ISO 27001 gap analysis: how it works and who runs it

What an ISO 27001 gap analysis tells you before you pay for certification

An ISO 27001 gap analysis compares your current practice with every mandatory requirement in clauses 4 to 10 and with the 93 Annex A controls, then turns the differences into a prioritized list of gaps. Clause 1 states that none of the clause 4 to 10 requirements can be excluded, so the review cannot skip the management system clauses just because the technical controls look strong. The result is not a pass or fail. It is a working list that shows what must be built, what must be documented, and what already exists but has no evidence behind it.

The size of that list depends on several factors you can check before asking anyone for a quote. The number of sites, business units and people in the scope drives how many processes and records the reviewer must sample. The amount of existing documentation matters, because a policy that exists but is never followed produces a different finding than a missing policy. If you are moving from the 2013 edition, the review must also cover the changes in the 2022 control set, which IAF MD 26:2023 summarizes as 11 new, 24 merged and 58 updated controls. Confirm with your own team which of these apply, because they change the effort more than the headcount does.

Decide early who performs the review. Your organization owns its controls and its risk decisions, so the people who run them should be involved in every finding. An implementation partner can prepare systems, policies and evidence, and a reviewer from outside the organization can test them. Only an independent auditor or certification body issues a report or certificate. Ask any firm to state in writing which of these roles it will play, and confirm that it will not also perform the internal audit that clause 9.2 requires, since that separation affects whether a certification body will accept your results later.

How an ISO 27001 gap analysis runs from scope to findings

A gap analysis runs in a fixed sequence: confirm the scope and interested parties, review what exists, test each control against practice, record every gap with its evidence, and hand a ranked findings register to the implementation plan.

Confirm the draft ISMS scope
The organization, with the assessor, checks the draft scope of the information security management system against clause 4.3, which covers the boundaries, the products, services, locations and systems in or out of scope, and the interfaces with outside parties. The same step identifies the interested parties and their information security requirements under clause 4.2, such as customers, regulators and contract counterparties. The output is a written scope statement and a list of interested parties that the rest of the analysis tests against. The step is complete when the organization signs off that the scope matches what it actually operates. Ask the assessor how the scope will be confirmed before any document review starts.
Review existing policies and records
The assessor reads the current policies, procedures, risk records, meeting minutes and management review material against clauses 4 to 10, which cover context, leadership, planning, support, operation, performance evaluation and improvement. Clause 1 does not allow any of these requirements to be excluded, so each one needs a documented answer, even where the answer is that nothing exists yet. The output is a clause-by-clause map that marks each requirement as documented, partly documented, or missing. This step shows whether the management system is designed on paper before anyone tests whether it runs. Ask for the clause map as a named deliverable in the written scope.
Test each Annex A control against practice
For each of the 93 Annex A controls, the assessor compares what the organization says it does with what it actually does. The test combines document review, interviews with the people who operate the control, and sampling of evidence such as access reviews, change tickets, training records and supplier reviews. Controls are tested in the groups set by the four Annex A themes, so organizational, people, physical and technological controls each get the right interviewees. The output is a control-by-control worksheet that records the observed practice and the evidence sampled. A control is only complete when its evidence was inspected, not when someone said it exists.
Record each gap with its evidence
Each shortfall found in the clause review or the control testing becomes a gap entry. The entry states the requirement or control, what was expected, what was observed, the evidence that supports the observation, and who owns the area. Gaps are recorded whether they are missing controls, controls that exist but do not run consistently, or evidence that cannot be produced on request. The output is a gap log in which every entry can be traced back to a sample or document. Ask the assessor to show the evidence behind each finding, since findings without evidence are difficult to act on or to defend later.
Assign risk-based priorities
The assessor and the organization rank each gap by the risk it leaves open, using the organization's risk criteria and the risk assessment already in place. The ISO 27001:2022 introduction states that the order of its requirements does not reflect their importance, so a clause 4 gap can outrank a clause 9 gap if the exposure is greater. Priority also reflects dependencies, since a missing risk assessment delays the Statement of Applicability and the treatment plan. The output is a priority rating on every gap with a short reason. Confirm that the priority scheme is written down, so the ranking can be explained to a certification body later.
Produce the findings register
All gaps, their evidence and their priorities are consolidated into one findings register. The register lists each finding, its owner, the affected clause or control, and the recommended remediation action. It also notes any findings that depend on another, so the sequence of work is clear. The output is a register that becomes the input to the implementation plan, which turns each finding into tasks, policies, control changes or evidence collection. The step is complete when the organization accepts the register and assigns owners. Ask whether the register will be delivered in a format the internal team can keep updating.
Hand findings to the implementation plan
The organization, not the assessor, decides how each finding is fixed and who fixes it. The implementation plan schedules remediation, updates the Statement of Applicability where control decisions change, and defines the evidence each fixed control will produce. Where an outside implementation partner prepares systems or evidence, its work is tied to specific register entries in the written scope. The output is an implementation plan linked to the findings register, so every gap has a remediation owner and a verification step. Ask for this linkage explicitly, because a gap analysis that does not drive remediation has little value.

