ISO 27001:2022 Gap Analysis Tool

Fully aligned with ISO 27001:2022

The ISO 27001:2022 Gap Analysis Tool will help your organization identify the extent to which its control stance meets the guidance in the Standard.

This tool is designed to support your organization in its initial project planning of the ISMS (information security management system) security controls, and quickly and easily map your current information security measures against ISO/IEC 27001:2022 and Annex A controls aligned to ISO/IEC 27002:2022 requirements. The ISO 27001 requirements and Annex A reference control categories are on different tabs within the workbook, so you can clearly establish areas for development and plan and prioritize your project effectively.

There is also an executive summary tab with tables that automatically analyze the inputted responses, showing the number of questions completed, how many controls have been fully implemented, and implementation progress for each control category.

What does the tool do? 

• A self-assessment questionnaire covering requirements from Clauses 4–10 of ISO/IEC 27001:2022 and 93 Annex A ISO/IEC 27002:2022 controls.
• An Excel workbook separated into ISO 27001 requirements and the four control categories: Organisational, People, Physical, and Technological. Each control category has its own tab for ease of use.
• The ability to use your own document references against specific clauses and add issues and comments, so you can track and organize your project.
• An executive summary tab with tables that show, by ISO 27001 clause and ISO 27002 control category, gap analysis questions completed, control category implementation percentages, and implementation progress.
• A clear indication of compliance, and comprehensive analysis of your compliance against the Standard, to highlight areas of development and help you plan and prioritize your project effectively.

The tool is designed to work in any Microsoft environment; it does not need to be installed like software, and does not depend on complex databases. It is reliant on human involvement.

The tool is not designed for conducting a detailed gap analysis or audit, which require granular compliance assessment. If you require specialist help in this area, please contact us.

For more information, read our FAQ here.