ISO/IEC 27001 gap analysis
An ISO/IEC 27001 gap analysis shows how far your information security management system (ISMS) is from certification. This guide covers the management clauses and the Annex A controls, with a free checklist and tool.
01What the standard requires
ISO/IEC 27001:2022 has two parts to assess. Clauses 4 to 10 set the management system requirements: scope, leadership, risk assessment and treatment, support, operation, monitoring and improvement. Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). You decide which controls apply in your Statement of Applicability (SoA).
A 2024 amendment added a requirement to consider whether climate change is a relevant issue in your context (clause 4.1) and for interested parties (4.2).
02How to run the gap analysis
- Agree the ISMS scope and boundaries.
- Check each clause 4–10 requirement and rate it, with evidence.
- Review your risk assessment method and whether a current risk register exists.
- Go through the Annex A controls and draft or update the SoA.
- Turn gaps into a prioritised treatment plan with owners and dates.
03Common gaps
- 6.1.2–6.1.3: no repeatable risk assessment, or risks not linked to controls.
- SoA missing justifications for excluded controls.
- 7.5: documented information not controlled.
- 9.2–9.3: no internal audit programme or management review.
- Annex A 5.23 (cloud services) and 8.28 (secure coding), both added in the 2022 edition, not addressed.
04Why a private tool matters here
A security gap analysis is itself sensitive: it lists your weaknesses. Paperwing’s gap assessment runs in your browser and stores everything locally, so your findings are never uploaded. You can export the report and an encrypted backup.
Frequently asked questions
Does the checklist include Annex A?
Both the checklist and the online tool cover clauses 4–10 and the four Annex A themes. For control-by-control detail, work through your Statement of Applicability.
How many controls are in Annex A?
93 in the 2022 edition, down from 114 in 2013.
Is ISO 27001 certification mandatory?
Not generally, but customers and contracts increasingly ask for it.