Preparing for ISO 27001 certification can feel complex, especially if your organisation already has security policies, technical controls and risk processes in place but is unsure how closely they align with the standard.
An ISO 27001 gap analysis helps answer that question.
It provides a structured review of your current information security management practices against the requirements of ISO/IEC 27001. The goal is to identify what is already in place, what needs improvement and what is missing before you move further towards certification.
For Australian organisations, a gap analysis can be particularly useful because it creates a clear starting point for developing or improving an Information Security Management System (ISMS). Rather than immediately creating new policies or purchasing additional security tools, you can first understand the actual gaps that need attention.
This guide explains what an ISO 27001 gap analysis covers, how the process works, what you can expect from the assessment and what happens after it is completed.
What is an ISO 27001 gap analysis?
An ISO 27001 gap analysis is an assessment of your organisation’s existing information security arrangements against the requirements of ISO/IEC 27001.
ISO/IEC 27001:2022 is the current international standard for Information Security Management Systems. It defines requirements for establishing, implementing, maintaining and continually improving an ISMS.
During a gap analysis, an assessor reviews your current practices and compares them with the standard to identify areas of:
- compliance or alignment
- partial compliance
- missing controls or processes
- insufficient documentation
- inconsistent implementation
- opportunities for improvement.
The assessment does not usually involve certifying your organisation.
Instead, it helps determine how prepared you are for ISO 27001 implementation and eventual certification.
Cyber Forte includes gap assessment as an early stage of its ISO 27001 certification process, using it to benchmark an organisation’s current state and provide recommendations before ISMS implementation begins.
Why conduct an ISO 27001 gap analysis?
Many organisations already have cyber security measures in place before they start their ISO 27001 journey.
You may already use:
- multi-factor authentication
- endpoint security
- access controls
- backups
- cloud security tools
- vulnerability scanning
- staff training
- incident response procedures.
However, having security controls does not automatically mean your organisation meets ISO 27001 requirements.
ISO 27001 focuses on how information security is managed across the organisation. This includes governance, risk management, documentation, responsibilities, monitoring and continual improvement as well as technology.
A gap analysis helps you understand whether your existing controls are part of a structured ISMS or are simply operating independently.
It can also prevent unnecessary work.
For example, you may discover that a required process already exists but needs better documentation rather than complete redevelopment.
When should you conduct a gap analysis?
A gap analysis is usually one of the first activities when preparing for ISO 27001 certification.
It is particularly useful when:
- you are starting your ISO 27001 certification journey
- your organisation already has security controls but no formal ISMS
- you have inherited an existing ISMS and want to review its maturity
- your business has expanded or changed significantly
- you are preparing for an external certification audit
- you have recently adopted ISO/IEC 27001:2022 requirements
- you want to estimate the effort required for certification.
If your organisation is planning to become certified, a gap analysis can provide the baseline needed to build a realistic implementation plan.
You can learn more about the broader process in Cyber Forte’s guide to how to get ISO 27001 certified in Australia.
What does an ISO 27001 gap analysis cover?
The scope of a gap analysis can vary depending on your organisation and where you are in the certification process.
A comprehensive assessment normally looks at both the core ISO 27001 management-system requirements and relevant information security controls.
1. ISMS scope
The assessment will normally start by reviewing the proposed scope of your Information Security Management System.
The scope defines which parts of the organisation, systems, services, locations and processes will be covered.
The assessor may examine whether:
- the scope is clearly defined
- important business processes are included
- dependencies are understood
- interfaces with suppliers are considered
- exclusions are reasonable
- the scope supports your certification objectives.
A poorly defined scope can create problems later in the certification process.
If the scope is too broad, implementation may become unnecessarily complicated. If it is too narrow, the resulting certification may not meet customer or business requirements.
2. Organisational context
ISO 27001 requires organisations to understand the internal and external factors that affect their information security management system.
A gap analysis may therefore review whether your organisation has identified:
- business objectives
- legal obligations
- regulatory requirements
- contractual commitments
- customer security expectations
- relevant interested parties
- internal business dependencies.
This helps ensure that the ISMS is designed around the organisation’s real environment rather than being based on generic templates.
3. Leadership and responsibilities
Information security cannot be managed only by the IT department.
The assessment will normally examine whether senior management is appropriately involved and whether information security responsibilities are clearly defined.
This can include reviewing:
- management commitment
- information security responsibilities
- policy ownership
- approval processes
- reporting lines
- security governance structures.
