The short answer
An ISO 27001 gap analysis compares how you manage information security today with every requirement of ISO/IEC 27001:2022: the mandatory clauses 4 to 10 and the 93 Annex A controls. You get a scored gap register, a risk-ranked remediation roadmap and an effort estimate, so you know what stands between you and certification.
On this page
- What does an ISO 27001 gap analysis cover?
- How do you perform an ISO 27001 gap analysis?
- What do you get from the gap analysis?
- Gap analysis vs internal audit vs Stage 1 audit
- How much does an ISO 27001 gap analysis cost?
- Free ISO 27001 gap analysis template
- Can the gap analysis cover UK GDPR?
- From gap analysis to ISO 27001 certification
- Why Sovereign Secure
- Get a fixed quote for your gap analysis
An ISO 27001 gap analysis measures your current information security practices against every requirement of ISO/IEC 27001:2022, then shows what is missing, how serious each gap is and what it will take to close it. It turns “we need ISO 27001” into a scoped, prioritised plan with realistic effort attached.
Sovereign Secure Ltd is an ISO 27001-certified UK consultancy, a PCI SSC-approved QSA company and an IASME-licensed Cyber Essentials certification body. We carry out the gap analysis. Certification audits are carried out independently by our partner certification body, MQA International.
What does an ISO 27001 gap analysis cover?
It covers the whole of ISO/IEC 27001:2022: the seven management system clauses (4 to 10) and the 93 Annex A controls. A controls-only review misses the clauses, which are what a certification auditor tests first.
| Clause | What we check | Where organisations often fall short |
|---|---|---|
| 4 Context | ISMS scope, interested parties, internal and external issues, and whether climate change is relevant (added by Amendment 1 in 2024) | Scope too vague, or missing the services customers care about |
| 5 Leadership | Security policy, top management commitment, roles and responsibilities | Policy approved but never communicated; no named ISMS owner |
| 6 Planning | Risk assessment and treatment method, risk acceptance criteria, Statement of Applicability, objectives | Risk register exists but is not linked to control choices |
| 7 Support | Resources, competence, awareness, communication, document control | No records of staff awareness or training |
| 8 Operation | Risk assessments at planned intervals, treatment plan delivered, outsourced processes controlled | Treatment plan with no owners or dates |
| 9 Performance evaluation | Monitoring and measurement, internal audit, management review | No internal audit or management review yet, though both are needed before certification |
| 10 Improvement | Nonconformities, corrective action, continual improvement | Incidents fixed, but root causes never recorded |
If clause 6 is your weakest area, start with our free ISO 27001 risk assessment template and its worked examples.
Annex A is assessed control by control across the four 2022 themes:
| Annex A theme | Controls | Examples we test |
|---|---|---|
| Organisational (5.1 to 5.37) | 37 | Asset inventory, supplier security, threat intelligence (5.7), cloud services (5.23), privacy and PII (5.34) |
| People (6.1 to 6.8) | 8 | Screening, terms of employment, awareness training, remote working |
| Physical (7.1 to 7.14) | 14 | Secure areas, physical security monitoring (7.4), secure disposal of equipment |
| Technological (8.1 to 8.34) | 34 | Access control, logging, vulnerability management (8.8), configuration management (8.9), secure coding (8.28), security testing in development and acceptance (8.29) |
If your last review was against ISO 27001:2013 (114 controls in 14 domains), it is out of date: the transition period for 2013 certificates ended on 31 October 2025.
How do you perform an ISO 27001 gap analysis?
Our ISO 27001 assessment combines document review, interviews and evidence sampling, so every rating rests on something we have seen, not a yes/no questionnaire answer.
- Scoping call. We agree the ISMS boundary (entities, sites, teams, systems and cloud services) and your target date.
- Document request. You share what exists today: policies, risk register, asset lists, supplier contracts and previous audit or test reports.
- Interviews and walkthroughs. Short sessions with leadership, IT, HR, facilities and process owners, remote or on site.
- Evidence sampling. We test records such as joiners and leavers, access reviews, patching, backups and incidents to confirm controls work as described.
- Scoring and roadmap. Every requirement is rated, and each gap is ranked by risk and effort.
- Read-out. We present the findings to leadership and agree next steps.
What do you get from the gap analysis?
- Gap register covering clauses 4 to 10 and all 93 Annex A controls, each rated met, partially met, not met or not applicable, with the evidence seen.
- Readiness score by clause and Annex A theme, to re-measure progress later.
- Risk-ranked remediation roadmap with suggested owners, sequencing and quick wins.
- Effort estimate for internal time and external support, to back your budget case.
- Draft Statement of Applicability position for each control.
- Executive summary for your board or a customer’s procurement team.
Sample report extract
| Ref | Requirement | Finding | Rating | Priority |
|---|---|---|---|---|
| 6.1.2 | Risk assessment process | Risk register held by IT only; no criteria for accepting risk | Partially met | High |
| 9.2 | Internal audit | No audit programme and no completed audit | Not met | High |
| 5.23 | Cloud services security | Main SaaS platforms listed, but no security requirements for adopting new ones | Partially met | Medium |
| 8.8 | Technical vulnerabilities | Monthly patching evidenced; no independent testing of internet-facing systems | Partially met | Medium |
Illustrative example of the report format, not client data.
