03 Conduct an ISO 27001 Gap Assessment

Welcome to the third project in:

Module 11 — Enterprise GRC Transformation Project

In the previous project, you built an:

Information Security
Management System

You established:

Organizational Context
        ↓
ISMS Scope
        ↓
Governance
        ↓
Risk Management
        ↓
Security Objectives
        ↓
Policies
        ↓
Controls
        ↓
Statement of Applicability
        ↓
Evidence
        ↓
Internal Audit
        ↓
Management Review
        ↓
Continual Improvement

Now management wants to understand:

Are We Ready
for ISO 27001?

Your assignment is to conduct an:

ISO/IEC 27001
Gap Assessment

The purpose is not simply to create a checklist.

You need to determine:

What Is Required?

What Exists Today?

Is It Implemented?

Is It Effective?

Can We Prove It?

What Is Missing?

What Risk Does
the Gap Create?

What Must
Be Remediated?

Project Objective

You will assess CloudNova Technologies against the requirements of:

ISO/IEC 27001:2022

Your assessment will cover:

ISO 27001 Requirements
        ↓
Current ISMS
        ↓
Documentation
        ↓
Implementation
        ↓
Evidence
        ↓
Control Effectiveness
        ↓
Gap Identification
        ↓
Risk Assessment
        ↓
Remediation
        ↓
Readiness Decision

Mission Information

Project Type: ISO 27001 Readiness / Gap Assessment
Difficulty: Intermediate to Advanced
Estimated Time: 4–6 Hours
Primary Role: GRC Analyst / ISO 27001 Consultant
Supporting Roles: CISO / ISMS Manager / Security / IT / HR / Engineering / Procurement / Legal / Internal Audit
Standard: ISO/IEC 27001:2022
Environment: Spreadsheet, documentation workspace, ticketing platform, or GRC platform
Deliverable: ISO 27001 Gap Assessment & Remediation Pack

Important: ISO standards are copyrighted. Use an appropriately licensed copy of ISO/IEC 27001:2022 when performing a real assessment. This project focuses on the assessment methodology rather than reproducing the standard.

Learning Objectives

By completing this project, you will learn how to:

define an ISO 27001 gap assessment.
establish assessment scope.
define assessment criteria.
assess ISMS requirements.
understand Clauses 4–10.
evaluate Annex A control applicability.
review a Statement of Applicability.
identify required documentation.
collect objective evidence.
conduct stakeholder interviews.
distinguish documentation from implementation.
evaluate control design.
evaluate operating effectiveness.
identify gaps.
classify assessment findings.
connect gaps to enterprise risk.
identify root causes.
prioritize remediation.
assign remediation ownership.
develop remediation plans.
measure ISO readiness.
prepare executive readiness reporting.
prepare an organization for certification activities.

Scenario

CloudNova Technologies has established its first formal ISMS.

The organization now has:

ISMS Scope

Risk Register

Risk Methodology

Risk Treatment Plans

Information Security Policy

Supporting Policies

Control Register

Statement of Applicability

Security Metrics

Internal Audit Process

Management Review Process

Leadership wants to pursue ISO/IEC 27001 certification.

However, management does not want to immediately engage a certification body without understanding the organization’s readiness.

The CISO asks:

Where Are
Our ISO 27001
Gaps?

The CEO asks:

How Much Work
Remains Before
Certification?

Your job is to answer both questions.

Your Mission

Conduct an ISO 27001 gap assessment that determines:

Requirement
      ↓
Current State
      ↓
Expected State
      ↓
Evidence
      ↓
Gap
      ↓
Risk
      ↓
Remediation
      ↓
Owner
      ↓
Target Date

Required Deliverables

Create:

01 Assessment Scope

02 Assessment Plan

03 ISO Requirement Assessment

04 Annex A Applicability Review

05 Statement of Applicability Review

06 Documentation Register

07 Evidence Request List

08 Interview Plan

09 Gap Register

10 Finding Register

11 Risk Assessment

12 Remediation Plan

13 Readiness Dashboard

14 Executive Gap Assessment Report

15 Certification Readiness Roadmap

Part 1 — Understand the Gap Assessment

A gap assessment compares:

Required State
      ↓
Against
      ↓
Current State

The difference is:

Gap

Conceptually:

ISO Requirement
        ↓
Expected Practice
        ↓
Current Practice
        ↓
Evidence
        ↓
Difference
        ↓
Gap

Part 2 — Gap Assessment vs Certification Audit

Do not confuse:

Gap Assessment

with:

Certification Audit

A gap assessment is typically performed to understand readiness and identify weaknesses before formal certification activities.

