ISO 27001 Gap Analysis

This is the help text the console shows in the help panel on this page.

Gap Analysis

The Gap Analysis evaluates your organization’s current controls against all 93 controls in ISO 27001:2022 Annex A. It tells you where you are compliant, partially compliant, or missing controls entirely.

Control Statuses

• Compliant: Evidence found confirming the control is implemented and effective.
• Partial: The control exists but has gaps in coverage, documentation, or effectiveness.
• Missing: No evidence of the control being implemented.
• N/A: The control does not apply.
• BLOCKING tag: The analysis found at least one gap rated Blocking for that control — treat it as a Stage 2 audit blocker.

Summary Cards and Filters

Four cards at the top (Compliant, Partial, Missing, Blocking) give you an instant readiness snapshot. Focus on reducing the Blocking count before your Stage 2 audit. Use the status buttons (All, Compliant, Partial, Missing, N/A) and the theme buttons (All themes, Organizational, People, Physical, Technological) to narrow the table.

Control Detail Drawer

Click any control row to open its detail drawer, which shows:

• The control and its status
• Evidence Summary and the list of Gaps with their source
• Last Scanned date
• An AI Co-pilot note for controls that are not compliant

Running the Analysis

Click Run Analysis (Owners and Managers) to evaluate all controls; this can take a few minutes, and Refresh updates the page while it runs. To re-check one control, open its drawer and click Re-run this control. The analysis uses the data sources connected to your organization, so connect them and keep them current before running. A daily limit on AI analyses applies, so very large re-runs may finish on the next day.