Gap analysis · ISO/IEC 27001 2022
Where are our gaps?
Answer 118 questions about how your organisation actually works, and see which parts of ISO/IEC 27001 2022 you would struggle to evidence. Every question explains itself as it is asked.
The baseline is ISO/IEC 27001:2022 itself. Every clause requirement applies to every management system, and every Annex A control is presumed to apply unless you rule it out with a justification. So a gap here means a requirement that applies to you and that you told us you could not evidence. That is the standard's own bar, not one we invented — but it is measured entirely from what you said about yourself.
- About 70 minutes.
- No account, and no email needed to see your result.
- Nothing you answer leaves your browser unless you ask for the full report.
- If you accepted analytics, we count how far people get through the questions, never what they answer.
First, a few things about you
Loading the questions…
Optional
When could we be ready for Stage 2?
The count above says what you would struggle to evidence, not when a certification audit could pass. This works out the earliest Stage 2 date the way the Certification Readiness Self-Assessment does, and checks it against the date you have booked. It needs a few totals your answers cannot give: dates, weeks of work, and where the internal audit programme stands.
How this is worked out, and what it is not
How the estimate is worked out. (a) Remaining work: each owner works through their items below In place one after another, blockers first, then in the standard's order, starting from the as-at date; the last item's date is when the work is done. Items at In place need no more work, only time. (b) IS-05: "The ISMS must run for at least 3 months, producing records, before the Stage 2 audit." — the last blocker's In place date plus 3 months. (c) IS-06: "At least one full internal audit cycle and one management review must be completed before Stage 2." — the later of your planned management review, your planned end of audit fieldwork, and the earliest possible end of the Check phase (the audit programme in place, plus 4 weeks, the Check phase in the ISO 27001 Implementation Methodology & Project Plan). The earliest Stage 2 date is the latest of the three. Weeks are calendar weeks.
Nothing is filled in from your gap answers. The workbook's levels are Not started, Planned, In place (documented and working, with little or no record yet) and Operating (records covering at least 3 months). In place in this guide means done and something to show, which may be either of the top two. So your answers cannot say how much is below Operating. They can say that a blocker you answered Partly or Not in place is below Operating, and the panel holds you to that.
It does not count how many requirements are at Operating, and does not name the blocking items or the critical path: the full check and the workbook do.
- This is a self-assessment: it is as accurate as the scores and the weeks of work entered. Evidence notes, and a second person checking the scores of the blockers, are the best defence against optimism.
- The estimate assumes each owner works on one item at a time, in the order shown, from the as-at date, and that the dates you entered for the internal audit and management review hold. It does not include the certification body's lead time: book the Stage 1 and Stage 2 dates early.
- A certification body decides on the evidence it samples. Every requirement at Operating makes a pass likely, not certain; a requirement at In place may still pass if it has enough records, and may not.
- It does not judge whether your controls are the right ones for your risks (IS-03): that is the risk assessment and the Statement of Applicability.
The full check, with the readiness line: Is our Stage 2 date realistic?. The workbook it comes from, row by row: Certification Readiness Self-Assessment.