# ISO/IEC 27001 Gap Assessment: [Organization name] ISMS

> A readiness assessment of an information security management system
> (ISMS) against ISO/IEC 27001:2022 as amended by Amd 1:2024 (climate
> action changes), run before a certification audit or a transition. It
> scores each management system clause from 4 to 10, summarises Annex A
> control status by theme (93 controls: 37 organizational, 8 people,
> 14 physical, 34 technological), lists the gaps with owners and dates,
> and records a readiness decision for booking the Stage 1 audit.
> Clause numbers are cited by number with labels written for this
> template; read the requirements in your licensed copy of the
> standard. Replace every `[bracketed]` value and every row marked
> *Example*.

<!--
Guidance: How to use this template
- Run the assessment against evidence, not against intentions. A clause
  scores 3 or more only when you can show the auditor a record, not a
  plan to create one.
- Fill section 1 (scope and method) first, then section 3 (clauses),
  then section 4 (Annex A summary). Section 5 (gap register) collects
  every item that scored below the readiness threshold.
- Use the full control-by-control matrix in the statement of
  applicability (`compliance/statement-of-applicability`) for Annex A
  detail. This template only summarises it by theme so the gap view
  stays readable.
- The worked example uses Lumenreach Software Ltd, a fictional
  200-person SaaS company preparing for its first certification.
- Related templates: scope statement (`compliance/ms-scope`),
  information security policy (`compliance/information-security-policy`),
  risk methodology (`compliance/risk-methodology`), risk register
  (`compliance/risk-register`), risk treatment plan
  (`compliance/risk-treatment-plan`), objectives register
  (`compliance/objectives-register`), internal audit programme
  (`compliance/internal-audit-program`), management review
  (`compliance/management-review`), corrective action
  (`compliance/capa-nonconformity`), business impact analysis
  (`compliance/business-impact-analysis`).
-->

## Contents

1. Scope and method
2. Scoring scale
3. Clause 4 to 10 assessment
4. Annex A summary by theme
5. Gap register
6. Readiness decision and roadmap
7. References
8. Standard and licence note

## Document control

<!-- Guidance: A gap assessment is a record, not a policy. Keep each run as a new version so you can show progress between runs. -->

| Field | Value |
|---|---|
| Document ID | [GAP-ISMS-001] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; control guidance ISO/IEC 27002:2022 |
| Assessment type | [First certification / Transition / Pre-surveillance / Scope extension] |
| Assessment period | YYYY-MM-DD to YYYY-MM-DD |
| Version | [1.0] |
| Status | [Draft / In review / Approved] |
| Owner | [ISMS manager, @name] |
| Assessor(s) | [Internal or external assessor, @name; independence noted] |
| Approvers/reviewers | [CISO, top management sponsor] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Target Stage 1 audit | YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Top management sponsor | [@name] | [Approved] | YYYY-MM-DD |
| ISMS manager | [@name] | [Reviewed] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft after interviews |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved, 15 gaps opened, Stage 1 target moved by eight weeks |

## 1. Scope and method

<!-- Guidance: State the ISMS scope you intend to certify, because a gap assessment against the wrong scope is wasted work. Say how evidence was gathered and who was interviewed. Pitfall: assessing the whole company when the certificate will cover one product line, or the reverse. -->

| Item | Value |
|---|---|
| Intended ISMS scope | [Scope sentence from `compliance/ms-scope`] |
| Sites and cloud regions | [List] |
| Evidence methods | [Document review, interviews, sampling of records, technical spot checks] |
| People interviewed | [Roles, not names, if the report is shared] |
| Out of scope for this assessment | [For example penetration testing, supplier audits] |
| Limitations | [Time, access, sampling depth] |

*Example:* Lumenreach Software Ltd intends to certify "the development,
operation and support of the Lumenreach scheduling platform from its
London office and two cloud regions". Evidence came from 14 interviews,
review of 31 documents and sampling of access reviews, change tickets
and incident records for the last three months.

