ISO 27001 Gap Assessment Checklist

ISO 27001 is worth the effort because it gives customers evidence rather than assurances. As a certified information security management system, it shows buyers, partners and regulators that your security is managed against an international standard, which builds trust and even opens doors with customers who only work with certified suppliers.

It also requires you to identify and treat your risks in a structured way, so weaknesses surface before an incident exposes them, which lets you avoid the emergency response costs, legal liabilities and regulatory fines that follow one. Because it also covers incident response and business continuity, you are better prepared to recover when something does go wrong.

However, achieving ISO 27001 is not without its challenges; it often requires specialised expertise, significant staff time, not to mention a dedicated budget for auditors, consultants and security tools.

This checklist will help you identify where your organisation already meets the requirements of ISO/IEC 27001:2022 and where it falls short. It turns Clauses 4 to 10 and the 93 Annex A controls into questions you can score yourself, so you can direct your time and budget at the gaps that matter.

Important Note

This checklist is a self-assessment tool, not a formal gap assessment. It will tell you roughly where you stand and where an auditor is likely to push, but it can’t replace a structured review, where the standard’s requirements are more nuanced than a single question can capture.

It is provided for informational and guidance purposes only. It doesn’t constitute certification, legal advice, or an endorsement by the International Organization for Standardization, and ISO® is a registered trademark of ISO with no affiliation to Palisade or this article.

Certification is awarded by an accredited certification body, not by us, and you should consult a qualified ISO 27001 auditor or certification body before relying on any assessment, including this one, for a formal certification decision.

ISO 27001 Checklist

Work through the questions below clause by clause and theme by theme, and score each one from 0 to 3 according to how much evidence sits behind your answer. The scale is built around evidence because an auditor treats a control you cannot evidence as one that is not operating, which means your score should reflect what you could show rather than what you believe you do.

0, Not in place. Nothing exists for this yet.
1, Informal. It happens, but it isn’t written down and depends on particular people.
2, Documented. It is written down and followed, but you could not yet hand an auditor proof that it runs.
3, Evidenced. It is written down, followed and backed by records an auditor can inspect, such as approvals, logs or meeting minutes.

If an Annex A control doesn’t apply to how you operate, mark it excluded instead of scoring it, and note why. A question you cannot answer without checking is also worth a note, since “I think so” is a 1 at best. When you have finished, add up the score for each section and use the guidance at the end of the checklist to read the results.

Part One: Clauses 4 to 10 (Management System Requirements)

Clause 4 — Context of the Organisation

Have you identified the internal and external issues that could affect the ISMS reaching its intended outcomes?
Have you listed your interested parties, their relevant requirements, and which of those requirements the ISMS actually addresses?
Have you defined and documented the scope of the ISMS, including the boundaries you chose and why?
Have you established the ISMS itself, along with the processes it needs and how those processes interact?

Clause 5 — Leadership

Can top management show genuine commitment to the ISMS, not just sign-off, including resourcing it and integrating it into business processes?
Have you established an information security policy that top management approved, that is documented, and that has actually been communicated to staff and relevant parties?
Have you assigned and communicated information security roles, responsibilities and authorities, including who reports on ISMS performance?

Clause 6 — Planning

Have you identified the risks and opportunities the ISMS needs to address, and planned how to act on them?
Do you have a documented risk assessment process with defined criteria, one that produces consistent, comparable results and identifies risk owners?
Do you have a documented risk treatment process that selects controls, checks them against Annex A, and produces a justified Statement of Applicability?
Have you set measurable information security objectives, with plans that name who is responsible, by when, and with what resources?
Where the ISMS changes, do you plan those changes rather than let them happen ad hoc?

Clause 7 — Support

Have you determined and provided the resources the ISMS needs?
Have you identified the competence people need for security-relevant roles, and can you provide evidence that they have it?
Are people aware of the security policy, their role in the ISMS, and what happens if they don’t conform?
Have you determined what needs to be communicated about the ISMS, to whom, when and how?
Does your documented information include what the standard requires plus whatever else you’ve judged necessary?
When you create or update ISMS documents, are they properly identified, formatted, reviewed and approved?
Is documented information controlled, so it is available when needed, protected, and managed through its full lifecycle including disposal?

