ISO 27001 gap analysis: how ready is your business for certification?

What ISO 27001 is and who asks for it

ISO/IEC 27001 is the international standard for an information security management system, or ISMS. The current edition was published by ISO and IEC in October 2022 (iso.org).

An ISMS is not a product. It is the decisions, rules, records and reviews that show you know your risks, have chosen how to deal with them, and check that it works.

Most small and mid-sized organisations look at ISO 27001 because someone asks for it:

• a larger client makes it a condition of a contract or a tender;
• client security questionnaires get long enough that a certificate is the simpler answer;
• you supply software, hosting or managed services and hold other people's data;
• your board or investors want independent assurance.

Certification means an independent certification body has audited your ISMS and issued a certificate. In the UK, look for one accredited by UKAS, the national accreditation body. UKAS accredits certification bodies. It does not certify organisations itself (UKAS).

The management system and Annex A are different things

Clauses 4 to 10 are the management system. They are requirements, and you must meet all of them to be certified:

• 4 Context: issues, interested parties and the ISMS scope.
• 5 Leadership: top management commitment, the policy and roles.
• 6 Planning: risk assessment and treatment, the Statement of Applicability, objectives and planned changes.
• 7 Support: resources, competence, awareness, communication and document control.
• 8 Operation: carrying out risk assessment and treatment.
• 9 Performance evaluation: monitoring, internal audit and management review.
• 10 Improvement: continual improvement and corrective action.

Annex A is a list of 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). You do not have to implement every one. You compare your risk treatment with the list, decide which controls you need, and record each decision with a reason in a Statement of Applicability (SoA).

The 2022 version and the climate change amendment

The 2022 edition replaced 114 controls in 14 domains with 93 controls in four themes. Many old controls were merged and 11 are new: A.5.7 Threat intelligence, A.5.23 Information security for use of cloud services, A.5.30 ICT readiness for business continuity, A.7.4 Physical security monitoring, A.8.9 Configuration management, A.8.10 Information deletion, A.8.11 Data masking, A.8.12 Data leakage prevention, A.8.16 Monitoring activities, A.8.23 Web filtering and A.8.28 Secure coding. The clauses changed less; the main addition is clause 6.3, on planning changes to the ISMS.

The transition is over. Under the International Accreditation Forum's rules (IAF MD 26:2023), 2013 certificates that had not moved to 2022 expired or were withdrawn at the end of 31 October 2025. Every certification audit now uses the 2022 edition.

Amendment 1:2024: climate change

In February 2024 ISO published ISO/IEC 27001:2022/Amd 1:2024, Climate action changes (iso.org). The same change was made to other ISO management system standards. Under clause 4.1 you now decide whether climate change is a relevant issue for your ISMS, and clause 4.2 gains a note that interested parties can have climate-related requirements.

For most small organisations this is a short, recorded decision, not a project. Expect the auditor to ask whether you considered it and where the decision is written down.

The essentials an auditor checks first

A certification body will not certify an ISMS that is missing its core parts, however good the IT is. Most of these must be written down, approved and kept under control.

In our gap analysis the essentials are 12 critical questions: scope, policy, risk method, risk assessment, treatment plan, SoA, objectives, competence, awareness, internal audit, management review and corrective action. If any is missing, you cannot be rated ready, whatever the score for the controls.

ISO 27001 readiness checklist, area by area

The checklist follows the 12 areas of our gap analysis. The first four cover the management system; the other eight group the Annex A controls.

1. Context, scope and leadership

What to check: issues (including climate change), interested parties, the scope and its exclusions, the policy and named roles.

You are ready when a director has approved the scope and policy, staff have seen the policy, and one person runs the ISMS and reports to top management.

2. Risk management and planning

What to check: a risk method with scales and acceptance criteria, a risk register across the scope, a treatment plan, the SoA and measurable objectives.

You are ready when repeat assessments would give comparable results, risk owners have accepted the remaining risk, and the SoA covers all 93 controls.

3. Support, skills and documents

What to check: skills defined for security roles, awareness, communication, and document control, including procedures for key IT tasks.

You are ready when you can show who is competent and why, and every document has an owner, a version and a review date.

4. Monitoring, audit and improvement

What to check: what you measure, the internal audit programme and the auditor's independence, management review and corrective action.

You are ready when one full internal audit and one management review are recorded, with their actions tracked to closure.

5. Policies, roles and assets

What to check: topic-specific policies, separated duties, contacts with the ICO, NCSC and police, threat information, the asset inventory, classification and acceptable use.