## 2. Scoring scale

<!-- Guidance: Use one scale for every clause so the scores compare. Agree the readiness threshold with the sponsor before scoring, not after. -->

| Score | Label | Meaning |
|---|---|---|
| 0 | Absent | Nothing exists |
| 1 | Initial | Ad hoc practice, no documented approach |
| 2 | Defined | Documented but not yet operating, or operating without records |
| 3 | Implemented | Operating, with records an auditor can sample |
| 4 | Effective | Operating for at least one full cycle, with measured results |
| 5 | Improving | Results reviewed and acted on, improvements recorded |

Readiness threshold for booking Stage 1: every clause scores 3 or more,
no mandatory documented information is missing, and at least one full
cycle of internal audit (9.2) and management review (9.3) is complete.
Certification bodies expect the ISMS to have operated before Stage 2;
confirm the evidence period they need when you book.

## 3. Clause 4 to 10 assessment

<!-- Guidance: One row per clause or sub-clause. "Evidence seen" names the record, with version or date. "Gap" says what is missing in one sentence. Clause 6.3 (planning of changes) was new in the 2022 edition, and Amd 1:2024 added the climate change question to 4.1 and a note to 4.2: check both explicitly. -->

| Clause | Topic (label for this template) | Score | Evidence seen | Gap | Gap ID |
|---|---|---|---|---|---|
| 4.1 *(Example)* | Context, including whether climate change is relevant | 3 | Context register v1.2, climate decision recorded | None | |
| 4.2 *(Example)* | Interested parties and their requirements | 3 | Interested parties table v1.0 | Contract requirements from two key customers not yet added | GAP-01 |
| 4.3 *(Example)* | Scope | 4 | Scope statement v1.1 approved | None | |
| 4.4 *(Example)* | ISMS and its processes | 3 | Process map | None | |
| 5.1 *(Example)* | Leadership and commitment | 3 | Board minutes approving ISMS budget | None | |
| 5.2 *(Example)* | Information security policy | 4 | Policy v2.0, communicated in onboarding | None | |
| 5.3 *(Example)* | Roles, responsibilities and authorities | 2 | Draft RACI | RACI not approved or communicated | GAP-02 |
| 6.1.1 *(Example)* | Actions to address risks and opportunities | 3 | Risk methodology v1.0 | None | |
| 6.1.2 *(Example)* | Risk assessment | 3 | Risk register, 64 risks | None | |
| 6.1.3 *(Example)* | Risk treatment and statement of applicability | 2 | Draft SoA | SoA not approved, 9 controls without justification | GAP-03 |
| 6.2 *(Example)* | Objectives and planning to achieve them | 2 | Objectives drafted | No measures or owners | GAP-04 |
| 6.3 *(Example)* | Planning of changes | 1 | None | No way to plan changes to the ISMS itself | GAP-05 |
| 7.1 *(Example)* | Resources | 3 | Budget line, ISMS manager appointed | None | |
| 7.2 *(Example)* | Competence | 3 | Training matrix | None | |
| 7.3 *(Example)* | Awareness | 2 | Awareness slides | No completion records for contractors | GAP-06 |
| 7.4 *(Example)* | Communication | 3 | Communication plan | None | |
| 7.5 *(Example)* | Documented information | 3 | Document control procedure | None | |
| 8.1 *(Example)* | Operational planning and control | 3 | Change tickets sampled | None | |
| 8.2 *(Example)* | Performing risk assessments at planned intervals | 3 | Quarterly risk review minutes | None | |
| 8.3 *(Example)* | Implementing risk treatment | 2 | Treatment plan | 7 of 18 actions overdue | GAP-07 |
| 9.1 *(Example)* | Monitoring, measurement, analysis and evaluation | 1 | Ad hoc dashboards | No defined metrics or methods | GAP-08 |
| 9.2 *(Example)* | Internal audit | 0 | None | No programme, no audit performed | GAP-09 |
| 9.3 *(Example)* | Management review | 0 | None | No review held | GAP-10 |
| 10.1 *(Example)* | Continual improvement | 2 | Improvement ideas list | Not linked to results | GAP-11 |
| 10.2 *(Example)* | Nonconformity and corrective action | 2 | Incident tickets | No root cause or effectiveness check | GAP-12 |
| [Clause] | [Topic] | [0 to 5] | [Record] | [Gap] | [GAP-nn] |

