ISO/IEC 27001:2022 Gap Assessment Template (Certification Readiness)
Clause 4 to 10 readiness scoring (0 to 5), Annex A summary by theme (93 controls), gap register with severity, readiness decision and Stage 1 roadmap
Cómo usar: Use it before booking a certification audit or after a major scope change. Fill the scope and method and agree the readiness threshold first, then score each clause against records actually seen. The main pitfall is scoring plans and drafts as implemented, then running out of time for internal audit and management review.
Vista previa
ISO/IEC 27001 Gap Assessment: [Organization name] ISMS
A readiness assessment of an information security management system (ISMS) against ISO/IEC 27001:2022 as amended by Amd 1:2024 (climate action changes), run before a certification audit or a transition. It scores each management system clause from 4 to 10, summarises Annex A control status by theme (93 controls: 37 organizational, 8 people, 14 physical, 34 technological), lists the gaps with owners and dates, and records a readiness decision for booking the Stage 1 audit. Clause numbers are cited by number with labels written for this template; read the requirements in your licensed copy of the standard. Replace every
[bracketed]value and every row marked Example.
Contents
- Scope and method
- Scoring scale
- Clause 4 to 10 assessment
- Annex A summary by theme
- Gap register
- Readiness decision and roadmap
- References
- Standard and licence note
Document control
| Field | Value |
|---|---|
| Document ID | [GAP-ISMS-001] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; control guidance ISO/IEC 27002:2022 |
| Assessment type | [First certification / Transition / Pre-surveillance / Scope extension] |
| Assessment period | YYYY-MM-DD to YYYY-MM-DD |
| Version | [1.0] |
| Status | [Draft / In review / Approved] |
| Owner | [ISMS manager, @name] |
| Assessor(s) | [Internal or external assessor, @name; independence noted] |
| Approvers/reviewers | [CISO, top management sponsor] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Target Stage 1 audit | YYYY-MM-DD |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| Top management sponsor | [@name] | [Approved] | YYYY-MM-DD |
| ISMS manager | [@name] | [Reviewed] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft after interviews |
| 1.0 | YYYY-MM-DD | [@name] | Example: Approved, 15 gaps opened, Stage 1 target moved by eight weeks |
1. Scope and method
| Item | Value |
|---|---|
| Intended ISMS scope | [Scope sentence from compliance/ms-scope] |
| Sites and cloud regions | [List] |
| Evidence methods | [Document review, interviews, sampling of records, technical spot checks] |
| People interviewed | [Roles, not names, if the report is shared] |
| Out of scope for this assessment | [For example penetration testing, supplier audits] |
| Limitations | [Time, access, sampling depth] |
Example: Lumenreach Software Ltd intends to certify "the development, operation and support of the Lumenreach scheduling platform from its London office and two cloud regions". Evidence came from 14 interviews, review of 31 documents and sampling of access reviews, change tickets and incident records for the last three months.
2. Scoring scale
| Score | Label | Meaning |
|---|---|---|
| 0 | Absent | Nothing exists |
| 1 | Initial | Ad hoc practice, no documented approach |
| 2 | Defined | Documented but not yet operating, or operating without records |
| 3 | Implemented | Operating, with records an auditor can sample |
| 4 | Effective | Operating for at least one full cycle, with measured results |
| 5 | Improving | Results reviewed and acted on, improvements recorded |
Readiness threshold for booking Stage 1: every clause scores 3 or more, no mandatory documented information is missing, and at least one full cycle of internal audit (9.2) and management review (9.3) is complete. Certification bodies expect the ISMS to have operated before Stage 2; confirm the evidence period they need when you book.
