Preparing for ISO 27001 certification is not just about having antivirus, firewalls, or strong passwords.
ISO/IEC 27001:2022 requires an organization to establish, implement, maintain, and continually improve an Information Security Management System (ISMS). It also requires organizations to assess and treat information security risks based on their own business context.
That means a company can have good security technology and still have important gaps in its ISO 27001 readiness.
A gap assessment helps you find those gaps before an audit.
This checklist gives you a practical way to review your current security, documentation, processes, and controls.
What Is an ISO 27001 Gap Assessment?
An ISO 27001 gap assessment compares your current information security practices with the requirements of ISO/IEC 27001.
The goal is simple:
Find what is already in place, identify what is missing, and create a plan to close the gaps.
A gap assessment is not the same as certification. It is a preparation step that helps an organization understand its current position before moving toward certification.
ISO/IEC 27001 applies to organizations of different sizes and industries. The standard focuses on creating a structured system for managing information security risks rather than relying only on individual security tools.
ISO 27001 Readiness Checklist
Use the following questions to review your organization’s current readiness.
1. Define the Scope of Your ISMS
Before implementing an ISMS, you need to understand what it will cover.
Ask:
- Have we clearly defined the scope of our ISMS?
- Which departments are included?
- Which information systems and applications are included?
- Which physical locations are included?
- Which business processes handle sensitive information?
- Have we identified relevant internal and external issues?
- Have we identified interested parties and their requirements?
What to look for
Your scope should clearly explain which parts of the organization are covered by the ISMS.
For example, an organization may include its corporate IT environment, cloud infrastructure, customer data, employees, applications, and supporting business processes.
2. Identify Your Information Assets
You cannot protect information properly if you do not know what information you have.
Create an inventory of important assets such as:
- Customer information
- Employee records
- Financial information
- Business documents
- Databases
- Servers
- Laptops and workstations
- Cloud systems
- Applications
- Network infrastructure
- Backups
- Intellectual property
For each important asset, consider:
Who owns it? Where is it stored? Who can access it? How important is it to the business?
A clear asset inventory makes later risk assessment and control implementation much easier.
3. Check Your Information Security Policies
ISO 27001 readiness is not only about technology.
Your organization should have documented policies that explain how information security is managed.
Review whether you have policies covering areas such as:
- Information security
- Access control
- Passwords and authentication
- Acceptable use
- Data classification
- Backup and recovery
- Incident management
- Remote working
- Mobile devices
- Third-party security
- Business continuity
- Secure development
- Employee responsibilities
Do not create policies simply to put documents in a folder.
Employees should understand the policies that apply to their roles, and the organization should be able to show evidence that these policies are being followed.
4. Perform an Information Security Risk Assessment
Risk assessment is one of the most important parts of ISO 27001 readiness.
For each important information asset or process, identify:
Asset → Threat → Vulnerability → Risk → Impact → Treatment
For example:
Asset: Customer database
Threat: Unauthorized access
Vulnerability: Weak access controls
Impact: Data exposure and business disruption
Risk: Unauthorized disclosure of customer information
Treatment: Strong authentication, access restrictions, monitoring, and periodic access reviews
Your risk assessment should reflect the actual risks facing your organization.
ISO/IEC 27001 requires organizations to assess and treat information security risks according to their context.
5. Review Access Control
Access should be based on business need.
Check:
- Are user accounts assigned to individual employees?
- Is multi-factor authentication enabled where appropriate?
- Are administrator accounts restricted?
- Are former employees removed promptly?
- Are access rights reviewed regularly?
- Do employees have only the access they need?
- Are privileged accounts monitored?
- Are shared accounts avoided or properly controlled?
A common gap is giving employees access when they join but not reviewing that access later.
Your organization should have a defined process for granting, changing, reviewing, and removing access.
6. Check Endpoint and Device Security
Laptops, desktops, mobile devices, and other endpoints can provide an entry point into the organization.
Review whether:
- Devices are centrally managed
- Security software is installed
- Operating systems are patched
- Disk encryption is enabled where required
- USB and removable media are controlled where appropriate
- Lost devices can be managed or remotely wiped
- Endpoint alerts are monitored
- Employees understand device security requirements
Technology alone is not enough.
You should also maintain evidence showing that these controls are actually operating.
Ambsan’s security assessment approach includes reviewing infrastructure, applications, policies, and security controls to identify vulnerabilities and compliance gaps.
7. Review Network Security
Your network should be protected against unauthorized access and unnecessary exposure.