### 3.1 Clause score summary

<!-- Guidance: Average by clause group to show where effort is needed. Averages hide single failures, so always read the "below 3" column too. -->

| Clause group | Rows | Total score | Average | Rows below 3 |
|---|---|---|---|---|
| 4 Context *(Example)* | 4 | 13 | 3.25 | 0 |
| 5 Leadership *(Example)* | 3 | 9 | 3.00 | 1 |
| 6 Planning *(Example)* | 5 | 11 | 2.20 | 3 |
| 7 Support *(Example)* | 5 | 14 | 2.80 | 1 |
| 8 Operation *(Example)* | 3 | 8 | 2.67 | 1 |
| 9 Performance evaluation *(Example)* | 3 | 1 | 0.33 | 3 |
| 10 Improvement *(Example)* | 2 | 4 | 2.00 | 2 |
| **All clauses** *(Example)* | **25** | **60** | **2.40** | **11** |

In the example, 11 of 25 rows are below the threshold and four rows
(6.3, 9.1, 9.2, 9.3) score 1 or less. Performance evaluation is the
critical path, because an internal audit and a management review need
time to plan and run.

## 4. Annex A summary by theme

<!-- Guidance: Take the counts from the statement of applicability. "Partial" means the control exists but lacks coverage or records. The totals must equal 37, 8, 14, 34 and 93, otherwise a control is missing. Readiness % counts a partial control as half and excludes not applicable controls. -->

| Theme (Annex A) | Controls | Implemented | Partial | Not implemented | Not applicable | Applicable | Readiness % |
|---|---|---|---|---|---|---|---|
| 5 Organizational *(Example)* | 37 | 22 | 9 | 4 | 2 | 35 | 75.7 |
| 6 People *(Example)* | 8 | 6 | 2 | 0 | 0 | 8 | 87.5 |
| 7 Physical *(Example)* | 14 | 8 | 2 | 1 | 3 | 11 | 81.8 |
| 8 Technological *(Example)* | 34 | 20 | 8 | 5 | 1 | 33 | 72.7 |
| **Total** *(Example)* | **93** | **56** | **21** | **10** | **6** | **87** | **76.4** |

Readiness % = (Implemented + 0.5 x Partial) / Applicable x 100.

Controls not implemented or partial that drive the most risk in the
example (labels written for this template):

| Control | Short label | Status | Linked risk | Gap ID |
|---|---|---|---|---|
| 5.7 *(Example)* | Threat intelligence | Not implemented | R-014 | GAP-13 |
| 5.23 *(Example)* | Security for cloud services use | Partial | R-022 | GAP-14 |
| 8.16 *(Example)* | Monitoring activities | Partial | R-031 | GAP-15 |
| [Control] | [Label] | [Status] | [R-nnn] | [GAP-nn] |

Each excluded control needs a justification in the SoA, and each
included control needs a reason: a risk, a legal or contractual
requirement, or a business decision.