3. Clause 4 to 10 assessment
| Clause | Topic (label for this template) | Score | Evidence seen | Gap | Gap ID |
|---|---|---|---|---|---|
| 4.1 (Example) | Context, including whether climate change is relevant | 3 | Context register v1.2, climate decision recorded | None | |
| 4.2 (Example) | Interested parties and their requirements | 3 | Interested parties table v1.0 | Contract requirements from two key customers not yet added | GAP-01 |
| 4.3 (Example) | Scope | 4 | Scope statement v1.1 approved | None | |
| 4.4 (Example) | ISMS and its processes | 3 | Process map | None | |
| 5.1 (Example) | Leadership and commitment | 3 | Board minutes approving ISMS budget | None | |
| 5.2 (Example) | Information security policy | 4 | Policy v2.0, communicated in onboarding | None | |
| 5.3 (Example) | Roles, responsibilities and authorities | 2 | Draft RACI | RACI not approved or communicated | GAP-02 |
| 6.1.1 (Example) | Actions to address risks and opportunities | 3 | Risk methodology v1.0 | None | |
| 6.1.2 (Example) | Risk assessment | 3 | Risk register, 64 risks | None | |
| 6.1.3 (Example) | Risk treatment and statement of applicability | 2 | Draft SoA | SoA not approved, 9 controls without justification | GAP-03 |
| 6.2 (Example) | Objectives and planning to achieve them | 2 | Objectives drafted | No measures or owners | GAP-04 |
| 6.3 (Example) | Planning of changes | 1 | None | No way to plan changes to the ISMS itself | GAP-05 |
| 7.1 (Example) | Resources | 3 | Budget line, ISMS manager appointed | None | |
| 7.2 (Example) | Competence | 3 | Training matrix | None | |
| 7.3 (Example) | Awareness | 2 | Awareness slides | No completion records for contractors | GAP-06 |
| 7.4 (Example) | Communication | 3 | Communication plan | None | |
| 7.5 (Example) | Documented information | 3 | Document control procedure | None | |
| 8.1 (Example) | Operational planning and control | 3 | Change tickets sampled | None | |
| 8.2 (Example) | Performing risk assessments at planned intervals | 3 | Quarterly risk review minutes | None | |
| 8.3 (Example) | Implementing risk treatment | 2 | Treatment plan | 7 of 18 actions overdue | GAP-07 |
| 9.1 (Example) | Monitoring, measurement, analysis and evaluation | 1 | Ad hoc dashboards | No defined metrics or methods | GAP-08 |
| 9.2 (Example) | Internal audit | 0 | None | No programme, no audit performed | GAP-09 |
| 9.3 (Example) | Management review | 0 | None | No review held | GAP-10 |
| 10.1 (Example) | Continual improvement | 2 | Improvement ideas list | Not linked to results | GAP-11 |
| 10.2 (Example) | Nonconformity and corrective action | 2 | Incident tickets | No root cause or effectiveness check | GAP-12 |
| [Clause] | [Topic] | [0 to 5] | [Record] | [Gap] | [GAP-nn] |
3.1 Clause score summary
| Clause group | Rows | Total score | Average | Rows below 3 |
|---|---|---|---|---|
| 4 Context (Example) | 4 | 13 | 3.25 | 0 |
| 5 Leadership (Example) | 3 | 9 | 3.00 | 1 |
| 6 Planning (Example) | 5 | 11 | 2.20 | 3 |
| 7 Support (Example) | 5 | 14 | 2.80 | 1 |
| 8 Operation (Example) | 3 | 8 | 2.67 | 1 |
| 9 Performance evaluation (Example) | 3 | 1 | 0.33 | 3 |
| 10 Improvement (Example) | 2 | 4 | 2.00 | 2 |
| All clauses (Example) | 25 | 60 | 2.40 | 11 |
In the example, 11 of 25 rows are below the threshold and four rows (6.3, 9.1, 9.2, 9.3) score 1 or less. Performance evaluation is the critical path, because an internal audit and a management review need time to plan and run.
4. Annex A summary by theme
| Theme (Annex A) | Controls | Implemented | Partial | Not implemented | Not applicable | Applicable | Readiness % |
|---|---|---|---|---|---|---|---|
| 5 Organizational (Example) | 37 | 22 | 9 | 4 | 2 | 35 | 75.7 |
| 6 People (Example) | 8 | 6 | 2 | 0 | 0 | 8 | 87.5 |
| 7 Physical (Example) | 14 | 8 | 2 | 1 | 3 | 11 | 81.8 |
| 8 Technological (Example) | 34 | 20 | 8 | 5 | 1 | 33 | 72.7 |
| Total (Example) | 93 | 56 | 21 | 10 | 6 | 87 | 76.4 |
Readiness % = (Implemented + 0.5 x Partial) / Applicable x 100.
Controls not implemented or partial that drive the most risk in the example (labels written for this template):
| Control | Short label | Status | Linked risk | Gap ID |
|---|---|---|---|---|
| 5.7 (Example) | Threat intelligence | Not implemented | R-014 | GAP-13 |
| 5.23 (Example) | Security for cloud services use | Partial | R-022 | GAP-14 |
| 8.16 (Example) | Monitoring activities | Partial | R-031 | GAP-15 |
| [Control] | [Label] | [Status] | [R-nnn] | [GAP-nn] |
Each excluded control needs a justification in the SoA, and each included control needs a reason: a risk, a legal or contractual requirement, or a business decision.
