Gap Analysis
A gap analysis is a structured comparison of your organization’s current practices against the requirements of a target standard or framework — ISO 27001, ISO 9001, ISO/IEC 42001, SOC 2 — producing a prioritized list of what is missing or incomplete.
What you get out of it
The output is a remediation roadmap: every requirement scored as compliant, partial, or missing, with severity, suggested remediation, and typically an effort estimate. Done well, it converts an abstract certification goal into a costed project plan — which is exactly what management and auditors want to see at Stage 1.
A gap analysis is usually the first step of any certification project: cheap, fast (days to a few weeks), and it prevents the classic failure mode of implementing controls nobody scoped. It is distinct from a risk assessment — the gap analysis measures you against the standard; the risk assessment identifies threats to your specific assets and drives which controls matter.
Running one
You can self-assess with a structured questionnaire, use a spreadsheet template for workshop-style reviews, or commission a consultant-led analysis (typically 2–6 weeks). Our free readiness checkers score you instantly against ISO 27001, ISO 9001, ISO/IEC 42001, and the SOC 2 Trust Services Criteria.
Related Standards
- •ISO/IEC 27001:2022
- •ISO 9001:2015
- •ISO/IEC 42001:2023
- •AICPA Trust Services Criteria
Free Tools & Resources
Further Reading
Need help with this?
We consult and build across all of these domains — tell us what you are working on.