Its purpose is:

Discover Problems
Before the
External Auditor Does

Part 3 — Understand ISO 27001 Structure

For assessment planning, think about ISO/IEC 27001:2022 in two major areas:

ISMS Requirements
Clauses 4–10

and:

Annex A
Information Security Controls

Part 4 — Management-System Requirements

Your assessment should consider the management-system areas covering:

Context

Leadership

Planning

Support

Operation

Performance Evaluation

Improvement

These correspond to Clauses 4–10.

Part 5 — Annex A

ISO/IEC 27001:2022 Annex A contains:

93 Controls

organized into four themes:

Organizational

People

Physical

Technological

Your job is not to automatically declare all controls applicable.

Control applicability should reflect:

Risk Treatment

Business Requirements

Legal Requirements

Regulatory Requirements

Contractual Requirements

Part 6 — Establish Assessment Scope

Start with the approved:

ISMS Scope

Do not assess random systems outside the defined boundary unless the scope itself is being challenged.

Document:

Business Units

Locations

Products

Processes

Technology

Information Assets

Third Parties

Interfaces

Dependencies

Part 7 — Example Scope

For CloudNova:

Enterprise SaaS Services

Production AWS Environment

Kubernetes Infrastructure

Corporate IT

Microsoft 365

GitHub

Software Development

Security Operations

Customer Support

Supporting Business Functions

Part 8 — Confirm Scope Validity

Ask:

Does the Scope
Cover the Services
Customers Actually
Depend On?

Look for inappropriate exclusions.

Example:

Production SaaS
Included

Identity Provider
Excluded

If authentication is critical to the SaaS service, this exclusion requires examination.

Part 9 — Identify Interfaces

Scope boundaries may connect to:

Cloud Providers

SaaS Providers

Payment Providers

Managed Services

Corporate Functions

Customers

Suppliers

These interfaces may create risk even when a service is externally operated.

Part 10 — Create Assessment Plan

Document:

Assessment Objective

Scope

Criteria

Assessment Team

Stakeholders

Assessment Dates

Evidence Requirements

Interview Schedule

Sampling Method

Reporting Method

Part 11 — Define Assessment Criteria

Your primary criteria should include the applicable ISO/IEC 27001 requirements.

Additional criteria may include:

Internal Policies

Legal Requirements

Contractual Requirements

Risk Treatment Decisions

Statement of Applicability

Part 12 — Establish Assessment Methodology

Use:

Document Review
      +
Interviews
      +
Evidence Review
      +
Observation
      +
Sampling

Do not rely on one source.

Part 13 — Assessment Workflow

Use:

Plan
 ↓
Request Evidence
 ↓
Review Documents
 ↓
Interview Owners
 ↓
Test Samples
 ↓
Evaluate Requirements
 ↓
Identify Gaps
 ↓
Validate Findings
 ↓
Prioritize Remediation
 ↓
Report Readiness

Part 14 — Build Assessment Workbook

Suggested columns:

Reference

Requirement Area

Expected State

Current State

Evidence

Owner

Assessment Result

Gap

Risk

Recommendation

Priority

Target Date

Status

Part 15 — Define Assessment Ratings

Use a simple rating model.

Conformant

Requirement Satisfied

Implemented

Evidence Available

Partially Conformant

Requirement Partially
Implemented or
Evidence Incomplete

Nonconformant

Requirement Not
Adequately Satisfied

Not Assessed

Insufficient Information
to Reach Conclusion

Where relevant, applicability should be separately documented rather than using assessment status as a substitute for the SoA.

Part 16 — Do Not Use “Not Applicable” Carelessly

Especially for Annex A controls, exclusion requires:

Reasoned
Justification

Do not write:

Not Applicable
Because We
Don't Use It

without validating the actual business and risk context.

Part 17 — Start With Clause 4

Assess organizational:

Context

Determine whether the organization has identified relevant:

Internal Issues

External Issues

Interested Parties

Requirements

ISMS Scope

Part 18 — Context Evidence

Possible evidence:

Context Register

Interested Parties Register

ISMS Scope

Business Strategy

Legal Register

Customer Requirements

Part 19 — Context Interview Questions

Ask:

What Business Changes
Could Affect the ISMS?

Which External Requirements
Influence Security?

Which Stakeholders
Have Security Expectations?

How Is ISMS Scope
Determined?

How Are Changes
Reviewed?