What must exist before an ISO 27001 gap analysis can start

A gap analysis compares your current practice with clauses 4 to 10 and the 93 Annex A controls, so it can only be as accurate as the material behind it. The six inputs below are what the reviewer needs from your organization before the first interview. Check each one before you book the work, because a missing input usually shows up later as an open finding or wasted review days.

A draft ISMS scope

Write down which products, services, sites, business units and legal entities sit inside the management system, and which sit outside. Clause 4.3 requires the scope to be documented and to state any boundaries and applicability. Check that the draft names the systems and teams it covers and that it can be stated in a few sentences. If it is missing, the reviewer cannot tell which controls apply, and the gap analysis may cover the wrong estate.

Asset inventory and systems in scope

List the information assets and the systems that store, process or transmit that information, with an owner for each. Include endpoints, cloud accounts, databases, backups and key business applications. Check that the list matches the scope draft and that owners can name the data classes they hold. If the inventory is missing or stale, the reviewer will rebuild it from interviews, which takes longer and misses shadow systems.

Risk assessment and treatment approach

Provide the current risk assessment, or at minimum the method you intend to use, the risk criteria and any risk register. Clause 6.1.2 and 6.1.3 require a defined approach and a risk treatment plan. Check that the criteria state how likelihood and impact are scored and who approves risk acceptance. If nothing exists, the reviewer can only test the method and cannot confirm that controls were chosen for real risks.

Current policies and procedures

Collect every policy, standard, procedure and runbook that touches information security, even if it is informal, unapproved or stored in a wiki or ticket. Check whether each item has an owner, a date and evidence of use. Informal practice is still practice, so unwritten rules should be recorded as they are. If documents are missing entirely, the reviewer will record gaps across most Annex A organizational controls.

Supplier and cloud service register

List each supplier, hosting provider, software-as-a-service tool and outsourced service that handles in-scope information, with the contract owner and the data involved. Include the cloud accounts and regions in use. Check whether contracts, security terms and any independent reports you hold are on file. If this register is absent, supplier controls cannot be assessed, and the reviewer will have to request the same documents later.

Access to people and system records

Name the people who can explain each process, such as HR, IT operations, engineering and facilities, and confirm they can make time for interviews. Arrange read access to logs, access reviews, change tickets, training records and incident history so samples can be pulled. Check that your own staff can produce records without rebuilding them. If access is delayed, the reviewer can record only what people say, which assessors treat as weaker evidence than records.

Why a certification body pre-audit is not a gap analysis

A certification body pre-audit is a visit by the body that will later certify you, so it answers a different question from a gap analysis. A gap analysis asks where your current practice falls short of clauses 4 to 10 and the 93 Annex A controls, and it is designed to help you fix those shortfalls. European Accreditation FAQ 48.11 (September 2024) records that certification bodies may offer a pre-audit before stage 1 only if impartiality is not compromised, and that no pre-audit may sit between stage 1 and stage 2. The body must also weigh the added impartiality risk in its own risk assessment before it offers one.

A pre-audit cannot stand in for the stage 1 audit. The guidance is explicit that it cannot be used as the stage 1 audit, so you still need the formal stage 1 review of documented information and readiness that the body reports on. European Accreditation FAQ 49.2 (March 2025) adds that preliminary audits sit outside the certification process, and that repeated preliminary visits checking whether earlier problems were solved amount to taking part in building the management system. A certification body that does this has moved from assessor into designer, which is why it should not be your design reviewer. Ask any body whether its preliminary audit is a single visit, what it will and will not report, and how it documents its impartiality decision.

Under European Accreditation FAQ 49.4, a certification body may not provide internal information security reviews of an ISMS it certifies, so a pre-audit cannot double as your internal review. Plan for the pre-audit to show where an auditor would likely raise a problem, then treat those findings as inputs to your own gap analysis and implementation plan. Assign an owner to each finding, decide the fix yourself or with an independent consultant, and expect the certification body to tell you what it found, not how to fix it. Confirm the scope, fees and written terms of any pre-audit before you book it.