Check:
- Are firewalls properly configured?
- Are unnecessary ports and services disabled?
- Is network traffic monitored?
- Are critical systems separated where appropriate?
- Are remote connections secured?
- Are network devices regularly updated?
- Are security logs collected?
- Are unusual activities investigated?
For organizations with complex environments, network security should be considered alongside endpoint, identity, application, and cloud security.
8. Review Vulnerability and Patch Management
An outdated system can create a significant security gap.
Ask:
- Do we have a list of systems and software?
- Do we regularly identify vulnerabilities?
- Are critical patches prioritized?
- Is there a documented patching process?
- Can we prove when patches were applied?
- Are unsupported systems identified?
- Are vulnerability scans performed where appropriate?
The important point is consistency.
A company should not depend on someone remembering to install updates manually.
9. Check Incident Response
Security incidents can happen even when preventive controls are in place.
Your organization should have a defined process for responding to incidents.
Check whether you have:
- An incident response policy
- Clearly assigned responsibilities
- Incident reporting procedures
- Escalation procedures
- Communication plans
- Evidence preservation procedures
- Recovery procedures
- Post-incident reviews
Also ask:
Have we actually tested our incident response process?
A document that has never been tested may not work as expected during a real incident.
10. Review Backup and Business Continuity
Backups are important, but having backups does not automatically mean you are prepared for recovery.
Check:
- Are critical systems backed up?
- Are backups protected from unauthorized access?
- Are backup copies separated from production systems?
- Are backups monitored?
- Are restoration tests performed?
- Are recovery responsibilities defined?
- Are recovery procedures documented?
A useful readiness question is:
If our main systems became unavailable today, could we recover them within the required timeframe?
11. Check Employee Security Awareness
People are an important part of an organization’s security system.
Your checklist should include:
- Security awareness training
- Phishing awareness
- Password and authentication guidance
- Data handling procedures
- Incident reporting
- Remote working security
- Acceptable use
- Employee onboarding
- Employee offboarding
Training should not stop after an employee’s first week.
Organizations should maintain records showing that required training has taken place.
12. Review Third-Party and Supplier Security
Your organization’s security can be affected by vendors, suppliers, contractors, and cloud providers.
Identify third parties that:
- Access company systems
- Process customer information
- Store company information
- Provide critical technology
- Have privileged access
- Support important business processes
Then ask:
- Do contracts include security requirements?
- Are vendors assessed before onboarding?
- Are important vendors reviewed periodically?
- Do we know what information each vendor can access?
- Do we have a process for managing vendor security incidents?
Third-party risk should be part of the overall risk management process.
13. Check Data Protection and Information Handling
Information should be handled according to its sensitivity and business importance.
Review whether your organization has defined:
- Information classification
- Data handling rules
- Storage requirements
- Data transfer procedures
- Data retention requirements
- Secure disposal procedures
- Access restrictions
Employees should know how to handle confidential and sensitive information.
14. Review Logging and Monitoring
Security controls need visibility.
Check whether important systems generate appropriate logs and whether someone is responsible for reviewing relevant security events.
Consider:
- Authentication logs
- Firewall logs
- Endpoint alerts
- Server logs
- Cloud activity
- Administrative activity
- Security alerts
The goal is not to collect every possible log.
The goal is to collect useful security information and have a process for responding to important events.
15. Check Documentation and Evidence
This is where many organizations discover a significant readiness gap.
Ask:
Can we prove that our security controls are actually working?
Examples of useful evidence include:
- Approved policies
- Risk assessments
- Risk treatment records
- Access review records
- Training records
- Vulnerability reports
- Patch records
- Backup test results
- Incident records
- Security monitoring records
- Supplier assessments
- Internal audit reports
- Management review records
Having a security control and being able to demonstrate that it operates are two different things.
16. Conduct an Internal Audit
Before the certification audit, conduct an internal audit of your ISMS.
The purpose is to determine whether:
- Requirements are being followed
- Controls are operating
- Policies are implemented
- Evidence is available
- Nonconformities exist
- Corrective actions are required
Internal audits give your organization an opportunity to identify and address problems before an external certification audit.
17. Review Management Involvement
ISO 27001 is not only an IT project.
Management needs to support the ISMS and understand important information security risks.
Review whether management:
- Approves relevant security policies
- Provides appropriate resources
- Reviews security performance
- Understands significant risks
- Participates in management reviews
- Supports continual improvement
Information security should have clear ownership across the organization.
