# ISO 27001 Gap Analysis
URL: https://docs.autociso.io/console/iso/gap-analysis/
Description: The Gap Analysis evaluates your organization's current controls against all 93 controls in ISO 27001:2022 Annex A. It tells you where you are compliant, partially compliant, or missing controls entirely.

*This is the help text the console shows in the help panel on this page.*

## Gap Analysis

The Gap Analysis evaluates your organization's current controls against all 93 controls in ISO 27001:2022 Annex A. It tells you where you are compliant, partially compliant, or missing controls entirely.

### Control Statuses
- **Compliant**: Evidence found confirming the control is implemented and effective.
- **Partial**: The control exists but has gaps in coverage, documentation, or effectiveness.
- **Missing**: No evidence of the control being implemented.
- **N/A**: The control does not apply.
- **BLOCKING** tag: The analysis found at least one gap rated Blocking for that control — treat it as a Stage 2 audit blocker.

### Summary Cards and Filters
Four cards at the top (Compliant, Partial, Missing, Blocking) give you an instant [readiness snapshot](https://docs.autociso.io/console/iso/readiness/). Focus on reducing the **Blocking** count before your Stage 2 audit. Use the status buttons (All, Compliant, Partial, Missing, N/A) and the theme buttons (All themes, Organizational, People, Physical, Technological) to narrow the table.

### Control Detail Drawer
Click any control row to open its detail drawer, which shows:
- The control and its status
- **[Evidence Summary](https://docs.autociso.io/console/iso/evidence/)** and the list of **Gaps** with their source
- **Last Scanned** date
- An **AI Co-pilot** note for controls that are not compliant

### Running the Analysis
Click **Run Analysis** ([Owners and Managers](https://docs.autociso.io/getting-started/roles-and-permissions/)) to evaluate all controls; this can take a few minutes, and **Refresh** updates the page while it runs. To re-check one control, open its drawer and click **Re-run this control**. The analysis uses the data sources connected to your organization, so connect them and keep them current before running. A daily limit on AI analyses applies, so very large re-runs may finish on the next day.