Scope and context
Test whether the proposed ISMS scope, interested parties and boundaries are defined and sensible.
ISO 27001 Gap Assessment
An ISO 27001 gap analysis compares how your organisation manages information security today with the requirements of ISO/IEC 27001:2022, the international standard for an information security management system (ISMS). Umbrella Tech reviews your scope, risk process, documents and controls against the clauses and Annex A, and gives you a clear gap register and a prioritised plan to reach audit readiness.
When this assessment is useful
An ISO 27001 gap assessment is the right first step when a customer or tender asks for certification, when you have security practices but no formal ISMS, or when a previous attempt stalled and you need to know what remains. It also helps estimate effort before committing budget to implementation.
Assessment scope
Management system clauses
Review leadership, risk assessment and treatment, objectives, document control, internal audit and management review against clauses 4 to 10.
Annex A controls
Review the organisational, people, physical and technological controls relevant to your risks.
Evidence
Check whether records exist to show each requirement operating, not only documented.
Evidence and access
Depending on scope, evidence may include existing security policies, risk registers, asset and supplier lists, access and change records, incident logs, Microsoft 365 and device settings, and interviews with control owners. We agree what is needed and how it is handled before the assessment begins.
Existing security policies
Risk registers
Asset and supplier lists
Access and change records
Incident logs
Microsoft 365 and device settings
Interviews with control owners
Findings that lead to action
You receive a gap register that distinguishes missing design, incomplete implementation and absent evidence, a draft view of which Annex A controls apply, and a prioritised roadmap. Each gap is linked to the clause or control it affects, so the remediation plan is easy to track.
Illustrative findingsExamples only
- ExampleRisk register with no treatment decisions or owners
- ExampleAccess review that happens informally but leaves no record
- ExamplePolicy set that nobody has formally approved
These are examples of what a gap analysis can uncover, not findings about your organisation.
How it runs
Assessment method
01
Confirm the scope
Agree the proposed ISMS scope, locations, systems and people to involve.
02
Review clauses and controls
Examine documents and records against the management system clauses and relevant Annex A controls.
03
Test a sample
Check selected technical and operational controls to confirm they work as described.
04
Report and plan
Present the gap register and agree a realistic sequence for closing it.
From assessment to remediation
You can address the gaps internally or ask us to build and run the ISMS with you through ISO 27001 Readiness & Implementation. Technical gaps often connect with our Cybersecurity services.
Assessment outputFindings and remediation roadmap
Umbrella TechWe deliver the improvements
DesignImplementValidate
Your organisationYour internal team
Your partnerYour existing technology provider
ISO/IEC 27001
ISO/IEC 27001 defines requirements for an information security management system (ISMS), with 93 reference controls in Annex A of the 2022 edition.
About ISO/IEC 27001 services →Preparing for certification
A gap analysis supports readiness; it is not a certification audit. Certification is assessed separately by an independent certification body, and the findings show what that body is likely to look for.
Gap assessmentUmbrella Tech
Remediation and implementationUmbrella Tech with your team
Operate and build evidenceYour organisation
External certification or assessmentIndependent body
Frequently asked questions
Can't see your question? Ask us directly →
What does an ISO 27001 gap analysis include?
A review of scope, management system clauses, relevant Annex A controls and supporting evidence, then a gap register and prioritised roadmap. You also receive an early view of your Statement of Applicability.
How long does the assessment take?
It depends on the ISMS scope, the number of sites and systems, and how much documentation already exists. We confirm scope and timing in discovery.
What evidence or access is required?
Copies of existing policies and records, read-only access to key systems where controls need testing, and time with the people who own security, IT, HR and supplier processes. We agree the list first.
What happens after the assessment?
You decide how to close the gaps. We can implement the ISMS with you, support your internal team, or review progress before you engage a certification body.
How much does it cost?
Cost depends on scope, organisational complexity and existing maturity. We confirm scope and cost in discovery. Certification body fees are separate and paid to that body.
Establish your current position
Tell us what you want the ISMS to cover and who is asking for certification. We will scope a gap analysis that gives you a clear starting point.