Part 20 — Example Context Gap

Current state:

Interested Parties
Identified

but:

Requirements
Not Maintained

Gap:

Stakeholder Security
Requirements Are
Not Systematically
Reviewed

Part 21 — Assess Clause 5 — Leadership

Evaluate:

Leadership Commitment

Information Security Policy

Roles

Responsibilities

Authorities

Part 22 — Leadership Evidence

Review:

Approved Security Policy

Governance Charter

Organization Chart

Role Descriptions

Committee Minutes

Management Decisions

Resource Approvals

Part 23 — Leadership Interview

Ask management:

How Do You
Review Cyber Risk?

Who Is Accountable
for the ISMS?

How Are Security
Objectives Approved?

How Are Resources
Allocated?

How Do You Know
the ISMS Is Effective?

Part 24 — Example Leadership Gap

Policy exists.

However:

No Evidence
of Executive
Approval

This is different from:

Policy Does
Not Exist

Your assessment must distinguish the two.

Part 25 — Assess Clause 6 — Planning

Evaluate:

Risk Assessment

Risk Treatment

Security Objectives

Planning Changes

Part 26 — Risk Methodology Review

Verify whether CloudNova has defined:

Risk Criteria

Likelihood

Impact

Risk Acceptance

Risk Ownership

Assessment Process

Treatment Process

Part 27 — Test Risk Register

Select samples.

For example:

R-001
Privileged Account Compromise

R-003
Critical Vulnerability

R-005
Third-Party Risk

Trace each risk through:

Risk
 ↓
Assessment
 ↓
Treatment
 ↓
Control
 ↓
Owner
 ↓
Evidence
 ↓
Residual Risk
 ↓
Acceptance

Part 28 — Example Risk Gap

Risk register contains:

High Risk

but no:

Treatment Owner

This indicates the process may be defined but not fully operationalized.

Part 29 — Review Risk Treatment

Ask:

Which Risks
Require Treatment?

Who Approves
Treatment?

How Are Controls
Selected?

How Is Residual
Risk Evaluated?

Who Accepts
Remaining Risk?

Part 30 — Review Security Objectives

Objectives should be:

Relevant

Measurable Where Practicable

Monitored

Communicated

Updated

Example:

100% Privileged
Accounts Protected
by MFA

Part 31 — Weak Objective

Improve
Cloud Security

The problem is not the intent.

The problem is:

How Will We
Know When
It Is Achieved?

Part 32 — Assess Clause 7 — Support

Evaluate areas including:

Resources

Competence

Awareness

Communication

Documented Information

Part 33 — Resource Assessment

Determine whether:

People

Budget

Technology

Time

are sufficient to operate the ISMS.

Part 34 — Competence Evidence

Review:

Training Records

Qualifications

Role Requirements

Skills Matrix

Performance Records

Part 35 — Awareness Testing

Do not only ask:

Was Training
Completed?

Determine whether personnel understand:

Security Policy

Their Responsibilities

Incident Reporting

Consequences of
Noncompliance

Part 36 — Communication Assessment

Verify:

What Is
Communicated?

When?

To Whom?

By Whom?

How?

Part 37 — Document Control

Review whether documented information is:

Identified

Reviewed

Approved

Version Controlled

Protected

Available

Retained

Disposed

appropriately.

Part 38 — Example Documentation Gap

You discover:

Access Control Policy

Version 1.2

Last Reviewed:
3 Years Ago

The policy exists.

But the document-control process may not be operating as intended.

Part 39 — Assess Clause 8 — Operation

Evaluate whether planned ISMS processes actually operate.

This includes:

Operational Planning

Risk Assessments

Risk Treatment

Part 40 — Look for Operational Evidence

Examples:

Tickets

System Reports

Approval Records

Access Reviews

Risk Reviews

Change Records

Meeting Records

Part 41 — Process vs Evidence

Procedure:

Privileged Access
Reviewed Quarterly

Evidence:

Q1 Review
✓

Q2 Review
Missing

Q3 Review
✓

Conclusion:

Process Exists

Operation
Is Inconsistent

Part 42 — Assess Clause 9 — Performance Evaluation

Evaluate:

Monitoring

Measurement

Analysis

Evaluation

Internal Audit

Management Review

Part 43 — Monitoring Assessment

For each important metric ask:

What Is Measured?

How?

When?

Who Reviews It?

What Target Exists?

What Happens
When It Fails?

Part 44 — Example Monitoring Gap

Metric:

Critical Patch
SLA Compliance

Report exists monthly.

But:

No Target

No Escalation

No Trend Review

The organization has data.

It does not yet have effective performance management.

