ISO/IEC 27001: from gap assessment to implementation

ISO/IEC 27001 specifies requirements for an information security management system. The certificate is awarded for the management system, not for a set of technical controls — which is why organizations with strong security sometimes fail an audit, and why organizations with modest security sometimes pass one.

What a gap assessment should produce

A useful gap assessment covers both parts of the standard: the management system clauses, and the Annex A controls selected through risk assessment. Reporting only on Annex A is a common shortcoming, because the clauses are where certification is most often lost — scope definition, risk methodology, management review, internal audit and continual improvement.

The output should say, for each gap, what is missing, what evidence an auditor would expect, and roughly what closing it involves. A finding that reads "no asset inventory" is not actionable. One that reads "no maintained inventory linking assets to owners and classification, evidenced by a dated review" is.

Sequencing the work

Scope first, and be deliberate about it. Scope determines the size of everything downstream, and a scope drawn too widely at the start is the most common reason a programme runs long.

Risk assessment next, because it justifies the selection of controls. A Statement of Applicability that excludes controls without a documented reason is a finding in itself.

Then the controls, ordered by risk rather than by Annex A numbering. Working numerically feels tidy and wastes months on controls that do not reduce your actual exposure.

Finally the management system machinery — internal audit, management review, corrective action. These need to have run at least once before certification, which means they cannot be left to the end.

Evidence as you go

The largest avoidable cost in a certification programme is reconstructing evidence afterwards. An access review that happened but was not recorded did not happen, as far as an auditor is concerned. Building the record while the work is being done costs very little; recreating it later costs weeks.

After certification

Certification is a three-year cycle with surveillance audits in between. The management system has to keep operating: risks reassessed, audits run, findings closed. Organizations that treat certification as a project rather than an operating model tend to discover this at the first surveillance audit.