What makes an ISO 27001 gap analysis take more or less effort

A gap analysis compares current practice with clauses 4 to 10 and the 93 Annex A controls, so its effort follows how much of the organization sits inside the scope, how mature the existing records are, and how many people must be heard. The cards below cover the drivers that move that effort and the steps that reduce each one.

People, sites, systems and suppliers in scope

Every person, location, system and supplier inside the ISMS boundary must be checked against the requirements and controls. A gap analysis for a single office with one cloud account is far shorter than one covering several countries, data centers and outsourced operations. Before you start, write down the boundary and the count of each element, and ask whether any part can be placed in a defined boundary for the first pass.

Maturity of documentation and records

Reviewers spend most of their time finding evidence. Organizations with current policies, asset registers, access reviews and incident logs can test each control quickly, while those that rely on memory or scattered files need to reconstruct history. Sample a few controls from each theme before committing to a timeline, and note which records are missing, out of date or never produced.

Existing certification to ISO/IEC 27001:2013

Organizations moving from the 2013 edition to the 2022 edition face a different task. IAF MD 26:2023 required a gap analysis of the changes, which the certification body reviewed in the transition audit alongside the updated Statement of Applicability. Map the 2013 controls to the 2022 set, identify the new and updated controls, and confirm with your certification body what evidence it expects for the change review.

Justified exclusions from Annex A

Annex A controls can be excluded when they are not necessary for the ISMS, but the exclusion must be justified and recorded. Each exclusion widens the review because the gap analysis must confirm the reason holds. Clauses 4 to 10 cannot be excluded at all. Review the list of exclusions early, document a rationale for each one, and remove any exclusion that the risk assessment does not support.

Staff who must be interviewed

Many Annex A controls depend on people, not documents, so the assessor must talk to owners in HR, engineering, facilities, procurement and operations. The number and availability of those people drive the calendar more than the document count. Build an interview list from the Statement of Applicability, book time with each owner in advance, and prepare short questions so each conversation can be closed in one session.

Preparing evidence before the review

Gap analysis findings multiply when evidence is hard to retrieve. Collecting logs, approvals, training records and supplier reviews into one location before the analysis begins lets reviewers test controls directly. Confirm who owns each evidence source, how long it is kept, and whether it can be exported without manual effort. Gaps found in this preparation are cheaper to fix than gaps found during a formal audit.

Who can perform the gap analysis, and what each choice gives you

This table compares four ways to run an ISO 27001 gap analysis: an in-house team, an implementation partner, an independent readiness assessor and the certification body's pre-audit. Read each row to see what the option is good for, what it cannot give you and when it fits, then confirm scope and deliverables in writing before work starts.

Option	Good for	Cannot provide	When it fits
In-house team using ISO/IEC 27003 guidance	Building internal knowledge, mapping current practice to clauses 4 to 10 and the 93 Annex A controls, and producing a findings list the team owns	A certificate, an independent opinion accepted by a certification body, or assurance that blind spots were caught	Teams with time, security staff and an internal audit function that can review work they did not build
Implementation partner such as DeployOpen	Preparing systems, controls and evidence, and turning gaps into a sequenced implementation plan inside the client's own infrastructure	Issuing audit reports or certificates, deciding conformity, or acting as the organization's management representative	Organizations that need hands-on build capacity alongside the gap findings, under a fixed written scope
Independent readiness assessor or consultant	An outside review of current practice against the standard, often with a clear list of gaps and priorities	A certificate, or a stage 1 or stage 2 decision. Ownership of the ISMS stays with the organization	Organizations that want an independent view but will build the controls with their own staff or another party
Certification body pre-audit	A preview of how an accredited body may approach the audit, before stage 1	Acting as a stage 1 audit, or certifying the ISMS. Repeated pre-audits to check fixes can amount to designing the system the body will certify	Use only as a limited preview. Confirm with the body how it manages impartiality risk for the pre-audit
Independence constraint	The certification body must not design the ISMS it later certifies, so keep design work out of its hands	Internal audit under clause 9.2 should stay separate from the people who built the controls, where practical	Check who designed each control and who reviews it before choosing a provider

Who does what in a gap analysis and the work that follows

The organization owns the information security management system and every decision inside it. A gap analysis compares current practice with clauses 4 to 10 and the 93 Annex A controls, but the findings only become a plan when the organization's leaders accept them. Management must set the scope, accept the risk treatment choices, approve policies, and sign the Statement of Applicability. Staff who run the controls day to day must answer questions honestly, because a gap analysis built on guesses produces a plan that fails at audit.

