ISO 27001 GAP Analysis
A gap analysis of your ISMS’s compliance against the ISO/IEC 27001:2022 standard
Where does the GAP analysis fit?
The GAP analysis is the second stage in Braveson’s ISO 27001 service path: a maturity assessment carried out after the ISO 27001 Starter and before the internal audit.
Kick-off
ISO 27001 Starter
€2,500 (excl. VAT)Maturity assessment
ISO 27001 GAP Analysis
€5,850 (excl. VAT)Internal audit
ISO 27001 Internal Audit
€4,000 – 7,000 (excl. VAT)4Ongoing support
Security Manager service
€3,000 / month (excl. VAT)A clear picture of ISMS maturity before certification
We assess your organization’s management system for compliance with ISO 27001 requirements, identify gaps and areas for improvement, and confirm you’re on the right track toward certification. The analysis covers both the standard’s main requirements (clauses 4–10) and the Annex A controls (A.5–A.8).
The result is a clear report you can use as the basis for addressing the gaps found.
Working methods
The project is carried out workshop-style, in close collaboration with you:
- Interviews with key people (management, IT, relevant business units) to get a comprehensive picture of current practices
- Document review: security policies, guidelines, risk management plans, contracts, technical descriptions
This method ensures the assessment is based on both actual practice and formal procedures, and that findings can be acted on quickly.
Project stages
1. Kick-off meeting and situational understanding
Organizational structure, key business functions, IT operating model, regulatory requirements. Defines the scope of the GAP analysis.
2. Document review and interviews
Existing policies, guidelines, and procedures; targeted interviews (including any external IT partner). Goal: find gaps and inconsistencies between documentation and practice.
3. ISO 27001 compliance analysis
Covers risk management, incident management and reporting, supply chain management, management responsibilities, continuity management, staff security awareness, and management of outsourced IT functions.
4. Reporting and recommendations
GAP analysis report: identified gaps, impact assessment, recommended development actions.
Work estimate
- Project kick-off and planning
- 1 htp
- ISO 27001 main requirements (4–6)
- 1 htp
- ISO 27001 main requirements (7–10)
- 1 htp
- Controls A.5, Organizational
- 0.5 htp
- Controls A.6, People
- 0.5 htp
- Controls A.7, Physical security
- 1 htp
- Controls A.8, Technological controls
- 0.5 htp
- Reporting and results workshop
- 1 htp
- Total
- 6.5 htp
What do you get, concretely?
GAP analysis report
Identified gaps in the standard’s main requirements and Annex A controls
Impact assessment
An assessed impact and severity for each finding
Recommendations
Recommended development actions to address the gaps found
Out of scope
This service does not include:
- The ISO 27001 certification audit itself (purchased separately from an accredited certification body)
- Technical vulnerability scanning or penetration testing
- Drafting missing documents: the GAP analysis assesses and reports, it doesn’t implement fixes (fixes are done in the ISO 27001 Starter or as a separate implementation project)
The recommended next step after the GAP analysis is an Internal audit (€4,000 – 7,000 (excl. VAT)) once the ISMS is implemented, plus the Security Manager service (€3,000 / month (excl. VAT)) for ongoing support.
Delivery approach
The project can be carried out remotely from Braveson’s offices. Braveson does not use external subcontractors: the work is done flexibly across work weeks, as efficiently as possible from start to finish.
Price and terms
- Total price
- €5,850 (excl. VAT) – example scope, 6.5 person-days
- Billing
- Monthly, based on work carried out
- Travel expenses
- Billed per tax authority guidelines, travel time at 50% of the hourly rate
- Reference rights
- Braveson may use the client’s logo as a reference unless otherwise agreed
Next step
Get in touch and we’ll schedule a short scoping call to confirm the exact scope and price.
Braveson · ISO 27001 consulting is based on the requirements of the ISO/IEC 27001:2022 standard.