5. Gap register
| Gap ID | Clause or control | Description | Severity | Action | Owner | Due | Status |
|---|---|---|---|---|---|---|---|
| GAP-03 (Example) | 6.1.3 | SoA not approved, 9 controls lack justification | Major | Complete justifications, approve SoA | [@ciso] | YYYY-MM-DD | Open |
| GAP-05 (Example) | 6.3 | No change planning for the ISMS | Major | Add ISMS change step to the change procedure | [@isms-manager] | YYYY-MM-DD | Open |
| GAP-08 (Example) | 9.1 | No defined metrics | Major | Define 8 metrics with method, frequency, owner | [@isms-manager] | YYYY-MM-DD | Open |
| GAP-09 (Example) | 9.2 | No internal audit | Major | Approve programme, audit all clauses and applicable controls once | [@internal-auditor] | YYYY-MM-DD | Open |
| GAP-10 (Example) | 9.3 | No management review | Major | Hold review with all required inputs after the audit | [@ceo] | YYYY-MM-DD | Open |
| GAP-07 (Example) | 8.3 | Overdue treatment actions | Minor | Re-plan 7 actions, report monthly | [@ciso] | YYYY-MM-DD | Open |
| [GAP-nn] | [Ref] | [Description] | [Major / Minor / Observation] | [Action] | [@owner] | YYYY-MM-DD | [Status] |
6. Readiness decision and roadmap
| Question | Answer |
|---|---|
| Threshold met today? | [Yes / No] Example: No, 11 rows below 3 |
| Major gaps open | [n] Example: 5 |
| Earliest realistic Stage 1 date | YYYY-MM-DD |
| Decision | [Book Stage 1 / Re-assess on YYYY-MM-DD] |
| Decided by | [@sponsor], YYYY-MM-DD |
Questions to settle with the certification body before booking: the evidence period they expect before Stage 2, how they sample multiple sites or cloud regions, and whether your scope sentence is acceptable as written.
7. References
| Reference | Edition or date | Use |
|---|---|---|
| ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements | Third edition, October 2022 | Clauses 4 to 10, Annex A |
| ISO/IEC 27001:2022/Amd 1:2024, Climate action changes | February 2024 | Clauses 4.1 and 4.2; no Annex A change |
| ISO/IEC 27002:2022 | Third edition, 2022 | Control guidance |
| IAF MD 26:2023, Transition requirements for ISO/IEC 27001:2022 | Issue 2, February 2023 | Transition ended 31 October 2025; certificates to the 2013 edition are no longer valid |
| Certification body rules (ISO/IEC 17021-1 and ISO/IEC 27006-1) | Check current editions | Stage 1 and Stage 2 audit practice |
Standard and licence note
Structure aligned with ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements (third edition), as amended by Amd 1:2024. Clause and control numbers are cited; topic labels, the scoring scale, the readiness formula and all guidance are original text written for this collection and reproduce no wording, tables or definitions from the standard. The worked example is fictional. Check the ISO catalogue for any later amendment or edition and read the requirements in your licensed copy before relying on this assessment.
Official text: ISO and IEC, purchase or licensed access: https://www.iso.org/standard/82875.html (ISO/IEC 27002:2022: https://www.iso.org/standard/75652.html), also available from national standards bodies.
Template licence: MIT.
Plantillas relacionadas
AML Business-Wide Risk Assessment Template (ML/TF/PF)
Enterprise-wide ML/TF/PF and sanctions evasion risk assessment: method, inputs, inherent risk by area, control ratings, residual risk, appetite, actions
ISO y cumplimientoCCPA Risk Assessment and Cybersecurity Audit Template
CCPA risk assessment and cybersecurity audit record: 7150 screening, 7152 report, ADMT, 45-day updates, Agency submission, audit scope, report and certification
ISO y cumplimientoData Residency and Sovereignty Assessment Template (GDPR Chapter V)
Data tiers, flow map, jurisdiction matrix, Chapter V mechanisms, TIAs, PIPL and DPDP examples, Data Act Art. 32, key custody, sovereign cloud scoring, decision