ISO 27001 gap analysis: how to run one and a free checklist

What an ISO 27001 gap analysis is and why SMEs use one

An ISO 27001 gap analysis is a practical review of where your current security arrangements stand today, compared with what you want them to look like for an ISO 27001-aligned information security management system. In simple terms, it helps you see what is already in place, what is only partly in place, and what is missing.

For a small or medium-sized business, that matters because time and budget are limited. A gap analysis helps you avoid spending money on the wrong things, reduces the chance of last-minute surprises, and gives you a clearer view of business risk. It is often the best starting point if you are trying to understand how much work is really involved before you commit to a bigger programme.

It is also useful even if certification is not your immediate goal. Many organisations use a gap analysis to improve their day-to-day security, support customer due diligence, or prepare for a supplier review. If you are still defining the boundaries of your information security management system, it can help to review your scope definition for small organisations first, because a clear scope makes the rest of the exercise far more manageable.

How it differs from a full audit or certification assessment

A gap analysis is not the same as an audit. An audit is a more formal check against defined requirements, usually with evidence and testing. A gap analysis is earlier and more flexible. It is designed to help you understand where you stand and what needs attention before you get to a formal review.

That distinction is important. If you treat the gap analysis like a pass or fail exercise, people often become defensive and the result is less useful. If you treat it as a planning tool, it becomes much more valuable. You are not trying to prove perfection. You are trying to find the most important weaknesses before they become expensive problems.

What business problems it helps you spot early

A good gap analysis can uncover issues such as unclear ownership, missing policies, weak record keeping, inconsistent access control, poor supplier oversight, or a lack of evidence that controls are actually being used. These are not just paperwork issues. They can lead to wasted effort, customer concern, delayed sales, and avoidable operational disruption.

It also helps you spot where your team may be relying on informal habits rather than repeatable process. That is often where SMEs feel the most pain later, because a process that lives in one person’s head is hard to defend, hard to improve, and hard to scale.

What you need before you start

You do not need a large team or a complex toolset to begin. You do need a sensible starting pack of documents and a few people who understand how the business actually works.

A simple list of documents, policies, and evidence to gather

Before you start, gather the following where available:

• Your current information security policies and procedures.
• A list of systems, services, and locations in scope.
• Your risk assessment and any risk treatment decisions.
• Your Statement of Applicability, if you already have one.
• Records of staff training and awareness activity.
• Examples of access approvals, reviews, or joiner and leaver records.
• Incident logs, backup records, and recovery test results.
• Supplier contracts, reviews, or security questionnaires.
• Internal audit results and management review notes, if available.

If some of these do not exist yet, that is useful information in itself. Missing evidence is often one of the clearest signs of a gap.

If you already have policies but are not sure whether they are complete or practical, it may help to compare them with a guide on the policies and procedures required by ISO 27001. That can save time when you are deciding whether a document is genuinely usable or just sitting in a folder.

Who should be involved from the business

For most SMEs, the right people are the ones who can answer practical questions, not just the people who own the paperwork. That usually includes:

• A senior sponsor who can make decisions and unblock issues.
• The person responsible for day-to-day security or IT.
• Someone from operations who understands how work is actually done.
• Someone from HR or people management if staff processes are involved.
• Someone who manages suppliers or procurement.

You do not need a large workshop. In many cases, a short series of focused conversations is better than one long meeting. Keep the discussion grounded in how the business operates, what could go wrong, and what evidence exists to show the control is working.

How to run a gap analysis in practical steps

The simplest way to run a gap analysis is to work through your current position in a structured way, record what you find, and then turn that into an action plan. The aim is not to create a perfect document. The aim is to produce a clear, honest picture of what needs attention.

Review your current controls against the standard’s requirements

Start by listing the main areas you need to review. For each one, ask three questions: is it in place, is it partly in place, or is it missing? Then note what evidence supports your answer.

For example, if you have an access control process, ask whether it is documented, whether it is followed in practice, and whether there is evidence of regular review. A policy that exists but is never used is only a partial control. A process that works for one team but not another is also a partial control.

