ISO/IEC 27001:2022 Gap Assessment Template (Certification Readiness)

Clause 4 to 10 readiness scoring (0 to 5), Annex A summary by theme (93 controls), gap register with severity, readiness decision and Stage 1 roadmap

ISO & KepatuhanStandarISO/IEC 27001:2022 + Amd 1:2024 (cited only)iso 27001 gap assessmentDiperbarui 29 Okt 2026

Buka di editorUnduh .md

Cara menggunakan: Use it before booking a certification audit or after a major scope change. Fill the scope and method and agree the readiness threshold first, then score each clause against records actually seen. The main pitfall is scoring plans and drafts as implemented, then running out of time for internal audit and management review.

Pratinjau

ISO/IEC 27001 Gap Assessment: [Organization name] ISMS

A readiness assessment of an information security management system (ISMS) against ISO/IEC 27001:2022 as amended by Amd 1:2024 (climate action changes), run before a certification audit or a transition. It scores each management system clause from 4 to 10, summarises Annex A control status by theme (93 controls: 37 organizational, 8 people, 14 physical, 34 technological), lists the gaps with owners and dates, and records a readiness decision for booking the Stage 1 audit. Clause numbers are cited by number with labels written for this template; read the requirements in your licensed copy of the standard. Replace every [bracketed] value and every row marked Example.

Scope and method
Scoring scale
Clause 4 to 10 assessment
Annex A summary by theme
Gap register
Readiness decision and roadmap
References
Standard and licence note

Document control

Field	Value
Document ID	[GAP-ISMS-001]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024; control guidance ISO/IEC 27002:2022
Assessment type	[First certification / Transition / Pre-surveillance / Scope extension]
Assessment period	YYYY-MM-DD to YYYY-MM-DD
Version	[1.0]
Status	[Draft / In review / Approved]
Owner	[ISMS manager, @name]
Assessor(s)	[Internal or external assessor, @name; independence noted]
Approvers/reviewers	[CISO, top management sponsor]
Last updated	YYYY-MM-DD
Classification	[Confidential]
Target Stage 1 audit	YYYY-MM-DD

Approvals

Role	Name	Decision	Date
Top management sponsor	[@name]	[Approved]	YYYY-MM-DD
ISMS manager	[@name]	[Reviewed]	YYYY-MM-DD

Revision history

Version	Date	Author	Change summary
0.1	YYYY-MM-DD	[@name]	First draft after interviews
1.0	YYYY-MM-DD	[@name]	Example: Approved, 15 gaps opened, Stage 1 target moved by eight weeks

1. Scope and method

Item	Value
Intended ISMS scope	[Scope sentence from `compliance/ms-scope`]
Sites and cloud regions	[List]
Evidence methods	[Document review, interviews, sampling of records, technical spot checks]
People interviewed	[Roles, not names, if the report is shared]
Out of scope for this assessment	[For example penetration testing, supplier audits]
Limitations	[Time, access, sampling depth]

Example: Lumenreach Software Ltd intends to certify "the development, operation and support of the Lumenreach scheduling platform from its London office and two cloud regions". Evidence came from 14 interviews, review of 31 documents and sampling of access reviews, change tickets and incident records for the last three months.

2. Scoring scale

Score	Label	Meaning
0	Absent	Nothing exists
1	Initial	Ad hoc practice, no documented approach
2	Defined	Documented but not yet operating, or operating without records
3	Implemented	Operating, with records an auditor can sample
4	Effective	Operating for at least one full cycle, with measured results
5	Improving	Results reviewed and acted on, improvements recorded

Readiness threshold for booking Stage 1: every clause scores 3 or more, no mandatory documented information is missing, and at least one full cycle of internal audit (9.2) and management review (9.3) is complete. Certification bodies expect the ISMS to have operated before Stage 2; confirm the evidence period they need when you book.

3. Clause 4 to 10 assessment

Clause	Topic (label for this template)	Score	Evidence seen	Gap	Gap ID
4.1 (Example)	Context, including whether climate change is relevant	3	Context register v1.2, climate decision recorded	None
4.2 (Example)	Interested parties and their requirements	3	Interested parties table v1.0	Contract requirements from two key customers not yet added	GAP-01
4.3 (Example)	Scope	4	Scope statement v1.1 approved	None
4.4 (Example)	ISMS and its processes	3	Process map	None
5.1 (Example)	Leadership and commitment	3	Board minutes approving ISMS budget	None
5.2 (Example)	Information security policy	4	Policy v2.0, communicated in onboarding	None
5.3 (Example)	Roles, responsibilities and authorities	2	Draft RACI	RACI not approved or communicated	GAP-02
6.1.1 (Example)	Actions to address risks and opportunities	3	Risk methodology v1.0	None
6.1.2 (Example)	Risk assessment	3	Risk register, 64 risks	None
6.1.3 (Example)	Risk treatment and statement of applicability	2	Draft SoA	SoA not approved, 9 controls without justification	GAP-03
6.2 (Example)	Objectives and planning to achieve them	2	Objectives drafted	No measures or owners	GAP-04
6.3 (Example)	Planning of changes	1	None	No way to plan changes to the ISMS itself	GAP-05
7.1 (Example)	Resources	3	Budget line, ISMS manager appointed	None
7.2 (Example)	Competence	3	Training matrix	None
7.3 (Example)	Awareness	2	Awareness slides	No completion records for contractors	GAP-06
7.4 (Example)	Communication	3	Communication plan	None
7.5 (Example)	Documented information	3	Document control procedure	None
8.1 (Example)	Operational planning and control	3	Change tickets sampled	None
8.2 (Example)	Performing risk assessments at planned intervals	3	Quarterly risk review minutes	None
8.3 (Example)	Implementing risk treatment	2	Treatment plan	7 of 18 actions overdue	GAP-07
9.1 (Example)	Monitoring, measurement, analysis and evaluation	1	Ad hoc dashboards	No defined metrics or methods	GAP-08
9.2 (Example)	Internal audit	0	None	No programme, no audit performed	GAP-09
9.3 (Example)	Management review	0	None	No review held	GAP-10
10.1 (Example)	Continual improvement	2	Improvement ideas list	Not linked to results	GAP-11
10.2 (Example)	Nonconformity and corrective action	2	Incident tickets	No root cause or effectiveness check	GAP-12
[Clause]	[Topic]	[0 to 5]	[Record]	[Gap]	[GAP-nn]