Gap analysis vs internal audit vs Stage 1 audit
A gap analysis is advisory and comes first; an internal audit is a mandatory check once your ISMS runs; Stage 1 starts certification.
| Aspect | Gap analysis | Internal audit | Stage 1 audit |
|---|---|---|---|
| When | Before or early in implementation | After implementation, then at planned intervals | Start of certification |
| Who | Consultant or in-house team | Competent auditor, independent of the work audited | Certification body |
| Required? | No, but strongly recommended | Yes, by ISO 27001 (clause 9.2) | Yes, by certification body rules (not by ISO 27001 itself) |
| Advice on fixes? | Yes, that is the purpose | Findings and opportunities for improvement | No: certification bodies must stay impartial |
| Output | Gap register and roadmap | Audit report and nonconformities | Stage 1 report and readiness for Stage 2 |
Once your ISMS is running, our ISO 27001 internal audit checks it before certification.
How much does an ISO 27001 gap analysis cost?
The price depends on the number of assessment days, which depends on your scope. We give a fixed quote after a short scoping call, based on the scope agreed there. For context, ISO 27001 consultant day rates published by UK providers we reviewed in September 2026 ranged from £400 to £1,000.
| Cost driver | Why it changes the effort |
|---|---|
| People in scope | More teams to interview and more records to sample |
| Sites and legal entities | Locations may need walkthroughs; multi-entity scopes need clear boundaries |
| Systems and cloud platforms | Hybrid and multi-cloud estates mean more technical controls to evidence |
| Existing frameworks | Cyber Essentials or PCI DSS evidence can be reused, shortening fieldwork |
| UK GDPR extension | Adds personal-data controls to the review |
For total spend, including audit fees and surveillance, see ISO 27001 certification cost.
Free ISO 27001 gap analysis template
Download the free ISO 27001 gap analysis template (.xlsx). It lists the 25 sub-clauses of clauses 4 to 10 and all 93 Annex A controls, with columns for a 0 to 3 score, the evidence you have, the gap, a priority, an owner and a target date. A summary sheet turns your scores into a readiness percentage by clause and by Annex A theme, so you can re-score later and show progress.
A template is a sensible first pass. Our guides to the ISO 27001 requirements and the Annex A controls explain each line, and the ISO 27001 checklist adds the Stage 1 and Stage 2 audit checks. The limit is evidence: internal teams tend to mark a control “done” when a policy exists, while an auditor asks for proof that it operates.
Free template or assessed gap analysis?
| Your situation | Free template | Assessed gap analysis |
|---|---|---|
| An experienced security lead has time to run it | Usually enough to start | Worth it later, to validate before Stage 1 |
| You need a budget or a board decision | Gives a rough picture | Adds an effort estimate and a risk-ranked roadmap to back the case |
| A customer or tender deadline is fixed | Risky, because gaps can surface late | Sets a realistic certification date early |
| Nobody in-house can judge the evidence objectively | Scores tend to be optimistic | Evidence is sampled independently, as an auditor would |
| Your documents were written for ISO 27001:2013 | Shows which controls changed | Checks whether old evidence still holds against the 2022 controls |
| You want UK GDPR covered in the same review | Not covered | Can be included |
Self-assess first, then validate with an assessed gap analysis before committing budget.
Can the gap analysis cover UK GDPR?
Yes. Where you process personal data, we map gaps against UK GDPR security and accountability requirements alongside Annex A control 5.34 (privacy and protection of PII). It suits organisations facing customer due-diligence questionnaires on both, or considering ISO/IEC 27701 for privacy information management.
From gap analysis to ISO 27001 certification
Gap analysis to certificate is usually measured in months rather than weeks. How long depends on the size of the gaps, the resources you commit and how quickly decisions are made, and your roadmap gives a realistic target date.
| Step | What happens | Who |
|---|---|---|
| 1. Gap analysis | Current state measured, roadmap agreed | Sovereign Secure |
| 2. Scope, risk and SoA | Risk assessment, treatment plan, Statement of Applicability | You, with our support |
| 3. Implement | Policies, controls, training and records put in place | You, with our support |
| 4. Internal audit and management review | Mandatory checks under clauses 9.2 and 9.3 | Sovereign Secure or your own auditor |
| 5. Stage 1 and Stage 2 audits | Documentation review, then implementation audit | MQA International |
| 6. Surveillance | Annual audits in years two and three, then recertification | MQA International |
Our ISO 27001 implementation plan sets out each step and typical timelines in detail. Our ISO 27001 consultancy covers every step, or you can take the roadmap and run it yourselves.
Why Sovereign Secure
- We hold ISO 27001 ourselves, so we know what certification auditors ask for.
- One set of evidence for several standards. As a PCI QSA company and IASME Cyber Essentials certification body, we map ISO 27001 controls to PCI DSS, Cyber Essentials and UK GDPR. See how the schemes compare in Cyber Essentials vs ISO 27001.
- Testing from one provider. Our penetration testing and vulnerability scanning can provide evidence for Annex A 8.8 (technical vulnerabilities) and 8.29 (security testing) where the roadmap calls for it. Read whether ISO 27001 requires penetration testing.
- UK company since 2012, headquartered in Accrington, Lancashire (Companies House 08334453), with offices in Los Angeles, Singapore, Dubai and Dhaka.
Get a fixed quote for your gap analysis
Tell us roughly how many people, sites and key systems are in scope, and your target certification date. We will confirm the assessment days and send a fixed quote. Request a quote or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
