A credible ISO 27001 gap assessment covers both the mandatory management-system clauses (4–10) and all 93 Annex A controls, not a sample or a generic checklist.
Annex A 2022 groups its controls into four themes: 37 organizational, 8 people, 14 physical and 34 technological. Eleven controls were new in the 2022 edition and are where older programs most often fall short.
The gaps that hurt most at audit are rarely missing controls. They are controls nobody can evidence: stale asset inventories, one-off supplier reviews, slow access recertification, untested incident plans and unminuted management reviews.
What a gap assessment is for
An ISO 27001 gap assessment compares what your organization does today with what ISO/IEC 27001:2022 requires, and turns the difference into a prioritized plan. Done well, it is the most valuable week of a certification project: it tells you how far you are from audit-ready, where effort should go first, and which existing work can be reused.
Done badly, it is a spreadsheet of yes/no answers that nobody trusts six weeks later. The difference usually comes down to coverage and evidence. A useful assessment looks at every requirement, records what is actually in place today, and asks for the evidence an auditor would ask for, rather than accepting "we do that" at face value.
Since the transition period from the 2013 edition ended in October 2025, every certificate must be against the 2022 edition. If your last gap assessment was against the old 114-control Annex A, it is time for a new one.
Start with clauses 4 to 10: they are not optional
It is tempting to jump straight to the controls, but certification audits begin with the management system. Clauses 4 to 10 are mandatory, and no exclusion is possible. They cover the context of the organization and the scope of the ISMS (clause 4), leadership commitment, the information security policy and assigned roles (5), information security risk assessment and treatment, the Statement of Applicability and security objectives (6), resources, competence, awareness, communication and documented information (7), operational planning and the execution of risk assessments and treatment plans (8), monitoring and measurement, internal audit and management review (9), and nonconformity, corrective action and continual improvement (10).
A gap assessment should test each of these for both design and operation. Is there a documented risk methodology, and has it actually been applied in the last year? Is there an internal audit programme, and has an internal audit been completed and reported? These clauses are where first-time certifications most often fail stage 1.
The four Annex A themes, and what they expect
Annex A of ISO 27001:2022 contains 93 controls in four themes. You must consider every one of them and record in your Statement of Applicability whether it applies, with justification for any exclusion.
Organizational controls (37) are the largest group. They cover information security policies and roles, threat intelligence, asset inventory and acceptable use, information classification and transfer, access control and identity management, supplier relationships and cloud services, incident management, business continuity and ICT readiness, legal and regulatory requirements, and independent review.
People controls (8) cover screening, terms of employment, security awareness and training, the disciplinary process, responsibilities after termination or change of employment, confidentiality agreements, remote working and reporting of security events.
Physical controls (14) cover secure perimeters and entry, securing offices and facilities, physical security monitoring, protection against environmental threats, working in secure areas, clear desk and screen, equipment siting and protection, off-premises assets, storage media, supporting utilities, cabling, equipment maintenance and secure disposal or reuse.
Technological controls (34) cover endpoint devices, privileged access, access restriction, secure authentication, capacity, malware protection, technical vulnerabilities, configuration management, information deletion, data masking, data leakage prevention, backup, redundancy, logging and monitoring, clock synchronization, network security and segregation, web filtering, cryptography, secure development and coding, security testing, outsourced development, separation of environments, change management and protection of systems during audit testing.
The eleven controls added in 2022
Eleven controls were new in the 2022 edition, and they are where programs built on the 2013 standard most often have gaps: threat intelligence (5.7), information security for use of cloud services (5.23), ICT readiness for business continuity (5.30), physical security monitoring (7.4), configuration management (8.9), information deletion (8.10), data masking (8.11), data leakage prevention (8.12), monitoring activities (8.16), web filtering (8.23) and secure coding (8.28).
Several of these are less about new technology than about formalizing what good teams already do. Configuration management, for example, usually exists in infrastructure-as-code or hardening baselines; the gap is a documented standard and evidence that it is reviewed. Give these eleven controls specific attention in your assessment rather than assuming an older control set covers them.
How to rate each control
For every clause and control, record four things: the current status, the evidence that supports it, the owner, and the priority of closing any gap.
A simple status scale works best: implemented, partially implemented, not implemented, or not applicable (with justification). "Partially implemented" is the most common and most important rating, because it usually means the control exists in practice but cannot be evidenced consistently. Priority should reflect risk and audit impact: a missing risk assessment or internal audit blocks certification outright, while a weak clear-desk practice does not.
The output should be an action plan with status, priority and next step for every control, not a list of everything that is imperfect. That is what lets you plan resources, sequence the work, and set a realistic certification date.
The five gaps we see most often
Across readiness reviews, the same five issues come up again and again, and none of them needs a new tool. They need an owner, a cadence and a record.
An asset inventory that no longer matches reality: it was built for the project and never updated, so it misses new cloud services, laptops and data stores. Supplier security reviewed at onboarding and never again: there is a due-diligence questionnaire on file from three years ago and no evidence of periodic review. Access rights granted quickly and recertified slowly: joiners are provisioned the same day, but leavers and role changes linger, and there is no record of periodic access reviews. An incident response plan that has never been tested: a well-written document with no tabletop exercise, lessons learned or updates. And a management review that happens in conversation but not in minutes: leadership does discuss security, but there is no record covering the inputs and decisions clause 9.3 requires.
Fix these five, with evidence, and you remove a large share of the nonconformities a first certification audit typically raises.
From gap assessment to certification
Once you have a scored assessment, the path to certification follows a predictable sequence: close the blocking gaps in clauses 4 to 10, complete your risk assessment and Statement of Applicability, implement and evidence the priority controls, run an internal audit and management review, then book the stage 1 and stage 2 audits with an accredited certification body.
How long that takes depends on your starting point and scope. The assessment itself should take days, not months, and should leave you with a plan you can act on immediately. If you are also planning ISO 42001 for AI governance, assess both together: the management-system clauses are shared, so you review them once and build one integrated system.