ISO27K

ISO 27001 gap assessment tool

Six questions across the clause requirements and the four Annex A themes. The score, the blocking items and the order to work in all appear on this page.

Last reviewed 2026-08-27Written by Jacob Masse, TrazTech Inc.

Answer honestly against what you could produce evidence for this afternoon, not against what your policies say. The gap between those two is the actual gap, and it is invisible to any assessment done on documents alone.

The score, the items blocking a stage 2 audit and the sequence to work in all appear on this page with nothing asked for.

Which of these exist and are current?

The clause requirements. This is the half that gets skipped, and it is where first certifications fail.

A.5, organizational controls: which of these could you evidence?

Thirty-seven controls sit under A.5. These are the ones auditors sample first.

A.6, people controls
A.7, physical controls

If you have no premises in scope, say so. Several of these controls are then excludable, with justification.

A.8, technological controls

Thirty-four controls. These are the ones with the most direct evidence, and the ones a compliance platform helps with.

How long have these been running as recorded practice?

The one thing money cannot accelerate. Stage 2 auditors sample records over a period, so this often sets your date.

How the score works, and what it is not

The clause requirements carry more weight than the Annex A themes, which is deliberate and reflects where first certifications actually fail. A company can close every technical control and still fail stage 2 for having no documented scope, no internal audit and no management review. The operating period carries weight of its own, because records take calendar time that no budget shortens.

This is a self-assessment and it has the limits of one. It cannot tell you whether what you consider evidence would satisfy an auditor, which is the judgement a paid assessor is actually selling. Use it to decide what to buy and where to start, then read what a good findings report contains before commissioning the real thing.

Common questions

Does this replace a paid gap assessment?

No. It replaces the first two weeks of one. A self-assessment cannot calibrate whether your evidence would satisfy an auditor, and that judgement is what an assessor is selling. What it does is stop you commissioning an assessment that spends its first week on discovery you could have done yourself in a day.

We scored well but have only been running a month. What does that mean?

It means your documentation is ahead of your evidence, which is the normal position and not a bad one. The constraint on your certification date is now calendar time rather than work: stage 2 auditors sample records over a period, usually at least three months. Start the periodic activities immediately and book the certification body, since scheduling a stage 2 can take two months on its own.

Do we really need all 93 Annex A controls?

You need a recorded decision on all 93, which is different. Controls you exclude need a justification tied to your risk assessment, and the valid exclusions are ones where the underlying activity does not exist in your organization. A company with no premises can exclude parts of A.7 on that basis. Inconvenience is not a justification an auditor accepts.