If responsibilities are unclear, the gap analysis may recommend establishing formal ownership for key ISMS activities.
4. Information security policies
The assessor will review existing policies and procedures to determine whether they support the requirements of the ISMS.
Examples may include:
- information security policy
- access control policy
- acceptable use policy
- incident response procedures
- supplier security policy
- asset management procedures
- backup procedures
- business continuity arrangements
- data handling requirements.
The assessment is not simply checking whether documents exist.
It should also consider whether policies are approved, communicated, reviewed and followed in practice.
Generic policies downloaded from templates may not be sufficient if they do not accurately reflect how your organisation operates.
5. Risk assessment process
Risk management is one of the most important areas reviewed during an ISO 27001 gap analysis.
The organisation needs a consistent method for identifying, analysing, evaluating and treating information security risks.
The assessor may review:
- your risk assessment methodology
- risk criteria
- risk register
- identified threats and vulnerabilities
- likelihood and impact ratings
- risk owners
- treatment decisions
- residual risk.
If your organisation already has an enterprise risk management framework, the assessor may also consider how information security risks fit within it.
The goal is to confirm that security decisions are driven by risk rather than by assumptions or isolated technical decisions.
6. Risk treatment and the Statement of Applicability
A gap analysis will also look at how your organisation responds to identified risks.
You should be able to demonstrate how risks are:
- reduced
- avoided
- transferred
- accepted.
The assessor may review your risk treatment plan and determine whether appropriate actions have been assigned and tracked.
Another important area is the Statement of Applicability, or SoA.
The SoA documents the information security controls determined to be necessary and explains their implementation status and applicability.
If the organisation does not yet have a Statement of Applicability, this will normally be identified as a gap to address during ISMS development.
7. Annex A controls
ISO/IEC 27001:2022 includes 93 Annex A controls divided across four categories:
- organisational controls
- people controls
- physical controls
- technological controls.
A gap analysis may review your current security practices against these areas to understand which controls already exist and where improvements may be required.
The assessment may consider controls relating to:
- identity and access management
- privileged access
- employee security
- supplier relationships
- asset management
- information classification
- physical security
- vulnerability management
- patching
- malware protection
- backups
- encryption
- network security
- logging
- monitoring
- secure development
- incident management.
However, ISO 27001 does not mean every Annex A control must automatically be implemented.
Control selection should be driven by your organisation’s risks and requirements.
8. Asset management
Understanding what needs to be protected is fundamental to effective information security.
The assessor may review whether your organisation maintains appropriate records of:
- hardware
- software
- information assets
- cloud services
- business applications
- data repositories
- third-party systems.
They may also consider whether ownership and responsibility for important assets have been assigned.
Gaps commonly found in this area include incomplete asset registers or unclear ownership of cloud and SaaS systems.
9. People and security awareness
Employees play an important role in the effectiveness of an ISMS.
A gap analysis can review whether your organisation has processes covering:
- security awareness training
- onboarding
- offboarding
- confidentiality obligations
- role changes
- access removal
- disciplinary processes
- security responsibilities.
Training should also be supported by evidence showing that employees have completed relevant awareness activities.
10. Supplier and third-party security
Many organisations depend heavily on external providers.
These may include:
- cloud platforms
- managed service providers
- software vendors
- contractors
- payment providers
- data processors.
The gap analysis may review whether supplier risks are identified and appropriately managed.
This can include assessing supplier due diligence, contractual security requirements, ongoing reviews and offboarding processes.
Third-party risk is often an area where organisations discover significant gaps because suppliers may have been selected primarily on operational or commercial factors rather than security requirements.
11. Incident management
The assessor may examine whether your organisation is prepared to identify, report, respond to and learn from security incidents.
This can involve reviewing:
- incident response plans
- reporting processes
- escalation procedures
- assigned responsibilities
- incident records
- post-incident reviews.
An organisation may already respond effectively to incidents but still have a gap if the process is informal or insufficiently documented.
12. Monitoring and performance measurement
ISO 27001 requires organisations to evaluate whether the ISMS is working effectively.
A gap analysis may therefore review how you monitor information security performance.
This could include:
- security objectives
- key measures
- control monitoring
- risk reviews
- vulnerability results
- incident trends
- audit findings.
The assessor will look for evidence that security performance is being reviewed rather than simply assuming implemented controls remain effective.
13. Internal audit and management review
Internal audits and management reviews are important elements of ISO 27001.
If your organisation has not yet established these processes, they may be identified as implementation gaps.