You are ready when every asset has an owner, and topic policies are approved, shared and reviewed on a set cycle.

6. Suppliers and cloud services

What to check: a supplier register, checks before use, security terms in contracts, regular reviews, and how you run cloud services (A.5.23).

You are ready when key suppliers are assessed and you know which Microsoft 365 security tasks are yours.

7. Incidents, continuity and legal

What to check: the incident procedure, a continuity plan, tested recovery targets, and a register of legal duties, including UK GDPR and the 72-hour deadline for reporting serious personal data breaches to the ICO.

You are ready when the incident procedure has been rehearsed and a restore has been tested against your targets.

8. People

What to check: screening in proportion to the role, security duties in contracts, awareness training, discipline, remote working rules and event reporting.

You are ready when HR records show screening and signed terms for every starter, and training records cover all staff.

9. Physical security

What to check: entry controls, monitoring, protection against fire, flood and power cuts, clear desk and screen, equipment off site and secure disposal.

You are ready when controls match the premises you actually use, home working included, and disposal certificates are kept.

10. Identity and access

What to check: unique accounts, multi-factor sign-in everywhere, few and separate admin accounts, access reviews and prompt removal of leavers.

You are ready when a Microsoft 365 report shows multi-factor sign-in for every user, a short admin list and a recent access review.

11. Devices and operations

What to check: device management and encryption, anti-malware, patching, configuration baselines, logging, tested backups and control of software installation.

You are ready when no device is unmanaged, no critical update is overdue, and a restore test is on record.

12. Network, data and development

What to check: network protection, web filtering, encryption, data deletion and leakage prevention, change management and, if you build software, secure development.

You are ready when changes are recorded and approved, and any code you write is reviewed and tested without real personal data.

How certification works

Choose a certification body accredited by UKAS for ISO/IEC 27001. Search the UKAS directory and check that ISO/IEC 27001:2022 is on the body's schedule of accreditation. To check any certificate, including a supplier's, use IAF CertSearch.

Stage 1: documents and readiness

The auditor reviews your documents and whether you are ready for the main audit: scope, policy, risk assessment and treatment, SoA, internal audit and management review. Anything missing is listed for you to close before stage 2.

Stage 2: implementation and effectiveness

The auditor checks that the ISMS works in practice, through interviews and samples of records. Stage 2 usually comes a few weeks after stage 1, and normally no more than about six months after.

Findings, surveillance and recertification

A major nonconformity must be closed before a certificate is issued. A minor one needs a corrective action plan the certification body accepts. The certificate is valid for three years, with surveillance audits in years one and two and a recertification audit before it expires. Risk reviews, internal audits and management reviews carry on in between.

How long it takes

That depends on what is already in place. The certification body needs to see the ISMS operating, so plan for a completed internal audit and management review before you book stage 1.

What you get beyond the certificate

• Faster answers to clients. A certificate and a current SoA answer many questionnaire items at once.
• Decisions on record. The risk register shows why you spend where you do, and which risks you have accepted.
• A plan for bad days. Incidents follow a rehearsed procedure, with the right people told in time.
• A yearly rhythm. Internal audit and management review catch drift early.
• A base for other standards. Other ISO management system standards, such as ISO 9001, share the clause structure.

How our gap analysis works

NORTH is Cybervis Ready's ISO 27001 gap analysis for organisations of up to 50 staff. It covers clauses 4 to 10 and all 93 Annex A controls of ISO/IEC 27001:2022, including Amendment 1:2024.

1. Questions. 74 plain-English questions in the 12 areas above, worked through in a workshop with the people who run IT, HR and operations.
2. Rating. A score per area and one of three results: ready for the certification audit, partly ready, or not ready. Ready needs at least 85% and no gaps in the 12 critical questions.
3. Action plan. Every gap is placed before the stage 1 audit, before the stage 2 audit, or within 12 months.
4. Statement of Applicability. Drafted from your answers: all 93 controls, whether each applies and how far it is implemented. You add the justifications.
5. ISMS document pack. 13 documents filled in with your details, from the scope statement, policy and risk methodology to the internal audit programme and management review minutes.
6. Microsoft 365 evidence. At the Verified level we check identity, admin accounts, devices, updates and anti-malware in Microsoft 365, and review the evidence with your team.

For up to 50 staff, excluding VAT: Gap analysis from £1,950 and Verified from £3,500. Implement, where we build the risk assessment with you, put controls in place, run an internal audit and support you through both stages, is quoted after the gap analysis. See the ISO 27001 page or compare all our services.