Clause 8 — Operation

Are the processes needed to meet ISMS requirements actually planned, implemented and controlled, including externally provided ones?
Are risk assessments performed at planned intervals or when something significant changes, using your established criteria?
Is the risk treatment plan actually being carried out, with the results documented?

Clause 9 — Performance Evaluation

Have you decided what to monitor and measure about the ISMS, how, when, and by whom?
Do you run internal audits at planned intervals that check conformance and effective operation?
Do you have a documented internal audit programme covering frequency, methods, responsibilities and reporting, with objective auditors?
Does top management review the ISMS at planned intervals?
Does that review cover prior actions, changes in context, performance feedback, audit results and improvement opportunities?
Are management review decisions and any resulting changes documented?

Clause 10 — Improvement

Can you show continual improvement of the ISMS over time, not just at audit season?
When a nonconformity occurs, do you correct it, address the consequences, and evaluate whether corrective action is needed, with the whole cycle documented?

Part Two: Annex A Controls

Annex A has 93 controls across four themes. You don’t need a yes on every one, only a documented, risk-based reason for each no. Where a question doesn’t apply to how you operate, mark it not applicable and record the reasoning, because that reasoning is what your Statement of Applicability needs.

A.5 — Organisational Controls (37)

Do you have an information security policy, approved by management, published and acknowledged by staff, reviewed at set intervals?
Are security roles and responsibilities defined and allocated?
Are conflicting duties segregated so no one person controls a whole sensitive process?
Does management actually hold staff to the policies and procedures you’ve written?
Do you maintain contact with relevant authorities (regulators, law enforcement) where needed?
Do you maintain contact with security interest groups or professional forums?
Do you collect and use threat intelligence relevant to your business?
Is security built into your project management process rather than bolted on afterward?
Do you maintain an inventory of information assets with named owners?
Have you documented acceptable use rules for information and assets?
Do you recover assets from people and parties when they leave or a contract ends?
Have you classified information by its security needs (confidentiality, integrity, availability)?
Do you have labelling procedures that match your classification scheme?
Are there rules or agreements covering how information is transferred, inside and outside the organisation?
Do you control physical and logical access based on business and security requirements?
Do you manage the full lifecycle of user identities?
Is there a process for managing authentication information (passwords, keys, tokens) and guiding staff on handling it?
Are access rights provisioned, reviewed and removed in line with your access control policy?
Do you manage information security risk from suppliers?
Have you agreed security requirements with each supplier appropriate to the relationship?
Do you manage security risk across your ICT supply chain, not just direct suppliers?
Do you monitor and review supplier security practices on an ongoing basis?
Have you defined how you acquire, use, manage and exit cloud services securely?
Have you planned for information security incidents, including roles and communication?
Do you have a process to assess events and decide whether they’re actually incidents?
Do you respond to incidents according to documented procedures?
Do you feed lessons from incidents back into your controls?
Do you have a process for collecting and preserving evidence after a security event?
Do you have business continuity plans that keep security at an appropriate level during disruption?
Have you planned, implemented and tested ICT readiness for continuity?
Have you identified and kept current the legal, regulatory and contractual requirements that apply to you?
Do you have procedures to protect intellectual property rights?
Are records protected against loss, destruction, falsification and unauthorised access?
Have you addressed privacy and PII protection requirements under applicable law?
Is your information security approach independently reviewed at planned intervals?
Do you regularly check compliance with your own policies and standards?
Are operating procedures for information processing documented and available to the people who need them?

A.6 — People Controls (8)

Do you run background checks on candidates before and, where appropriate, during employment?
Do employment contracts spell out each person’s information security responsibilities?
Do people get security awareness and training appropriate to their role, kept current?
Do you have a communicated disciplinary process for policy violations?
Are post-employment and role-change security responsibilities defined, enforced and communicated?
Do you use and regularly review confidentiality or non-disclosure agreements?
Are remote workers protected by appropriate security measures for information they access off-site?
Do people have a clear, timely way to report suspected security events?