Part 45 — Internal Audit Assessment

Review:

Audit Program

Audit Scope

Audit Criteria

Auditor Independence

Audit Reports

Findings

Corrective Actions

Part 46 — Common Internal Audit Gap

CloudNova performs:

Security Control
Self-Assessments

but has not established a sufficiently independent ISMS internal audit process.

This should be evaluated against the organization’s audit arrangements and applicable requirements.

Part 47 — Management Review Assessment

Review:

Meeting Agenda

Attendance

Required Inputs

Risk Changes

Metrics

Audit Results

Incidents

Actions

Decisions

Part 48 — Weak Management Review

A meeting titled:

Quarterly
Security Review

does not automatically satisfy the management-review process.

Verify:

Required Inputs

Management Participation

Decisions

Outputs

Action Tracking

Part 49 — Assess Clause 10 — Improvement

Evaluate:

Nonconformities

Corrective Actions

Continual Improvement

Part 50 — Corrective Action Assessment

For each significant finding, determine whether the organization:

Contains Problem

Corrects Problem

Determines Cause

Assesses Similar Issues

Implements Action

Verifies Effectiveness

Part 51 — Example Weak Corrective Action

Finding:

Quarterly Access
Review Missed

Action:

Complete
Access Review

That fixes the immediate problem.

It may not fix:

Root Cause

Part 52 — Better Corrective Action

Identify Root Cause
      ↓
Establish Control Calendar
      ↓
Assign Owner
      ↓
Automate Reminder
      ↓
Create Escalation
      ↓
Verify Next Cycle

Part 53 — Assess Continual Improvement

Look for improvements driven by:

Audit Findings

Incidents

Risk Changes

Metrics

Management Reviews

Threat Intelligence

Control Failures

Part 54 — Move to Annex A

After assessing the management system, review:

Annex A
Control Applicability

Do not immediately start testing every control.

First examine:

Statement of
Applicability

Part 55 — Review the SoA

For each relevant control, verify the organization’s SoA appropriately records information such as:

Control Reference

Applicability

Justification

Implementation Status

and supports traceability to the organization’s control environment.

Part 56 — SoA Review Questions

Ask:

Is the SoA
Current?

Does It Reflect
Risk Treatment?

Are Applicable
Controls Included?

Are Exclusions
Justified?

Does Implementation
Status Match Reality?

Part 57 — Example SoA Gap

SoA:

Control:
Implemented

Evidence review:

Control:
Partially Operating

Gap:

SoA Does Not
Accurately Reflect
Current Implementation

Part 58 — Review Organizational Controls

Assess relevant controls dealing with areas such as:

Policies

Roles

Asset Management

Access Governance

Supplier Relationships

Incident Management

Business Continuity

Compliance

Cloud Services

Part 59 — Review People Controls

Consider relevant areas including:

Screening

Employment Responsibilities

Awareness

Training

Disciplinary Processes

Termination

Confidentiality

Remote Working

Security Event Reporting

Part 60 — Review Physical Controls

Consider relevant controls around:

Physical Boundaries

Secure Areas

Physical Access

Monitoring

Equipment

Media

Utilities

Cabling

Maintenance

Secure Disposal

Cloud-first organizations still need to evaluate physical-security applicability for offices, devices, people, and relevant service dependencies.

Part 61 — Review Technological Controls

Consider areas such as:

Endpoint Security

Privileged Access

Authentication

Capacity

Malware Protection

Vulnerability Management

Configuration Management

Data Protection

Backup

Logging

Monitoring

Network Security

Cryptography

Secure Development

Change Management

Part 62 — Build Control Assessment Record

For each sampled control record:

Control Reference:

Control Objective:

Applicability:

Internal Control:

Control Owner:

Implementation:

Evidence:

Design Effectiveness:

Operating Effectiveness:

Gap:

Risk:

Recommendation:

Part 63 — Evidence Collection

Create an:

Evidence Request List

or:

ERL

Part 64 — Example Evidence Requests

Request:

ISMS Scope

Risk Methodology

Risk Register

Risk Treatment Plan

Statement of Applicability

Information Security Policy

Access Control Policy

Asset Inventory

Access Reviews

Vulnerability Reports

Incident Records

Vendor Assessments

BCP / DR Tests

Training Records

Internal Audit Reports

Management Review Minutes

Part 65 — Evidence Request Register

Create:

ID	Evidence	Owner	Requested	Received	Status
E-001	ISMS Scope	GRC	Date	Date	Complete
E-002	Risk Register	Risk	Date	Date	Complete
E-003	Access Review	IAM	Date	—	Pending
E-004	DR Test	BCM	Date	Date	Complete

Part 66 — Evaluate Evidence Quality

Evidence should be:

Relevant

Reliable

Complete

Current

Traceable

Part 67 — Weak Evidence

Example:

Screenshot
Showing MFA
Enabled

may prove configuration at one moment.

