Overview
Know your gaps before
the auditor does.
An information security management system gap assessment maps your current security controls against the requirements of an internationally recognised information security management standard. Companies that attempt certification without a prior gap assessment fail their Stage 1 audit at a rate that wastes months of preparation time and thousands in audit fees.
Our assessment covers all 93 controls across 4 themes and 14 control categories, rates your current maturity against each, identifies non-conformities, and produces a remediation roadmap with implementation effort estimates so you can plan certification with confidence.
Why This Matters
Enterprise clients, especially in financial services, healthcare, and government sectors, now require ISMS certification as a procurement condition. Companies pursuing these contracts without certification are being excluded from RFPs. Our gap assessment tells you exactly what needs to be done and in what order.
What We Audit
🔒
Organisational Controls
Policies, roles, responsibilities, threat intelligence, supplier relationships, and incident management controls assessed.
👤
People Controls
Screening, training, awareness, disciplinary process, and remote work security controls reviewed.
🏢
Physical Controls
Physical security perimeter, entry controls, clear desk/screen, equipment security assessed.
💻
Technological Controls
Access control, cryptography, malware protection, network security, backup, logging, and vulnerability management reviewed.
📋
Documentation Review
Mandatory documentation requirements assessed. Statement of Applicability, ISMS scope, and risk register gaps identified.
🔍
Risk Assessment Review
Risk identification, analysis, and treatment methodology reviewed against standard requirements.
What You Receive
Gap Assessment Report - All controls rated with maturity score, current state, and gap description.
Non-Conformity Register - Every identified gap classified as major non-conformity, minor non-conformity, or observation.
Remediation Roadmap - Priority-ordered implementation plan with effort estimates and dependency mapping.
Statement of Applicability Draft - Initial SoA with control applicability determinations and justifications.
Risk Register Template - Pre-populated risk register framework aligned to your business context.
30-Day Support - Queries on remediation implementation and certification readiness advisory.