If you want a more detailed view of how risk decisions should be handled, our guide to risk assessment and treatment under ISO 27001 is a useful companion piece. A gap analysis becomes much more useful when it is linked to real business risk rather than a simple checklist of documents.

Record gaps, owners, and target dates

Every gap should have three things attached to it: an owner, a target date, and a short description of what needs to change. Without those three items, the exercise becomes a wish list rather than a plan.

Keep the wording practical. For example, instead of writing “improve supplier management”, write “create a supplier review process for critical suppliers and complete the first review by the end of next quarter”. That makes the task easier to track and easier to explain to leadership.

It is also worth noting whether a gap is a quick fix or a longer-term improvement. Some issues can be resolved in days, such as missing evidence or an outdated document. Others, such as improving backup testing or formalising supplier oversight, may need more time and coordination.

Prioritise the biggest business risks first

Not every gap has the same impact. Focus first on the issues that could affect customer trust, service continuity, legal obligations, or the business’s ability to recover from an incident. In practice, that often means prioritising access control, backup and recovery, incident handling, supplier risk, and the clarity of your overall scope.

This is where many SMEs get the most value. If you try to fix everything at once, progress slows and people lose momentum. If you start with the highest-risk items, you reduce exposure sooner and build confidence in the process.

Areas to check in your ISO 27001 review

A useful gap analysis should cover both the management side of the system and the practical controls that support it. The following areas are a sensible starting point for most SMEs.

Scope, context, and interested parties

Check whether your scope is clear, realistic, and aligned to the parts of the business that matter most. You should also consider whether you have identified the people and organisations that depend on your information security arrangements, such as customers, suppliers, and internal teams.

If the scope is too broad, the project becomes harder than it needs to be. If it is too narrow, you may miss important risks. A good scope is specific enough to be manageable, but broad enough to cover the real business environment.

Risk assessment and risk treatment

Look at whether risks are identified in a consistent way, whether they are assessed using a sensible method, and whether treatment decisions are recorded. The key question is not whether every risk is removed. It is whether the business has made informed decisions about what to do with each important risk.

For many SMEs, the biggest weakness is not the risk list itself. It is the lack of follow-through. Risks are identified, but actions are not tracked, reviewed, or completed.

Statement of Applicability

Your Statement of Applicability should show which controls are relevant, which are not, and why. It should also reflect what you actually do, not what you hope to do one day. If your controls have changed, the statement should change with them.

This document often reveals whether the system is being maintained or has drifted. If it is out of date, that is usually a sign that other parts of the system may also need attention.

Policies, procedures, and records

Check whether your key documents are current, approved, and used in practice. Then check whether you can show evidence that the process is followed. A policy without records is weak. Records without a policy are also weak, because they suggest the business is acting without a clear standard.

If you are unsure what should exist, our article on policies and procedures required by ISO 27001 can help you separate essential documents from nice-to-have extras.

Internal audits and management review

Check whether you have a plan for internal audits and whether management reviews happen often enough to be useful. These are not just formalities. They are how you spot drift, confirm that actions are being completed, and keep leadership involved.

If these activities are missing, the system can quickly become static. That usually means the business only finds problems when a customer asks a difficult question or when a formal review is due.

Our guide to internal audits under ISO 27001 explains what SMEs should test and is a good next step once you have identified the main gaps.

Incident handling, backup, access control, and supplier management

These are some of the most business-critical areas to review because they affect how quickly you can respond to problems and how much damage those problems can cause.

• Incident handling: Can staff recognise and report an issue quickly, and is there a clear response process?
• Backup: Are backups being taken, protected, and tested so you know they can be restored?
• Access control: Are people given the right access, removed promptly when they leave, and reviewed regularly?
• Supplier management: Do you know which suppliers are important, what they handle, and how they are reviewed?

These are often the controls that matter most to customers and leadership, because they directly affect service continuity and loss exposure.

A simple free checklist you can use

You do not need a complicated template to get started. A simple checklist is often enough for the first pass, especially if your goal is to understand the size of the task rather than produce a polished report.

Checklist structure for small teams

Use a table with five columns:

• Area to check.
• What good looks like.
• Status.
• Evidence seen.
• Action needed.