Internal audits help determine whether the ISMS conforms to requirements and is operating effectively.
Management reviews give senior leadership the opportunity to evaluate ISMS performance, risks, audit findings, security objectives and improvement opportunities.
These activities are particularly important before progressing to an external certification audit.
What happens during an ISO 27001 gap analysis?
The process usually begins with defining the scope of the assessment.
The assessor then gathers information through activities such as:
- interviews with key stakeholders
- document reviews
- workshops
- policy reviews
- examination of security processes
- review of technical and operational controls
- discussions with management and system owners.
You should expect questions about both documented procedures and actual practices.
For example, an assessor may review your access control policy and then ask how user access is approved, reviewed and removed in practice.
This distinction matters because ISO 27001 certification is based on an operational management system, not simply a collection of documents.
What should you prepare before the assessment?
You do not need to have a complete ISMS before conducting a gap analysis.That is often the reason for performing the assessment in the first place.However, gathering existing documentation can make the review more efficient.
Useful information may include:
- existing security policies
- risk registers
- asset registers
- network or system information
- supplier lists
- incident response plans
- business continuity documentation
- security training records
- audit reports
- vulnerability assessments
- access control procedures.
If some of these items do not exist, that is not necessarily a problem. Their absence may simply become one of the gaps identified during the assessment.
What does an ISO 27001 gap analysis report include?
At the end of the assessment, you should receive a clear picture of your current position.
The report may include:
- areas already aligned with ISO 27001
- partial gaps
- missing requirements
- weaknesses in current processes
- recommended remediation actions
- priorities
- implementation considerations.
A useful gap report should not simply list failures.
It should explain what needs to change and give the organisation a practical roadmap towards certification.
Cyber Forte’s current ISO 27001 approach includes a current-state assessment followed by a detailed gap report and recommendations before progressing to ISMS design and implementation.
Is a gap analysis the same as an internal audit?
No.
Although both involve assessing the ISMS, they normally serve different purposes.
A gap analysis is generally performed earlier in the implementation journey to understand what still needs to be developed or improved.
An internal audit is conducted once the ISMS has been implemented and is designed to determine whether it conforms to requirements and operates effectively.
In simple terms:
Gap analysis: What do we still need to build or improve?
Internal audit: Is the implemented ISMS working as intended?
Both can be important steps before certification.
How long does an ISO 27001 gap analysis take?
The timeframe depends on your organisation’s:
- size
- scope
- number of locations
- technology environment
- existing ISMS maturity
- availability of documentation
- complexity of business operations.
A smaller organisation with a clearly defined certification scope may require less assessment effort than a larger organisation operating across multiple locations and business units.
The quality of the analysis is more important than rushing the process.
The objective should be to identify meaningful gaps early enough that they can be addressed before the certification audit.
What happens after the gap analysis?
The gap assessment should become the foundation for your ISO 27001 implementation plan.
Once gaps have been identified, the next steps may include:
- prioritising remediation activities
- developing missing policies and processes
- establishing or improving the risk management framework
- creating the Statement of Applicability
- implementing required controls
- collecting evidence
- training employees
- conducting the internal audit
- completing management review
- preparing for certification.
Cyber Forte’s ISO 27001 certification process follows a similar progression from scope definition and gap assessment through ISMS design, implementation, internal audit and certification audit.
Common mistakes to avoid during a gap analysis
One common mistake is treating the assessment as a pass-or-fail test.
Finding gaps is the purpose of the exercise.
Other mistakes include:
- hiding known security weaknesses
- focusing only on IT controls
- failing to involve business stakeholders
- assessing against generic checklists without considering scope
- confusing a gap analysis with a certification audit
- assuming every Annex A control must be implemented
- ignoring existing processes simply because they are not formally documented.
An effective assessment should provide an accurate picture of your current state, even if that reveals significant work is still required.
Start with a clear view of your ISO 27001 readiness
An ISO 27001 gap analysis gives your organisation a practical starting point for certification.
It shows what you already have, what is missing and where improvements should be prioritised. More importantly, it allows you to approach ISO 27001 implementation based on evidence rather than assumptions.
For Australian organisations, conducting the assessment early can make the certification journey more structured and help reduce unnecessary work later.
Cyber Forte provides end-to-end ISO 27001 certification support in Australia, including scope definition, gap assessment, ISMS development, risk management, implementation support, internal audit and certification readiness.
If your organisation is considering certification, an ISO 27001 gap assessment can help establish where you stand today and what needs to happen next.