It may not prove:

All Accounts

Correct Scope

Continuous Enforcement

Review Process

Part 68 — Stronger Evidence

Combine:

Policy

Configuration

System Export

Sample Accounts

Monitoring

Exception Records

Part 69 — Conduct Interviews

Documents tell you:

What Should
Happen

Interviews help determine:

What People
Actually Do

Part 70 — Interview ISMS Manager

Ask:

How Is the
ISMS Maintained?

How Are Risks
Reviewed?

How Are Policies
Updated?

How Are Controls
Monitored?

How Are Problems
Escalated?

Part 71 — Interview Control Owners

Ask:

What Is
Your Control?

How Often
Does It Operate?

What Triggers It?

What Evidence
Does It Generate?

What Happens
When It Fails?

Part 72 — Interview Employees

Ask:

How Do You
Report a Security
Incident?

Where Do You
Find Security Policies?

What Are Your
Security Responsibilities?

Part 73 — Use Sampling

You normally cannot inspect every:

User

Server

Ticket

Vendor

Change

Incident

Use appropriate sampling.

Example:

Quarterly Access Reviews

Select:
Q1
Q2
Q3
Q4

Part 74 — Sampling Must Be Defensible

Record:

Population

Sample Size

Selection Method

Period

Exceptions

Part 75 — Trace Controls End-to-End

Example:

Risk:
Privileged Compromise
        ↓
Policy:
Access Control
        ↓
Control:
Quarterly Review
        ↓
Procedure
        ↓
Evidence
        ↓
Testing
        ↓
Finding

Part 76 — Identify Gaps

Typical gap categories include:

Missing Documentation

Incomplete Documentation

Missing Control

Partial Implementation

Control Failure

Insufficient Evidence

Unclear Ownership

Missing Measurement

Missing Governance

Outdated Documentation

Part 77 — Create Gap Register

Example:

Gap ID	Area	Gap	Risk	Priority	Owner
G-001	IAM	Access review inconsistent	High	High	IAM
G-002	Supplier	Reviews incomplete	High	High	TPRM
G-003	ISMS	Policy review overdue	Moderate	Medium	GRC
G-004	Audit	Audit program incomplete	High	High	Audit

Part 78 — Write Strong Findings

Weak:

Access Review
Not Good

Strong:

The defined quarterly
privileged-access review
process was not performed
during Q2.

Evidence was available
for Q1 and Q3 but
not Q2.

Part 79 — Finding Structure

Use:

Criteria

Condition

Evidence

Risk / Impact

Recommendation

Part 80 — Example Finding

Finding ID:
F-001

Area:
Access Governance

Criteria:
Approved access review
requirements

Condition:
One quarterly privileged
access review was not
completed.

Evidence:
Q1 and Q3 reports
were available.
Q2 evidence was absent.

Risk:
Inappropriate privileged
access may remain
undetected.

Recommendation:
Implement centralized
scheduling, ownership,
and escalation for
access reviews.

Part 81 — Classify Findings

Your internal gap methodology may use:

Critical

High

Medium

Low

or another defined model.

Do not confuse internal readiness ratings with the formal classification terminology used by a certification body.

Part 82 — Prioritize by Risk

Do not prioritize only because:

ISO Requirement
Missing

Consider:

Security Risk

Certification Impact

Business Criticality

Customer Impact

Remediation Complexity

Dependencies

Part 83 — Critical Priority Example

No Formal
Risk Assessment

could undermine significant portions of the ISMS.

Part 84 — High Priority Example

Internal Audit
Not Completed

may create major readiness concerns before certification activities.

Part 85 — Medium Priority Example

Several Policies
Past Review Date

where controls are otherwise operating effectively.

Part 86 — Root Cause Analysis

For significant gaps ask:

Why Does
This Gap Exist?

Possible root causes:

No Owner

No Process

Insufficient Resources

No Tooling

Poor Awareness

Unclear Requirement

Process Not Integrated

Weak Governance

Part 87 — Example Root Cause

Gap:

Vendor Reviews
Overdue

Immediate cause:

Assessments
Not Completed

Root cause:

No Central Vendor
Inventory or
Assessment Calendar

Part 88 — Build Remediation Plan

Each gap should have:

Gap ID

Required Action

Owner

Priority

Dependencies

Target Date

Evidence Required

Status

Part 89 — Example Remediation

Gap:
G-001

Issue:
Quarterly privileged
access review inconsistent.

