ISO 27001 Gap Assessment

ISO 27001 is the international standard for information security management systems (ISMS). It provides a systematic approach to managing sensitive company information, ensuring it remains secure through a framework of policies, processes, and controls. The latest version, ISO 27001:2022, reorganized the Annex A controls into 4 themes: organizational, people, physical, and technological.

Certification is voluntary but increasingly expected by enterprise clients, regulators, and partners. It demonstrates to stakeholders that your organization has implemented a comprehensive security management system that is independently audited and continuously improved.

ISO 27001 certification involves two stages: a Stage 1 audit reviewing your documentation and ISMS design, followed by a Stage 2 audit evaluating implementation effectiveness. Certificates run on a three-year cycle, with surveillance audits in between and a recertification audit at the end.

Organizational Controls (A.5) cover governance, policies, roles, responsibilities, threat intelligence, asset management, access control, supplier relationships, incident management, business continuity, and compliance. These form the management backbone of your ISMS.

People Controls (A.6) address the human element — screening, terms of employment, awareness training, disciplinary processes, termination procedures, confidentiality agreements, remote working, and event reporting. People are both your greatest asset and your greatest risk.

Physical Controls (A.7) cover physical security perimeters, entry controls, securing offices, monitoring for physical threats, equipment protection, secure disposal, clear desk policies, and storage media management.

Technological Controls (A.8) address technical security measures including user devices, privileged access, access restrictions, source code security, authentication, capacity management, malware protection, vulnerability management, configuration management, data deletion, masking, leakage prevention, monitoring, web filtering, network security, and cryptography.