Risk decisions: Leaders decide which risks to accept, reduce or transfer, and they record the reasons.
Statement of Applicability: The organization justifies each included and excluded Annex A control and keeps it current.
Policies and sign-off: Owners approve policies, procedures and the remediation priorities that follow the gap analysis.
Control operators: Engineers, HR and facilities staff explain how controls really run and provide the records.
Internal audit: Staff independent of the work check that the system operates as documented.

Confirm with any partner which decisions your own leaders must take and which evidence your teams must produce, because these cannot be delegated.

How to check a gap analysis provider before you sign

A gap analysis is only as useful as the independence and scope behind it. The checks below give procurement teams written questions to put to any provider, covering who does the work, what is in scope, how findings are ranked and where the provider's advice stops and the auditor's review begins.

Separate the gap analysis from certification

Ask in writing whether the provider, or any firm in its group, is also the certification body that will audit the same ISMS. Only an independent accredited certification body issues an ISO 27001 certificate, and European Accreditation guidance says a certification body may not provide internal information security reviews of an ISMS it certifies. A provider that is also the auditor has a conflict that should be disclosed before work starts, and it may need to be resolved by using a different body.

Confirm who does the work

Ask for the names and roles of the people who will perform the analysis, and ask them to describe their hands-on experience with ISO/IEC 27001:2022 clauses 4 to 10 and the Annex A controls. Do not assume a credential answers the question. Ask whether the team has reviewed organizations through a certification cycle, and whether anyone on the team will also act as an internal auditor later, since that role carries its own independence rules.

Require a written scope

A usable scope statement lists every clause from 4 to 10, because none of those requirements may be excluded, and names the Annex A controls covered by the analysis. It also identifies the sites, business units, cloud accounts and systems in the ISMS boundary, and the deliverables with their format. Ask the provider to show how it will check the Statement of Applicability against current practice, so the scope and the controls stay aligned.

Ask how findings are ranked and evidenced

The standard's introduction notes that the order of its requirements does not reflect their importance, so a good analysis ranks findings by risk to the organization rather than by clause number. Ask how each finding will be rated, what evidence supports it (configuration exports, policy documents, interview notes, sampled records) and whether each gap is linked to the risk treatment plan. Findings without evidence are opinions and will not help a certification body judge readiness.

Confirm what the organization must provide

Ask for a dated list of the documents, system access, staff interviews and sample records the provider needs, and who on the client side owns each item. Ask what happens when a deliverable is late, and how many review rounds are included in the fixed scope. Most gap analyses slow down because the client has not named an owner for access or evidence, so the schedule should show those dependencies before work begins.

Ask where advice stops and audit begins

Ask how the provider separates its recommendations from the independent review that the certification body performs. Advice on how to design a control is appropriate, but the provider should not rehearse the auditor's findings or repeatedly test whether earlier problems were fixed, since European Accreditation guidance treats repeated preliminary audits as helping to develop the management system. Ask who owns the final decisions on controls and the Statement of Applicability, and get that boundary written into the contract.

How ISO 27001 gap findings feed the implementation plan

A gap analysis only helps if its findings become a plan with owners and deadlines. Start by turning every gap into a row in a findings register that records the clause or Annex A control it relates to, the current state, the evidence that would prove the fix, a risk rating, and an owner. Then group the rows two ways. The first grouping is by risk: gaps that expose customer data, production systems or regulated services go to the top, whatever clause they sit under. The second is by dependency. A missing risk assessment blocks the Statement of Applicability, and the Statement of Applicability in turn blocks the policies that cite it. Work that other work depends on must be sequenced first, even when it looks less urgent. The standard's introduction says its requirements are not ordered by importance or by the order of implementation, so clause numbers are a poor guide to sequence.

The Statement of Applicability is the place where the plan and the controls meet. Every one of the 93 Annex A controls should be marked as implemented, planned or excluded, and each exclusion needs a stated reason. Link each planned control to a finding, an owner and a target date, and link the risk treatment plan to the same findings so that a control's justification traces back to a risk. Confirm with the certification body which format it expects for the Statement of Applicability, since the wording and level of detail it accepts can vary. Once the work is done, repeat the gap assessment against the same register and record what closed, what did not and why. Use the clause 9.2 internal audit as a later check on whether the management system operates as described, but do not treat it as a substitute for the certification body's stage 1 and stage 2 audits, which only an accredited body can perform and certify.