## 5. Gap register

<!-- Guidance: One row per gap, with a single owner and a date. Severity: Major means a requirement is not met at all or a mandatory record is missing (likely a major nonconformity at audit); Minor means partly met; Observation means met but weak. Pitfall: owners who are teams, not people. -->

| Gap ID | Clause or control | Description | Severity | Action | Owner | Due | Status |
|---|---|---|---|---|---|---|---|
| GAP-03 *(Example)* | 6.1.3 | SoA not approved, 9 controls lack justification | Major | Complete justifications, approve SoA | [@ciso] | YYYY-MM-DD | Open |
| GAP-05 *(Example)* | 6.3 | No change planning for the ISMS | Major | Add ISMS change step to the change procedure | [@isms-manager] | YYYY-MM-DD | Open |
| GAP-08 *(Example)* | 9.1 | No defined metrics | Major | Define 8 metrics with method, frequency, owner | [@isms-manager] | YYYY-MM-DD | Open |
| GAP-09 *(Example)* | 9.2 | No internal audit | Major | Approve programme, audit all clauses and applicable controls once | [@internal-auditor] | YYYY-MM-DD | Open |
| GAP-10 *(Example)* | 9.3 | No management review | Major | Hold review with all required inputs after the audit | [@ceo] | YYYY-MM-DD | Open |
| GAP-07 *(Example)* | 8.3 | Overdue treatment actions | Minor | Re-plan 7 actions, report monthly | [@ciso] | YYYY-MM-DD | Open |
| [GAP-nn] | [Ref] | [Description] | [Major / Minor / Observation] | [Action] | [@owner] | YYYY-MM-DD | [Status] |

## 6. Readiness decision and roadmap

<!-- Guidance: Record a yes or no against the threshold in section 2 and the date you expect to meet it. Show the sequence, because internal audit and management review must come after the controls they evaluate. -->

| Question | Answer |
|---|---|
| Threshold met today? | [Yes / No] *Example:* No, 11 rows below 3 |
| Major gaps open | [n] *Example:* 5 |
| Earliest realistic Stage 1 date | YYYY-MM-DD |
| Decision | [Book Stage 1 / Re-assess on YYYY-MM-DD] |
| Decided by | [@sponsor], YYYY-MM-DD |

```mermaid
flowchart LR
  A["Close planning gaps: 5.3, 6.1.3, 6.2, 6.3"] --> B["Operate controls and collect records"]
  B --> C["Define metrics, clause 9.1"]
  C --> D["Internal audit, clause 9.2"]
  D --> E["Management review, clause 9.3"]
  E --> F["Corrective actions, clause 10.2"]
  F --> G{"Threshold met?"}
  G -->|Yes| H["Book Stage 1 audit"]
  G -->|No| B
```

Questions to settle with the certification body before booking: the
evidence period they expect before Stage 2, how they sample multiple
sites or cloud regions, and whether your scope sentence is acceptable
as written.

## 7. References

<!-- Guidance: Record the editions you assessed against. If a later amendment or edition is published, re-check the affected clauses before the audit. -->

| Reference | Edition or date | Use |
|---|---|---|
| ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements | Third edition, October 2022 | Clauses 4 to 10, Annex A |
| ISO/IEC 27001:2022/Amd 1:2024, Climate action changes | February 2024 | Clauses 4.1 and 4.2; no Annex A change |
| ISO/IEC 27002:2022 | Third edition, 2022 | Control guidance |
| IAF MD 26:2023, Transition requirements for ISO/IEC 27001:2022 | Issue 2, February 2023 | Transition ended 31 October 2025; certificates to the 2013 edition are no longer valid |
| Certification body rules (ISO/IEC 17021-1 and ISO/IEC 27006-1) | Check current editions | Stage 1 and Stage 2 audit practice |

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022, *Information security,
cybersecurity and privacy protection, Information security management
systems, Requirements* (third edition), as amended by Amd 1:2024. Clause
and control numbers are cited; topic labels, the scoring scale, the
readiness formula and all guidance are original text written for this
collection and reproduce no wording, tables or definitions from the
standard. The worked example is fictional. Check the ISO catalogue for
any later amendment or edition and read the requirements in your
licensed copy before relying on this assessment.

Official text: ISO and IEC, purchase or licensed access:
https://www.iso.org/standard/82875.html (ISO/IEC 27002:2022:
https://www.iso.org/standard/75652.html), also available from national
standards bodies.

Template licence: MIT.