A customer asks whether your business has ISO 27001 certification. A tender mentions an information security management system. Someone suggests buying a set of policies so you can get started.
Our recommendation is to establish your starting position first. Before committing to a certification date or a library of documents, find out which arrangements are already working, which requirements are missing and what evidence supports the answers.
An ISO 27001 gap analysis gives that work a structure. Done properly, it leaves a small business with a prioritised plan, clear responsibilities and a realistic understanding of the effort ahead.
What is an ISO 27001 gap analysis?
A gap analysis compares your existing information security arrangements with the requirements of ISO/IEC 27001. It identifies what is in place, what is incomplete and what still needs to be established.
ISO/IEC 27001:2022 sets requirements for an information security management system, usually shortened to ISMS. In plain English, this is the way your organisation identifies information security risks, decides how to handle them and checks that its arrangements remain effective.
The review therefore goes beyond antivirus, firewalls and Microsoft 365 settings. It includes management decisions, responsibilities, people, suppliers and the way security is maintained as the business changes.
Our view: a policy is a claim that needs supporting evidence
A policy can say that departing employees lose access promptly. That statement is useful, but it does not establish what happens when someone actually leaves.
A gap analysis should follow the process through: how the departure is reported, which systems are checked, who removes access and what record confirms completion.
The same reasoning applies to backups. A document saying “backups are tested” needs supporting records of the tests, their results and the handling of any failures. Our article on Microsoft 365 backup explains what a meaningful restore test looks like.
We would treat a mismatch between a written procedure and day-to-day practice as a priority finding. It gives management false confidence and leaves staff following an arrangement the business cannot demonstrate.
The answer is not automatically another policy. It could be a clearer responsibility, a simpler workflow or an existing control that needs consistent operation.
Agree the scope before assessing the gaps
Define which services, teams, locations and information are included. Identify the suppliers and shared systems those activities rely on.
For a small consultancy, that could mean client delivery, business email, shared documents and the laptops used to access them. For a software company, development, hosting and customer support introduce different dependencies.
Scope needs to reflect the service the customer expects assurance about. We would challenge a proposal that excludes a critical shared system simply because reviewing it looks inconvenient.
A boundary on paper does not remove a real dependency. The assessment needs to explain how that dependency is managed.
What should the assessment cover?
A useful review examines both the management system and the security controls selected to address the organisation's risks.
| Area | What the assessment needs to establish |
|---|---|
| Leadership and responsibilities | Who makes security decisions and provides the resources to carry them out |
| Risk assessment and treatment | How risks are identified, evaluated, assigned and addressed |
| Information and systems | What the business needs to protect and who is responsible for it |
| People and access | How access is authorised, reviewed and removed |
| Suppliers and cloud services | How important dependencies and security responsibilities are managed |
| Operational security | What supports secure configuration, updates, backups and incident handling |
| Performance and improvement | How the business reviews effectiveness, audits its arrangements and follows up problems |
These headings guide the investigation. They do not replace assessment against the current standard and its applicable requirements.
Understand the Statement of Applicability
The Statement of Applicability records the necessary controls, why they are included, whether they are implemented, and the justification for excluding controls from Annex A. Annex A provides a reference set of controls to check against when deciding what the organisation needs.
Its purpose is to make the control decisions explainable. It should connect the business's risks and requirements to the protections it has chosen.
For example, using a cloud hosting supplier does not remove your responsibility to understand how that service supports your security needs. Some activities are carried out by the supplier; the business still needs a defensible decision about the arrangement.
Distinguish a missing control from missing evidence
These lead to different actions. If access reviews never happen, the business needs a process and an owner. If they happen but no results are retained, the evidence and record-keeping need improvement.
A third possibility is an ineffective control: access is reviewed, but the reviewer receives an incomplete user list. Producing more records of the same weak review will not resolve that problem.
A useful finding explains what was examined, what is missing, why it matters and what would demonstrate that the action is complete. Findings based on interviews alone should be distinguishable from those supported by records or technical checks.
What should the gap analysis report deliver?
You should receive more than a percentage score. A single total can hide a serious exposure among many low-impact items.
We would expect the report to provide:
- A plain-English summary for the business owner or management team.
- Findings linked to the relevant requirements or control decisions.
- The evidence reviewed and any assessment limitations.
- A distinction between absent, incomplete and ineffective arrangements.
- Prioritised actions with responsible owners and completion evidence.
- A roadmap showing dependencies and work needed before the next review.
Priorities should reflect business risk as well as certification preparation. An exposed administrator account needs attention even while the wider ISMS documentation is being developed.
Is a gap analysis the same as an internal audit or certification?
No. A gap analysis is typically used to establish the starting position and plan improvements. An internal audit is a planned, objective evaluation of the management system against defined criteria. It is part of maintaining the ISMS.
Certification is a separate assessment by a certification body. A consultancy's gap report does not award certification or guarantee the outcome of a later audit. For UKAS-accredited certification, verify that the certification body's accreditation covers ISO/IEC 27001.
If your business already holds Cyber Essentials, retain and reuse relevant evidence. It is useful groundwork, but it does not establish conformity with the wider ISO 27001 management-system requirements. Our guide on whether Cyber Essentials is worth it explains what that scheme covers.
What affects the cost of an ISO 27001 gap analysis?
The scope, number of locations, systems, suppliers and depth of evidence review determine the work. A document-only review and an assessment that includes interviews and technical sampling are different engagements.
A quotation should state what will be examined, what access and documents are required, what the report includes and whether a findings meeting is included. Implementation, internal auditing and certification fees should be identified separately.
Define those deliverables before comparing prices. A low-cost checklist with no supporting investigation gives you little basis for budgeting the work ahead.
Further reading: ISO's overview of ISO/IEC 27001 and UKAS information security accreditation.
Need an ISO 27001 gap analysis for your business?
Montalex offers practical information security consultancy for UK small businesses. We can scope an ISO 27001 gap analysis around your business, review the agreed evidence and provide a prioritised improvement plan. Tell us what is driving your ISO 27001 requirement, including any customer request or tender deadline, so we can quote for the assessment you need.
Tell us about your ISO 27001 requirement