What makes a gap analysis fail to produce a usable plan

A gap analysis only helps if its findings are evidenced, scoped and prioritized. The six pitfalls below are the ones that most often turn a readiness review into a list nobody can act on, and each one has a specific check that prevents it.

A gap list without evidence or priority

A gap list that says a control is missing, with no record of what was checked, stalls the plan because nobody can tell which items are urgent or what closing them requires. For each finding, record the clause or Annex A control, the evidence reviewed, the people interviewed and a risk-based priority. ISO/IEC 27001:2022 states that the order of its requirements does not set their importance, so ranking by risk is the reviewer's expectation, not a shortcut. Ask whether every line can be traced to something the assessor would sample.

A scope too broad or too vague to test

A scope that says "the whole company" or lists systems without boundaries makes the gap analysis either unmanageable or impossible to verify. Pin down the business units, locations, services, data and suppliers inside the ISMS, and state the interfaces with anything outside it. Confirm that clauses 4 to 10 apply in full, since none of them may be excluded. A scope that is written precisely lets the analysis test real systems rather than intentions.

Copying policy templates without checking practice

Policies adopted from a template describe what the organization says it does, and interviews and records show what it actually does. Gaps appear when staff cannot explain a documented procedure, or when access reviews, incident logs or training records do not match the policy. During the gap analysis, sample each policy against operating evidence such as tickets, logs, approvals and meeting minutes. Mark a control as partially met until the practice is shown, not just written down.

Treating ISO/IEC 27002 as a certifiable standard

ISO/IEC 27002:2022 gives guidance on the Annex A controls, and ISO states that it cannot itself be certified to. Gap analyses that score the organization against 27002 chapters, or promise a "27002 certificate", measure the wrong thing. Certification is tested against the requirements of ISO/IEC 27001:2022 and the Annex A controls it lists. Use 27002 as a reference for what a control intends, and use the 27001 clauses and the Statement of Applicability as the basis for the findings.

Using a pre-audit as a free design review

A certification body's pre-audit can look like a cheap way to get expert feedback, but European Accreditation guidance accepts a pre-audit only before stage 1 and only if impartiality is protected. Repeated preliminary audits that check whether earlier problems were fixed amount to helping build the management system, which the certification body may not do. Use an independent gap analysis to design the fixes, and treat the pre-audit as a limited readiness check. Ask the body in writing what it will and will not review.

Skipping the 2022 changes after the 2013 edition

Organizations certified to the 2013 edition that move to the 2022 edition must work through what changed. IAF MD 26:2023 expects a gap analysis of the changes, which the certification body reviews in the transition audit alongside the updated Statement of Applicability. The Annex A set fell from 114 controls in 14 clauses to 93 controls in 4 clauses, with 11 new controls, 24 merged and 58 updated. Map each old control to its successor, identify the new controls and confirm each one has an owner and evidence.

Questions buyers ask before hiring help for an ISO 27001 gap analysis

Can our own team run an ISO 27001 gap analysis without an outside provider?

Yes, in most organizations an internal team can run a gap analysis, because the work is a comparison of current practice against the requirements. The organization owns the result either way. The standard expects the organization to know its own context, scope and risks, so staff who know the systems and processes are needed in every case. An outside provider adds value when the team lacks experience reading clauses 4 to 10 and the 93 Annex A controls, or when internal staff cannot judge their own gaps objectively. The guidance in ISO/IEC 27003:2017 explains each requirement and can support an in-house review. Confirm with any provider which parts of the work their staff will do and which must stay with your people.

Is a gap analysis required before ISO 27001 certification?

The standard does not require a gap analysis by name, but it does require that you meet every mandatory requirement in clauses 4 to 10 and address the Annex A controls in your Statement of Applicability. Clause 1 states that none of the clause 4 to 10 requirements may be excluded. A gap analysis is the most practical way to show that each clause and each relevant control has been checked against your current practice before the certification body arrives. Organizations that skip it often discover missing evidence during stage 1 or stage 2 audits, which costs time. Treat the gap analysis as a method for meeting the requirements, not as a certification step in its own right.

How long does an ISO 27001 gap analysis take and what sets the pace?

The duration depends on how much of the management system already exists, how many sites and systems are in scope, and how quickly staff can provide documents and interviews. A narrow scope with written policies and recorded risk decisions moves faster than a scope with undocumented processes across several sites. No standard duration is fixed by the standard itself, so ask the provider to give a timeline based on your scope and to list the assumptions behind it. Ask for the number of interviews, the documents they will review and the decision points where your leadership must respond. Confirm the expected duration with the provider in writing before work starts.

