit?
No. Certification is decided by a certification body after its audit; the gap analysis is a self-assessment that organizes the work and shows progress.
Related guides
ISO 27001:2022 mandatory documents and records: checklist by clause
Checklist of the documents and records ISO/IEC 27001:2022 requires, clause by clause, which Annex A documents apply and common audit gaps.
Read the guide →ISO 27001 risk assessment template: what it must include and how to use it
What ISO/IEC 27001:2022 requires for risk assessment, the columns an ISMS risk register needs, and how to calculate risk levels. Includes a free Excel sample.
Read the guide →ISO 27001 internal audit checklist: free Excel template
Free ISO/IEC 27001:2022 internal audit checklist in Excel: clauses 4 to 10 and Annex A controls, how to grade findings and what evidence to ask for.
Read the guide →Updated: 2026-10-29