Action:
Establish automated
quarterly review workflow.

Owner:
IAM Manager

Evidence:
Completed review
and approval records.

Success:
Two consecutive
review cycles completed.

Part 90 — Validate Remediation

Do not close a gap because:

Document
Created

Validate:

Implemented?

Operating?

Evidence Available?

Effective?

Part 91 — Remediation Lifecycle

Gap
 ↓
Action
 ↓
Owner
 ↓
Implementation
 ↓
Evidence
 ↓
Retest
 ↓
Effective?
   / \
 Yes  No
 ↓     ↓
Close  Rework

Part 92 — Build Readiness Dashboard

Example:

ISO 27001 READINESS

Requirements Assessed       100%

Conformant                    72%

Partially Conformant          18%

Nonconformant                 10%

Critical Gaps                  1

High Gaps                      6

Medium Gaps                   11

Remediation Complete          45%

Values are illustrative.

Part 93 — Avoid Misleading Readiness Percentages

Do not report:

87%
ISO Compliant

as though all requirements carry identical importance.

A single fundamental gap may materially affect readiness.

Therefore combine percentages with:

Critical Gaps

Systemic Issues

Certification Blockers

Risk Exposure

Part 94 — Identify Certification Blockers

Create a separate category:

Certification
Readiness Blocker

Examples might include:

Incomplete ISMS Scope

Missing Risk Assessment

Missing Risk Treatment

Incomplete SoA

Internal Audit Not Performed

Management Review Not Performed

Major Controls Not Operating

Evaluate these against the organization’s actual certification situation.

Part 95 — Create Readiness Heat Map

Example:

Area	Readiness
Context	High
Leadership	High
Planning	Medium
Support	High
Operation	Medium
Performance Evaluation	Low
Improvement	Medium
Annex A Controls	Medium

Part 96 — Identify Systemic Gaps

A systemic issue affects multiple requirements.

Example:

No Central
Control Ownership

may cause:

Missing Evidence

Overdue Reviews

Unclear Accountability

Control Failures

Audit Findings

Fixing the root cause can resolve multiple gaps.

Part 97 — Group Remediation

Instead of:

Fix 37
Individual Findings

group them into programs.

Example:

Program 01
ISMS Governance

Program 02
Risk Management

Program 03
Identity Governance

Program 04
Supplier Security

Program 05
Evidence Automation

Program 06
Internal Assurance

Part 98 — Create Remediation Waves

Wave 1 — Certification Blockers

Immediate

Wave 2 — High-Risk Gaps

Priority

Wave 3 — Operational Maturity

Improve

Wave 4 — Optimization

Automate

Part 99 — Example Roadmap

Month 1
Scope
Risk
SoA
Governance

Month 2
Policies
Control Ownership
Evidence

Month 3
Control Remediation
Metrics
Supplier Security

Month 4
Internal Audit

Month 5
Corrective Actions
Management Review

Month 6
Readiness Validation

This timeline is illustrative, not a certification requirement.

Part 100 — Prepare Executive Report

Executives do not need:

93 Control
Rows

on the first page.

They need:

Are We Ready?

What Are
the Biggest Gaps?

What Risk
Do They Create?

What Must
Be Fixed?

Who Owns It?

How Long
Will It Take?

What Investment
Is Required?

Part 101 — Executive Summary Structure

Use:

Assessment Objective

Assessment Scope

Overall Readiness

Key Strengths

Critical Gaps

High-Risk Gaps

Systemic Issues

Certification Blockers

Remediation Priorities

Resource Requirements

Target Readiness

Management Decisions

Part 102 — Example Executive Narrative

CloudNova has established
the foundational components
of its ISMS.

Governance, risk management,
and core security policies
are substantially established.

Readiness gaps remain in
internal audit, supplier
assurance, evidence consistency,
and privileged access reviews.

These gaps should be
remediated and validated
before progressing to
formal certification activities.

Part 103 — Highlight Strengths Too

A gap assessment should not become:

Everything
Is Wrong

Report mature areas such as:

Strong Executive Sponsorship

Defined ISMS Scope

Established Risk Register

Central Security Monitoring

Mature Incident Response

This provides balanced assurance.

Part 104 — Maintain Evidence Traceability

Create:

Requirement
      ↓
Control
      ↓
Evidence
      ↓
Assessment
      ↓
Finding
      ↓
Remediation

Part 105 — Create Traceability Matrix

Example:

Requirement Area	Control	Evidence	Result	Gap
Risk Management	GRC-001	Risk Register	Partial	G-001
Access	IAM-001	MFA Report	Pass	—
Supplier	TPRM-001	Vendor Reviews	Partial	G-004

Part 106 — Separate Design and Operation

A control can be:

Designed Well

but:

Operating Poorly

or:

Designed Poorly

even if people follow it consistently.