A.7 — Physical Controls (14)

Have you defined and applied security perimeters around areas holding information and assets?
Are entry points to secure areas controlled?
Is physical security designed into your offices and facilities rather than added afterward?
Do you monitor your premises for unauthorised physical access?
Are you protected against physical and environmental threats to your infrastructure?
Do you have specific security measures for working in secure areas?
Do you enforce clear desk and clear screen rules?
Is equipment sited and protected appropriately?
Are assets used off-site protected to the same standard?
Do you control storage media across its lifecycle, in line with your classification scheme?
Are information processing facilities protected against power failures and utility disruption?
Are cables carrying power or data protected from interception and damage?
Is equipment properly maintained to preserve availability, integrity and confidentiality?
Do you verify that sensitive data and licensed software are removed before equipment is disposed of or reused?

A.8 — Technological Controls (34)

Are user endpoint devices protected against loss of the information stored on or accessible from them?
Is privileged access restricted and managed?
Is access to information and systems restricted in line with your access control policy?
Is access to source code, development tools and libraries controlled?
Do you use secure authentication technologies aligned with your access policy?
Do you monitor and adjust capacity to meet current and expected demand?
Are you protected against malware, backed by user awareness?
Do you have a process to learn about technical vulnerabilities, assess exposure and act on them?
Are configurations, including security configurations, documented, implemented and reviewed?
Do you securely delete information from systems and devices once it’s no longer needed?
Do you apply data masking where it’s warranted by policy, business need or law?
Do you have data leakage prevention measures on systems that handle sensitive information?
Do you back up information and systems, and actually test the restores?
Do information processing facilities have enough redundancy to meet your availability needs?
Do you produce, protect and analyse logs of activity, exceptions and faults?
Do you monitor networks, systems and applications for anomalous behaviour?
Are system clocks synchronised to an approved time source?
Is the use of utility programs that can override system controls restricted?
Is software installation on operational systems managed securely?
Are your networks and network devices secured and controlled?
Are security mechanisms and service levels for network services identified and monitored?
Are information services, users and systems segregated within your networks where appropriate?
Do you manage access to external websites to limit exposure to malicious content?
Have you defined rules for using cryptography, including key management?
Do you have and apply rules for secure software and system development?
Are security requirements identified and approved when you develop or acquire applications?
Have you established secure system engineering principles for development work?
Do developers follow defined secure coding principles?
Do you run security testing within the development lifecycle?
If development is outsourced, do you direct, monitor and review that work?
Are development, testing and production environments separated?
Are changes to systems and processing facilities run through change management?
Is test data selected, protected and managed appropriately?
Are audit tests and other assurance activities on live systems planned and agreed with the relevant owners first?

Evaluating Your Score

For each section, add up your points and divide by the maximum available, which is three points for every question you scored, leaving out any you marked excluded. A section with 20 scored questions has a maximum of 60, so a total of 39 gives you 65%. Working section by section shows you where the gaps concentrate.

Treat Clauses 4 to 10 differently from Annex A, because the management system requirements apply to every certified organisation and cannot be excluded. A 0 or 1 on any of those questions is therefore a priority gap even when your overall percentage looks healthy.

By completing this checklist, you’ll have a better idea of where the gaps are and where to begin allocating resources to close them. We recommend fixing gaps based on dependency rather than severity. Building your Scope, Statement of Applicability, and Risk Methodology first provides the foundation for everything else. This ensures you only implement the exact security controls your organisation actually needs.

How Palisade Can Help

If you need some assistance, we can help provide an ISO 27001 gap assessment that evaluates your information security management system, policies, risk treatment and evidence against the requirements of ISO 27001. We’ll help you identify what is missing, and what to prioritise for the preparation work ahead of an independent certification audit

Our specialists can also assist with customer security reviews and vendor questionnaires, as well as SOC 2 readiness, Cyber Essentials, and Cyber Trust Mark preparation where relevant.

Book a free scoping call today to find out how we can help your organisation comply with ISO 27001.

The ISO 27001 Gap Assessment Checklist

Important Note

ISO 27001 Checklist