Keep the checklist short enough that someone can actually complete it. If it becomes too long, people stop using it. For most SMEs, a first pass should fit on a few pages, not a binder.

How to score each item as in place, partial, or missing

A simple three-point score works well:

• In place means the control exists, is used, and evidence is available.
• Partial means the control exists but is inconsistent, incomplete, or not well evidenced.
• Missing means the control does not exist or is not being used in practice.

This scoring method is easy to explain to non-specialists and helps you compare areas without pretending that every gap is equally serious. If you want to automate evidence gathering later, our article on automating ISO 27001 evidence collection using GRC tools may be useful once your manual process is stable.

How to turn findings into an action plan

A gap analysis only creates value if the findings are turned into action. That means deciding what happens next, who owns it, and how progress will be tracked.

Set realistic priorities and deadlines

Start with the highest-risk items and the easiest wins. Quick improvements build momentum, while the larger items can be planned properly. Be realistic about capacity. If your team is already stretched, it is better to complete three important actions well than to launch ten and finish none of them.

Use deadlines that reflect the real effort involved. A deadline should be challenging, but not so aggressive that it encourages shortcuts or superficial fixes.

Decide what to fix internally and when to get help

Some gaps can be handled in-house, especially if they involve updating documents, assigning ownership, or improving existing routines. Other gaps may need outside support, particularly if you need help interpreting requirements, building a practical plan, or reviewing a complex area such as supplier risk or evidence collection.

The right question is not whether you can do everything yourself. It is whether doing it yourself is the best use of your time and whether the result will be robust enough for your business needs.

Common mistakes SMEs make during gap analysis

Most problems in a gap analysis are not technical. They are process problems. The good news is that they are avoidable.

Treating it like a paperwork exercise

If the review becomes a hunt for documents only, you can miss the real issue, which is whether the business is actually managing risk. A neat folder does not mean the control is working. Focus on how the business behaves, not just what it has written down.

Leaving evidence collection until the end

Evidence is easier to gather while you are reviewing each area, not after the fact. If you wait until the end, people forget details, files are harder to find, and the final report becomes less reliable.

Trying to fix everything at once

It is tempting to turn every gap into an immediate project. That usually leads to overload. A better approach is to prioritise, sequence the work, and keep the plan visible. Small, steady progress is more effective than a burst of activity that cannot be sustained.

When to repeat the gap analysis

A gap analysis should not be a one-off exercise. It is most useful when it is repeated at sensible points, so you can see whether the business is improving or drifting.

After major business or technology changes

Repeat the review after significant changes such as a new office, a major system change, a merger, a new supplier model, or a change in how staff work. Those changes can alter your risk profile quickly.

Before an external audit or supplier review

It is also wise to repeat the gap analysis before a formal external review or a major customer assessment. That gives you time to fix obvious issues, gather evidence, and avoid unnecessary pressure later.

For some organisations, the next step is also to compare the work with a broader framework or related business requirement. If that applies to you, our article on mapping NIST CSF to ISO 27001 in practice can help you see how the pieces fit together without duplicating effort.

Final thoughts

An ISO 27001 gap analysis is one of the most useful early steps an SME can take if it wants a clearer view of security maturity, effort, and risk. Done well, it gives you a practical roadmap rather than a vague sense that “more work is needed”.

Keep it simple, keep it honest, and keep it tied to business priorities. That approach will give you a far better result than trying to make the process look more formal than it needs to be.

If you would like help turning a gap analysis into a realistic action plan, or want a second opinion on where to focus first, you can Speak to a consultant.

Frequently asked questions

Is there a free ISO 27001 checklist available?

Yes. A simple free checklist can be built from the main areas covered in this article, using a table with the area to check, what good looks like, status, evidence seen, and action needed. For most SMEs, that is enough to start a useful gap analysis without buying a complex tool.

How do I prepare for an ISO audit checklist?

Start by reviewing your scope, risk assessment, Statement of Applicability, policies, records, internal audits, management review, incident handling, backup, access control, and supplier management. Then score each item as in place, partial, or missing, and turn the gaps into a tracked action plan before any formal review.