Scope and context review
The intended certification scope, organisational context and relevant interfaces are confirmed before the assessment starts.
ISO 27001 · Defined starting point
Know what is missing before you implement. ISO 27001 Gap Analysis.
A focused review of your current ISMS against the intended certification scope, with a prioritised view of what is missing, what already works and what management should do next.
20 minutes · no obligation · usually a reply within one business day
ISO 27001 · Gap Analysis
Discuss your ISO 27001 Gap Analysis →From € 2,495 excl. VAT
Report included. Final pricing follows a written scope agreement; complexity and requested depth may affect the project fee.
What you get
More than a checklist: a decision-ready improvement route.
You leave with a clear view of what already works, what prevents readiness and which gaps deserve attention first.
Clause-by-clause and control-level gap view
Clauses and applicable controls are reviewed against what is designed, implemented and demonstrable today.
Evidence observations
Available evidence is sampled so the gap view reflects practice rather than documentation alone.
Prioritised improvement roadmap
Gaps are ranked by certification impact, control risk and the effort needed to close them.
Management-ready summary
Management receives a concise summary of the main decisions, dependencies and recommended sequence of action.
How it works
From scope to a prioritised gap view.
Four steps keep the review bounded and turn observations into a management decision.
Confirm scope
Agree the intended certification boundaries and what evidence exists.
Assess
Review governance, processes, controls and evidence against the standard.
Prioritise
Separate certification-critical gaps from normal maturity improvements.
Decide
Give management a practical route into implementation or audit preparation.
Fit check
Use this when you need a baseline before implementation.
A good fit when certification is planned, the ISMS is partly built or management needs an independent baseline before investing further.
Discuss your situationBack to ISO 27001 →Defined scopeThe work is bounded before it starts.
Senior-ledOne senior line through assessment and decision.
No forced follow-onThe output remains useful without a mandatory next engagement.
BEFORE YOU DECIDE
What the gap analysis covers, and what it does not
The assessment is a defined review of your existing ISMS, not a full implementation programme or a certificate. Its purpose is to give management a reliable view of the current position and a sensible order of action.
Assessment inputs
We agree the organisational boundary, intended certification scope, relevant stakeholders and core records. Interviews and a sample of evidence connect documented controls with day-to-day operation.
What you receive
A management summary, a mapped overview of gaps and available evidence, priorities linked to risk and dependencies, and a practical route towards implementation or audit readiness.
Outside the base assessment
Full remediation, operating every control, formal certification and unlimited document reconstruction are not automatically included. The final scope and price are agreed in writing.
Questions to settle before commissioning
Does the assessment guarantee certification?
No. It identifies gaps and the evidence still needed. Certification decisions belong to an independent certification body.
What determines the final fee and timing?
Scope, organisational complexity, accessible documentation and the requested depth of interviews and evidence review. The displayed starting price includes reporting for the agreed base scope.
A practical first step
Know the gap before you commit to the programme.
A short scope discussion is enough to confirm the intended certification boundary, current maturity and whether a gap analysis is the right first step.
Discuss your ISO 27001 Gap Analysis