ISO 27001 Gap Analysis Template: A Practical Guide for UK SMBs

An ISO 27001 gap analysis tells you how far your current information security practices are from what the standard requires. For UK SMBs, this is the step that separates a realistic certification plan from guesswork. Skip it, and you will overspend on consultancy or walk into your Stage 1 audit unprepared.

ISO 27001:2022 contains 93 controls in Annex A plus management system requirements in Clauses 4-10. Your ISO 27001 gap analysis template needs to cover both. Here is how to do it without turning it into a three-month project.

What you are assessing

Two distinct things:

1. Management system clauses (4-10) — the ISMS framework. Policy, risk assessment, management review, internal audit.
2. Annex A controls (93 controls) — specific security measures. Access control, encryption, incident management, supplier oversight.

Common mistake: spending all your time on Annex A and treating the management system as an afterthought. Both are audited equally. On this site's own reading, Clause 6 (risk assessment methodology) is as common a source of SMB findings as the technical controls; we have not found published certification-body data on the split, so treat that as our judgement rather than a measured statistic.

The 93 Annex A controls

ISO 27001:2022 reorganised the Annex A controls into 4 categories. The 2013 version used a different structure with different control numbers:

Category	Covers
Organisational (A.5)	Policies, roles, asset management, supplier relationships
People (A.6)	Screening, awareness training, remote working
Physical (A.7)	Secure areas, equipment, clear desk, media disposal
Technological (A.8)	Access control, encryption, malware, logging, network security

UKAS records 11 new controls in ISO/IEC 27002:2022, with which Annex A is aligned, but does not name them. The commonly-cited examples — threat intelligence (5.7), cloud services security (5.23), ICT readiness for business continuity (5.30), data masking (8.11), data leakage prevention (8.12) — come from ISO/IEC 27002:2022 itself, which is paywalled, so treat that list as indicative and check it against a purchased copy.

The 93-control, 4-theme and 11-new figures are UKAS's, and UKAS states them of ISO/IEC 27002:2022: its ISO/IEC 27001:2022 transition bulletin says Annex A "has been aligned with the controls defined in ISO/IEC 27002:2022, which contains 93 controls (11 of which are new) organised in 4 themes". The theme names and the individual control numbers and titles are not UKAS's — those come from ISO/IEC 27002:2022, which is paywalled. Per-category control counts are not stated here.

For a plain-English breakdown of what each of the 93 controls actually asks for, see ISO 27001 list of controls.

Step-by-step gap analysis process

Step 1: Define your ISMS scope (Clause 4.3)

Define which business units, sites, systems, and information assets are covered. For most SMBs under 50 staff, the scope is the entire business. Write one paragraph. Your auditor reviews this first.

Step 2: Assess ISMS management clauses (4-10)

Rate your position on each clause:

• Clause 4: Have you identified external issues (UK GDPR, cyber threat landscape) and internal issues (IT infrastructure, remote working)?
• Clause 5: Information security policy signed by the MD? Roles assigned?
• Clause 6: Defined risk assessment methodology? "We deal with risks as they come up" is not a methodology.
• Clause 7: Resources allocated? Staff awareness programme? Competence records?
• Clause 8: Risk treatment plans implemented? Evidence?
• Clause 9: Internal audits conducted? Management reviews covering information security?
• Clause 10: Nonconformity and corrective action process in place?

Step 3: Assess each Annex A control

For each of the 93 controls, record:

1. Applicability — does it apply? If not, justify the exclusion in your Statement of Applicability (Clause 6.1.3 d)
2. Current state — what exists today? Be factual, not aspirational
3. Compliance level — 0 (not implemented) / 1 (partial) / 2 (largely implemented) / 3 (fully effective)
4. Gap description — what work is needed?
5. Priority — High / Medium / Low based on risk and effort

Step 4: Prioritise gaps

Rank by risk impact and implementation effort. A missing access control policy (A.5.15) for a business handling sensitive client data is higher priority than a clear desk policy (A.7.7) in a paperless office.

Address dependencies first. You cannot classify assets (A.5.12) without an asset inventory (A.5.9). You cannot define access rights (A.5.15) without knowing your systems.

Step 5: Build your risk treatment plan

ISO 27001 Clause 6.1.3 requires this. For each gap, define: specific action, responsible person (name, not role), target date, resources needed, and evidence of completion. Update monthly.

The risk treatment plan is only as good as the risk assessment behind it. A step-by-step method with a worked UK example is in the ISO 27001 risk assessment template guide.

Common mistakes

Ignoring cloud and supplier controls. Controls A.5.19-A.5.23 cover suppliers and cloud services. If you run on Microsoft 365, Xero, and AWS, these apply directly. Your provider handles infrastructure security; you own access management, configuration, and data classification.

Treating the SoA as a formality. The Statement of Applicability is one of the most scrutinised audit documents. Draft it during the gap analysis, not the week before your audit.

Assessing controls in isolation. Access control (A.8.3-A.8.5) depends on identity management, which depends on HR onboarding/offboarding (A.6.1-A.6.5). Gaps cascade.

UK-specific considerations

UK GDPR alignment. The Data Protection Act 2018 and UK GDPR overlap with several Annex A controls — breach notification to the ICO under Article 33 ("without undue delay and, where feasible, not later than 72 hours", and only where the breach is not "unlikely to result in a risk to the rights and freedoms of natural persons"), DPIAs (Article 35), data subject rights. The ICO provides guidance at ico.org.uk.

Cyber Essentials. If you hold CE or CE Plus (NCSC/IASME scheme), you have a head start. Its five control areas (firewalls, secure configuration, access control, malware protection, patch management) map to several Annex A technological controls.

NCSC guidance. Free practical guidance at ncsc.gov.uk — 10 Steps to Cyber Security, cloud security principles, supply chain guidance.

Public sector supply chain. UK government departments increasingly require ISO 27001 from suppliers handling official information. The Cabinet Office Security Policy Framework references it as a baseline.

Practical takeaway checklist

1. Allow 2-3 days for a thorough gap analysis
2. Start with ISMS Clauses 4-10 before Annex A — management system gaps often take longer to close
3. Use the 0-3 scale — enough granularity without overcomplication
4. Build in a spreadsheet: control ref | applicability | current state | level | gap | priority | action | owner | deadline
5. Draft your Statement of Applicability during the gap analysis
6. Focus first 90 days on high-risk gaps and dependencies
7. Review findings with management before committing budget

If you have completed your ISO 9001 gap analysis, the management system clauses overlap significantly. Our ISO 9001 gap analysis checklist uses a similar framework. For certification cost estimates, try the cost estimator.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. ISO certification requirements vary by scope, sector, and certification body. Always verify requirements with your UKAS-accredited certification body or a qualified consultant before making compliance decisions.