3.1 Clause score summary

Clause group	Rows	Total score	Average	Rows below 3
4 Context (Example)	4	13	3.25	0
5 Leadership (Example)	3	9	3.00	1
6 Planning (Example)	5	11	2.20	3
7 Support (Example)	5	14	2.80	1
8 Operation (Example)	3	8	2.67	1
9 Performance evaluation (Example)	3	1	0.33	3
10 Improvement (Example)	2	4	2.00	2
All clauses (Example)	25	60	2.40	11

In the example, 11 of 25 rows are below the threshold and four rows (6.3, 9.1, 9.2, 9.3) score 1 or less. Performance evaluation is the critical path, because an internal audit and a management review need time to plan and run.

4. Annex A summary by theme

Theme (Annex A)	Controls	Implemented	Partial	Not implemented	Not applicable	Applicable	Readiness %
5 Organizational (Example)	37	22	9	4	2	35	75.7
6 People (Example)	8	6	2	0	0	8	87.5
7 Physical (Example)	14	8	2	1	3	11	81.8
8 Technological (Example)	34	20	8	5	1	33	72.7
Total (Example)	93	56	21	10	6	87	76.4

Readiness % = (Implemented + 0.5 x Partial) / Applicable x 100.

Controls not implemented or partial that drive the most risk in the example (labels written for this template):

Control	Short label	Status	Linked risk	Gap ID
5.7 (Example)	Threat intelligence	Not implemented	R-014	GAP-13
5.23 (Example)	Security for cloud services use	Partial	R-022	GAP-14
8.16 (Example)	Monitoring activities	Partial	R-031	GAP-15
[Control]	[Label]	[Status]	[R-nnn]	[GAP-nn]

Each excluded control needs a justification in the SoA, and each included control needs a reason: a risk, a legal or contractual requirement, or a business decision.

5. Gap register

Gap ID	Clause or control	Description	Severity	Action	Owner	Due	Status
GAP-03 (Example)	6.1.3	SoA not approved, 9 controls lack justification	Major	Complete justifications, approve SoA	[@ciso]	YYYY-MM-DD	Open
GAP-05 (Example)	6.3	No change planning for the ISMS	Major	Add ISMS change step to the change procedure	[@isms-manager]	YYYY-MM-DD	Open
GAP-08 (Example)	9.1	No defined metrics	Major	Define 8 metrics with method, frequency, owner	[@isms-manager]	YYYY-MM-DD	Open
GAP-09 (Example)	9.2	No internal audit	Major	Approve programme, audit all clauses and applicable controls once	[@internal-auditor]	YYYY-MM-DD	Open
GAP-10 (Example)	9.3	No management review	Major	Hold review with all required inputs after the audit	[@ceo]	YYYY-MM-DD	Open
GAP-07 (Example)	8.3	Overdue treatment actions	Minor	Re-plan 7 actions, report monthly	[@ciso]	YYYY-MM-DD	Open
[GAP-nn]	[Ref]	[Description]	[Major / Minor / Observation]	[Action]	[@owner]	YYYY-MM-DD	[Status]

6. Readiness decision and roadmap

Question	Answer
Threshold met today?	[Yes / No] Example: No, 11 rows below 3
Major gaps open	[n] Example: 5
Earliest realistic Stage 1 date	YYYY-MM-DD
Decision	[Book Stage 1 / Re-assess on YYYY-MM-DD]
Decided by	[@sponsor], YYYY-MM-DD

Questions to settle with the certification body before booking: the evidence period they expect before Stage 2, how they sample multiple sites or cloud regions, and whether your scope sentence is acceptable as written.

7. References

Reference	Edition or date	Use
ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements	Third edition, October 2022	Clauses 4 to 10, Annex A
ISO/IEC 27001:2022/Amd 1:2024, Climate action changes	February 2024	Clauses 4.1 and 4.2; no Annex A change
ISO/IEC 27002:2022	Third edition, 2022	Control guidance
IAF MD 26:2023, Transition requirements for ISO/IEC 27001:2022	Issue 2, February 2023	Transition ended 31 October 2025; certificates to the 2013 edition are no longer valid
Certification body rules (ISO/IEC 17021-1 and ISO/IEC 27006-1)	Check current editions	Stage 1 and Stage 2 audit practice

Standard and licence note

Structure aligned with ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements (third edition), as amended by Amd 1:2024. Clause and control numbers are cited; topic labels, the scoring scale, the readiness formula and all guidance are original text written for this collection and reproduce no wording, tables or definitions from the standard. The worked example is fictional. Check the ISO catalogue for any later amendment or edition and read the requirements in your licensed copy before relying on this assessment.

Official text: ISO and IEC, purchase or licensed access: https://www.iso.org/standard/82875.html (ISO/IEC 27002:2022: https://www.iso.org/standard/75652.html), also available from national standards bodies.

Template licence: MIT.

Templat terkait

ISO & Kepatuhan