ISO/IEC 27001 gap analysis: what Sterling examines, what you receive, and what happens next

What a gap analysis answers, and the two steps it is confused with

A gap analysis measures, with evidence, how far your organisation stands today from an information security management system that meets ISO/IEC 27001:2022 with its 2024 amendment. It then turns that distance into a plan: what stays, what changes, who changes it and by when.

Keep three readiness terms apart. The readiness check is Sterling's free online tool, ten minutes of self-assessment that returns a score and the priorities to fix first. The gap analysis is Sterling's first engagement stage, performed by consultants on evidence. The readiness review is the certification body's Stage 1, the opening stage of its certification audit.

What Sterling examines: clauses 4 to 10 and the Annex A themes

Each requirement is tested four ways: the documents that define it, the practice people demonstrate, the records that prove it and whether people know their part. A policy without records is a gap; so is a working control left undocumented where the standard requires documented information.

The management system clauses

Clauses 4 to 10 are examined in full, since a claim of conformity cannot exclude any of them: context and interested parties, including whether climate change is relevant; the ISMS scope (4.3); leadership, policy and roles; the risk assessment and treatment method (6.1.2, 6.1.3) and any Statement of Applicability; objectives and planning of changes (6.3); competence, awareness and documented information (7.5); operational control; monitoring, internal audit (9.2), management review (9.3) and corrective action.

The Annex A control themes

All 93 controls are reviewed, since the Statement of Applicability must account for each, and seven themes are tested hardest:

• Policies (5.1): approved, communicated, reviewed and matched by what systems enforce.
• Access (5.15 to 5.18, 8.2, 8.5): joiners, movers and leavers, privileged accounts, multi-factor authentication, and reviews that end in revocations.
• Suppliers (5.19 to 5.23): the supplier and cloud-service inventory, security terms in contracts, and service monitoring.
• Logging (8.15, 8.16): what is logged and kept, who reviews it and which alerts reach a person.
• Change (8.32): request, testing, approval and record, emergency changes included.
• Incidents (5.24 to 5.28): reporting, triage, response, lessons learned and the collection of evidence.
• Continuity (5.29, 5.30, 8.13): security during disruption, ICT readiness and backups that have actually been restored in a test.

People and physical controls are covered too; the Annex A guide explains all four themes.

How the evidence is gathered: interviews, walk-throughs and samples

Interviews

Consultants talk to the people who run each process, not only its owner on paper: the administrator who disables accounts, the engineer who approves releases, the HR officer who runs induction.

Configuration walk-throughs

Your administrator opens the settings in the identity provider, cloud console, endpoint tool, backup platform or logging service while the consultant notes what is configured: the directory's password rule against the policy's, the backup job history against the stated schedule.

Sampling of tickets and logs

Small samples of real records are traced end to end: recent leavers, change-log entries, the latest incidents, some weeks of alert reviews. Samples show whether a control runs every time or only when someone remembers.

An illustration: the policy says accounts are disabled on the leaving date, and single sign-on covers every application except finance. Of five recent leavers on the HR list, one still had a finance login six weeks later. The report records a control that does not reach every system; the action plan brings finance into the leaver process, with periodic access reviews as evidence.

What you receive at the end of the gap analysis

Findings are presented to your sponsor at a closing meeting and handed over in writing.

Priority follows three tests: does the gap block certification outright, as a missing risk method would; does the control need weeks of operating history, as logging and access reviews do; has a client already been promised it? The scope guide covers boundary wording, and the timeline guide the audit window.

Who needs to be in the room for an ISMS gap analysis

Findings are only as good as the people present: a process nobody can explain defaults to "not evidenced", and the plan fills with unnecessary work. Plan for:

• The sponsor from top management, at the opening and closing meetings, to confirm purpose, scope and acceptable risk.
• The ISMS lead or project coordinator, throughout.
• IT and cloud administrators, with console access, for the walk-throughs.
• Engineering leads, for change and secure development.
• HR, for screening, induction, awareness and leavers.
• Procurement, legal and privacy leads, for supplier terms and legal, regulatory and contractual requirements.
• Facilities, for offices and secure areas.
• A client-facing lead who knows what questionnaires and contracts already promise.

What the ISO/IEC 27001 gap analysis is not

Not a penetration test. Nothing is scanned, attacked or exploited. The vulnerability assessment included in a Sterling engagement comes later, during implementation.

Not an audit. It raises no nonconformities, cannot replace the internal audit that clause 9.2 requires and is not the certification body's Stage 1: an internal audit samples an operating ISMS, while a gap analysis precedes most of it. Nor does it forecast the certification decision, which only the accredited certification body takes; Sterling does not certify.

Not a template pack. Model policies cannot tell you which of your own documents, controls and records can stay; the gap analysis can.

How long it takes, and how it feeds Design™ or Drive™

For a single-site organisation, scoping and the gap analysis together usually take two to four weeks, paced by how quickly interviews are booked and the scope is settled; more sites, cloud platforms or a parallel SOC 2 examination add time.

The effort estimate then settles the route. Design™, the guided route, keeps the implementing with your teams, supported by Sterling's structure, ISMS templates, risk workshops and coaching. Drive™, the managed route, hands the agreed work to Sterling's consultants, from the risk assessment to audit preparation, alongside your control owners. Either way the action plan becomes the project plan in Effivity, included with the engagement at no additional cost. The risk assessment guide covers what comes next, and the implementation plan guide the phases and owners.

ISO/IEC 27001 gap analysis: questions buyers ask