A Simple ISO 27001 Gap Assessment Template
You can turn the checklist above into a simple assessment table:
| Area | Current Status | Gap | Required Action | Priority |
|---|---|---|---|---|
| ISMS Scope | Defined | Missing documented boundaries | Define and approve scope | High |
| Asset Inventory | Partial | Some systems missing | Complete asset inventory | High |
| Risk Assessment | Not completed | No formal risk register | Conduct risk assessment | High |
| Access Control | Implemented | Access reviews missing | Schedule periodic reviews | High |
| Incident Response | Documented | Not tested | Conduct tabletop exercise | Medium |
| Security Awareness | Partial | Training records incomplete | Run and document training | Medium |
| Vendor Security | Partial | No formal assessment | Assess critical vendors | Medium |
| Internal Audit | Not completed | No audit evidence | Conduct internal audit | High |
This makes the assessment easier to manage because every gap has an action attached to it.
What Happens After the Gap Assessment?
Finding gaps is only the first step.
A practical ISO 27001 readiness process should move through these stages:
1. Identify
Find weaknesses in policies, processes, technology, and documentation.
2. Prioritize
Rank gaps according to risk, business impact, and certification requirements.
3. Remediate
Implement the required policies, processes, controls, and technical improvements.
4. Document
Create and maintain evidence showing that controls are implemented and operating.
5. Test
Check whether the controls actually work.
6. Audit
Perform an internal audit and address identified nonconformities.
7. Improve
Continue monitoring and improving the ISMS.
ISO/IEC 27001 is designed around establishing, maintaining, and continually improving an ISMS, so readiness should not be treated as a one-time checklist.
ISO 27001 Readiness: The Questions to Ask First
If you are just starting, begin with these 10 questions:
- Have we defined the scope of our ISMS?
- Do we know what information assets we need to protect?
- Have we completed a formal information security risk assessment?
- Are our security policies documented and approved?
- Are access rights controlled and reviewed?
- Are vulnerabilities and security updates managed?
- Do we have an incident response process?
- Are backups and recovery procedures tested?
- Can we provide evidence that our controls are operating?
- Have we performed an internal audit?
If several answers are “No” or “Not sure,” a gap assessment should be the next step.
How Ambsan Can Help With ISO 27001 Readiness
Preparing for ISO 27001 requires more than checking whether a company has security products installed.
Ambsan’s Security Assessment service reviews infrastructure, applications, policies, and configurations to identify vulnerabilities, compliance gaps, and areas requiring improvement. Its approach includes scoping, information gathering, vulnerability analysis, risk evaluation, and actionable reporting.
For organizations preparing for ISO 27001, this type of assessment can help turn a broad compliance goal into a practical remediation roadmap.
Need to know where your organization stands before an ISO 27001 audit?
Contact Ambsan to assess your current security posture and identify the gaps that need attention.
Frequently Asked Questions
What is an ISO 27001 gap assessment?
An ISO 27001 gap assessment compares an organization’s current information security practices with the requirements of ISO/IEC 27001. It identifies missing controls, processes, documentation, and evidence that should be addressed before certification.
Is a gap assessment required for ISO 27001 certification?
A gap assessment itself is not the same as an ISO 27001 certification requirement. However, it is a useful preparation activity because it helps an organization identify and address weaknesses before an external certification audit.
How long does ISO 27001 readiness take?
The timeline depends on the organization’s size, existing security controls, ISMS maturity, scope, risk profile, and the number of gaps identified. A company with mature processes may need less preparation than an organization starting from scratch.
What documents are needed for ISO 27001?
The documentation required depends on the organization’s ISMS and circumstances. Common areas include the ISMS scope, information security policies, risk assessment, risk treatment, applicable controls, records of security activities, internal audit information, and management review evidence.
Can cybersecurity tools alone make a company ISO 27001 ready?
No. ISO 27001 is an information security management standard, not simply a technology checklist. Security technology can support controls, but organizations also need appropriate processes, responsibilities, risk management, policies, evidence, monitoring, and continual improvement.
Final Thoughts
ISO 27001 readiness becomes easier when you stop treating it as a certification document exercise and start looking at how your organization actually manages information security.
Start with your scope. Identify your assets. Assess your risks. Review your controls. Check your documentation. Test what you have implemented. Then create a clear plan for closing the remaining gaps.
A practical gap assessment gives you that starting point.
Ready to assess your ISO 27001 readiness?
Talk to Ambsan about your security assessment and compliance requirements.