What ISO 27001 is designed to control
The standard creates a repeatable way to identify information security risks, decide how they will be treated, assign responsibilities and review whether the management system remains effective. The useful question is not whether documents exist, but whether decisions, controls and evidence form one coherent system.
Scope, risk and the Statement of Applicability
A credible ISMS starts with a defensible scope. Risk assessment then connects business exposure to control choices. The Statement of Applicability should explain which Annex A controls are relevant, how they are implemented and why any exclusions are justified.
Gap analysis and internal audit are different
A gap analysis helps determine what is missing or immature before implementation or certification. An internal audit tests whether the management system conforms and operates as intended. Confusing the two often creates false confidence or unnecessary preparation work.
Evidence matters more than policy volume
Policies are only one layer. Auditors and management also need evidence of operation: risk reviews, access decisions, supplier oversight, incident handling, competence, objectives, management review and corrective action. Evidence should show that governance is active, not merely documented.
ISO 27001 and NIS2
ISO 27001 can provide a strong control and governance foundation for NIS2, but certification does not automatically demonstrate every legal obligation. Scope, reporting duties, management accountability and sector-specific requirements still need separate legal and operational assessment.