Assess both.

Part 107 — Example

Control:

Annual
Vendor Assessment

Design:

Insufficient
for Critical Vendor
Risk Profile

Operation:

Performed
as Documented

The process works as designed.

The design itself may be inadequate for the organization’s risk-treatment needs.

Part 108 — Test Exceptions

Ask:

What Happens
When the Control
Cannot Be Followed?

Example:

MFA Exception

should have:

Business Justification

Risk Assessment

Approval

Compensating Control

Expiration

Review

Part 109 — Review Control Exceptions

Look for:

Permanent Exceptions

Expired Exceptions

Unapproved Exceptions

No Compensating Controls

No Risk Acceptance

Part 110 — Assess Evidence Consistency

One successful sample does not necessarily prove consistent operation.

Look across:

Time

Systems

Teams

Locations

Populations

Part 111 — Identify Shadow Processes

You may discover:

Official Procedure
      ↓
Different
Real Process

Example:

Policy:
Access Request
Through Ticket

Reality:
Administrators
Sometimes Grant
Access via Chat

This is important assessment evidence.

Part 112 — Assess Tooling

Determine whether ISMS processes depend heavily on:

Manual Spreadsheets

Email

Individual Knowledge

Manual Reminders

These are not automatically nonconformities.

But they may create:

Scalability

Consistency

Evidence

Ownership

Monitoring

risks.

Part 113 — Identify Automation Opportunities

Examples:

Automated Evidence Collection

Automated Access Reviews

Policy Review Reminders

Risk Treatment Tracking

Vendor Reassessment Alerts

Control Monitoring

Compliance Dashboards

Part 114 — Build Gap Register Template

Gap ID:

Requirement Area:

Control / Process:

Expected State:

Current State:

Evidence:

Gap Description:

Root Cause:

Business Risk:

Security Risk:

Readiness Impact:

Priority:

Recommendation:

Owner:

Target Date:

Status:

Retest Date:

Closure Evidence:

Part 115 — Build Finding Template

Finding ID:

Title:

Criteria:

Condition:

Evidence:

Cause:

Risk / Impact:

Recommendation:

Owner:

Management Response:

Target Date:

Status:

Part 116 — Build Evidence Request Template

Evidence ID:

Requirement Area:

Evidence Requested:

Purpose:

Owner:

Request Date:

Due Date:

Received Date:

Evidence Location:

Reviewer:

Result:

Notes:

Part 117 — Build Remediation Template

Remediation ID:

Gap ID:

Action:

Priority:

Owner:

Supporting Teams:

Dependencies:

Required Resources:

Target Date:

Expected Evidence:

Success Criteria:

Status:

Validation Result:

Part 118 — Build Readiness Report Template

Assessment:

Standard:
ISO/IEC 27001:2022

Scope:

Assessment Period:

Assessment Team:

Overall Readiness:

Strengths:

Critical Gaps:

High Gaps:

Systemic Issues:

Certification Blockers:

Annex A Observations:

Remediation Priorities:

Resource Requirements:

Recommended Next Step:

Practical Assignment

Perform the assessment for CloudNova.

Task 1 — Define Scope

Create:

ISO 27001
Gap Assessment Scope

Task 2 — Build Assessment Plan

Document:

Objective

Criteria

Stakeholders

Timeline

Methodology

Sampling

Task 3 — Assess Clauses 4–10

For each relevant requirement area record:

Expected State

Current State

Evidence

Assessment

Gap

Task 4 — Review Annex A

Evaluate applicability and implementation across the four control themes.

Task 5 — Review SoA

Validate:

Applicability

Justification

Implementation

Traceability

Task 6 — Create Evidence Request List

Request at least:

25 Evidence
Artifacts

Task 7 — Conduct Interviews

Prepare interview questions for:

CISO

ISMS Manager

IAM

SOC

Engineering

HR

Procurement

BCM

Task 8 — Create Gap Register

Identify at least:

15 Realistic
Readiness Gaps

Task 9 — Risk-Rate Gaps

Assign:

Critical

High

Medium

Low

using a documented internal methodology.

Task 10 — Root Cause Analysis

Perform root-cause analysis for at least:

5 High-Priority
Gaps

Task 11 — Create Remediation Plan

For every high-priority gap define:

Action

Owner

Target

Evidence

Success Criteria

Task 12 — Build Readiness Dashboard

Summarize:

Assessment Status

Gap Severity

Remediation Progress

Certification Blockers

Task 13 — Executive Report

Prepare a concise executive assessment answering:

Are We Ready?