What does a gap analysis need from our staff?

The work needs time from people who run the controls, not only from the security team. Expect requests for policy documents, asset and risk records, access reviews, incident logs, supplier contracts and evidence of training. Leadership must confirm the scope, the context of the organization and the risk appetite, because a gap analysis cannot judge against priorities that have not been set. Staff who operate systems will need to show how controls work in practice, which is often where gaps appear. Ask the provider to name the roles they will interview and to agree a document request list at the start, so that delays are visible early.

Does a certification body pre-audit replace a gap analysis?

No, a pre-audit does not replace a gap analysis, and its role is limited. European Accreditation FAQ 48.11 records that a certification body's pre-audit before stage 1 can be acceptable if impartiality is not compromised, but a pre-audit cannot be used as the stage 1 audit. European Accreditation FAQ 49.2 adds that preliminary audits sit outside the certification process, and that repeated preliminary audits checking whether earlier problems were fixed can amount to helping develop the management system. A certification body may not perform internal information security reviews of the ISMS it will certify, as set out in European Accreditation FAQ 49.4. An independent gap analysis from a separate provider keeps the certification body impartial.

Who owns the Statement of Applicability after a gap analysis?

The organization owns the Statement of Applicability. A gap analysis can list which Annex A controls apply, which are implemented and where the gaps lie, and the provider may draft it as input. The decisions about which controls are necessary, why any are excluded and what status each carries belong to your management, backed by your risk assessment. A provider can help document those decisions, but must not make them for you. Ask who writes the first draft, who approves each justification for exclusion and how the Statement of Applicability will be kept in step with the risk treatment plan as the implementation proceeds.

What does a gap analysis not give us?

A gap analysis is not a certificate, an audit report or an attestation. Only an accredited certification body can issue an ISO 27001 certificate after its audit, and only an independent assessor can issue an audit report. A gap analysis produces findings, prioritized actions and evidence requirements, which feed the implementation plan. Its findings are a snapshot of current practice and do not show that controls operate over time. Customers who ask for proof of certification will need a certificate from an accredited body, not a gap report. Make sure your internal teams, customers and contracts do not describe a gap analysis as a certification.

What should we ask for in a written quote for a gap analysis?

A written quote should follow a written scope, and it should state the deliverables, the timeline and the assumptions behind them. Ask the provider to list the clauses and Annex A controls they will assess, the sites and systems in scope, the interviews and document reviews included, and the form of the final report. Check whether the quote covers prioritized remediation advice, a gap register and a draft implementation plan, and whether it excludes re-assessment after fixes. Confirm which work the provider will perform and which work your staff must do, and ask how changes to scope are priced. DeployOpen agrees scope, deliverables and timelines in writing before work starts and does not publish a price list, so a quote follows from that written scope.

How DeployOpen scopes and prepares ISO 27001 gap work

DeployOpen is a Chainscore Labs company that plans, implements, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For ISO 27001 gap work, we prepare the systems and evidence that let your team compare current practice with clauses 4 to 10 and the Annex A controls. We do not issue audit reports or certificates; an independent certification body does that.

How we scope

Engagements are fixed-scope, with the gap analysis boundary, deliverables and timeline agreed in writing before work starts.
The written scope lists which clauses 4 to 10 and which of the 93 Annex A controls we will compare against current practice.
We confirm which systems, sites and cloud accounts fall inside the assessed boundary, so findings match the ISMS scope your organization intends to certify.

How we build

We review existing policies, procedures, asset records, access reviews and logs against each clause and Annex A control in scope.
Each control is recorded with its current state, the evidence reviewed, the gap found and a proposed owner for remediation.
We prepare draft findings with a risk-based priority, since the standard does not require working through clauses in numeric order.

How we hand over

You receive a written gap register covering every in-scope clause and control, with evidence references and open items clearly marked.
Findings are organized into an implementation plan that your team can assign, track and approve through its own governance.
Your internal owners walk through the results, so accountability for controls and the Statement of Applicability stays with your organization.

How we support

Ongoing support after the gap analysis is available as a retainer, scoped separately in writing and priced from a quote.
Remediation work, such as hardening, logging or backup configuration on self-hosted platforms, can follow the gap register under its own written scope.
Questions about the certification body's pre-audit or stage 1 audit are answered by your auditor, since pre-audits carry impartiality limits we will not replace.