What Is Missing?

What Must Be Fixed?

What Requires
Management Action?

Final Validation Checklist

Planning

assessment objective defined.
scope defined.
criteria defined.
stakeholders identified.
methodology documented.
sampling approach defined.

ISMS Requirements

context assessed.
leadership assessed.
planning assessed.
support assessed.
operation assessed.
performance evaluation assessed.
improvement assessed.

Annex A

SoA reviewed.
applicability reviewed.
exclusions justified.
implementation validated.
selected controls sampled.
evidence reviewed.

Evidence

ERL created.
evidence owners identified.
evidence received.
evidence quality evaluated.
evidence traceability maintained.

Interviews

ISMS owner interviewed.
management interviewed.
control owners interviewed.
operational personnel interviewed.
conflicting information investigated.

Findings

criteria identified.
condition documented.
objective evidence recorded.
risk identified.
root causes considered.
recommendations provided.

Remediation

gaps prioritized.
certification blockers identified.
owners assigned.
target dates established.
evidence requirements defined.
retesting planned.

Reporting

strengths identified.
systemic gaps identified.
readiness dashboard created.
executive report prepared.
management decisions identified.
roadmap created.

Expected Project Folder

03 Conduct an ISO 27001 Gap Assessment
│
├── 01 Assessment Scope
├── 02 Assessment Plan
├── 03 ISO Requirement Assessment
├── 04 Annex A Applicability Review
├── 05 Statement of Applicability Review
├── 06 Documentation Register
├── 07 Evidence Request List
├── 08 Interview Plan
├── 09 Gap Register
├── 10 Finding Register
├── 11 Gap Risk Assessment
├── 12 Remediation Plan
├── 13 Readiness Dashboard
├── 14 Executive Gap Assessment Report
└── 15 Certification Readiness Roadmap

Success Criteria

You successfully complete this project when you can take:

ISO Requirement
       ↓
Expected State
       ↓
Current State
       ↓
Objective Evidence
       ↓
Assessment
       ↓
Gap
       ↓
Risk
       ↓
Root Cause
       ↓
Remediation
       ↓
Validation

and answer:

What Does
ISO Require?

What Do
We Currently Have?

Can We
Prove It?

Does It
Actually Operate?

Where Are
the Gaps?

Which Gaps
Matter Most?

What Could
Block Readiness?

Who Must
Fix Them?

What Evidence
Will Prove
Remediation?

Are We Ready
to Move Forward?

Career Connection

This project reflects work performed by:

GRC Analysts

ISO 27001 Analysts

ISMS Managers

Information Security
Consultants

Compliance Analysts

Internal Auditors

Security Assurance
Professionals

GRC Consultants

A beginner approaches an ISO assessment as:

Requirement
      ↓
Yes / No

A professional approaches it as:

Requirement
      ↓
Business Context
      ↓
Risk
      ↓
Process
      ↓
Control
      ↓
Evidence
      ↓
Effectiveness
      ↓
Gap
      ↓
Remediation

The objective is not simply to determine:

Do We Have
the Document?

It is to determine:

Is the ISMS
Designed Correctly?

Is It
Implemented?

Does It
Operate?

Is There
Objective Evidence?

Does It
Manage Risk
Effectively?

That is the foundation of professional ISO 27001 readiness assessment.

What’s Next?

➡️ Next: 04 — Perform a SOC 2 Readiness Review

You have now moved from:

Enterprise
Risk Assessment
       ↓
Build an ISMS
       ↓
ISO 27001
Gap Assessment

The next project changes the assurance perspective.

Instead of focusing primarily on an ISO management-system certification framework, you will assess whether CloudNova is prepared for:

SOC 2
Assurance

You will move through:

SOC 2 Scope
      ↓
System Description
      ↓
Trust Services Criteria
      ↓
Control Mapping
      ↓
Control Ownership
      ↓
Evidence
      ↓
Design Assessment
      ↓
Operating Readiness
      ↓
Gap Identification
      ↓
Remediation
      ↓
Audit Readiness

You will learn how to answer:

Which Trust Services
Categories Apply?

What Is
Our System Boundary?

Which Controls
Support the Criteria?

Are Controls
Designed Appropriately?

Can We Produce
Audit Evidence?

Are Controls
Operating Consistently?

Which Gaps
Could Affect
SOC 2 Readiness?

➡️ Next: 04 — Perform a SOC 2 Readiness Review