ISO 27001 Gap Analysis Template
A ready-to-use spreadsheet covering all 93 Annex A controls of ISO/IEC 27001:2022. Track your current status, flag every gap, assign owners, and turn it into a dated remediation plan.
No email required · 93 controls · Works in Excel, Google Sheets, and LibreOffice
What an ISO 27001 Gap Analysis Actually Is
A gap analysis compares what the ISO/IEC 27001:2022 standard requires against what your organization actually does today. The difference between those two things is your gap list.
It is the step most teams skip, and the one that costs them most later. Walking into a certification audit without one means discovering your gaps in the room, with an auditor taking notes.
Done properly, a gap analysis answers three questions: which controls are missing, how severe is each one, and who fixes what by when? This template is structured around exactly those three.
What is in the workbook
- Gap Analysis sheet — all 93 Annex A controls, pre-listed in standard order
- Organizational (37), People (8), Physical (14), Technological (34)
- Twelve ready-made columns including status, priority, owner and target date
- Instructions sheet explaining the method in five steps
iso-27001-gap-analysis-template.xlsx
93 controls · 12 columns · 2 sheets
The file opens in Excel, Google Sheets, and LibreOffice. Each row is one Annex A control — nothing summarised away.
The Columns, and Why Each One Exists
Most free templates stop at a control list. This one tracks the decisions that actually close gaps.
Implementation Status
Where you actually are today — fully, mostly, partially, planned, or not implemented.
Gap? (Yes/No)
One clean flag per control so you can filter to just the problems.
Priority
High / Medium / Low, so the 20% of gaps that matter most surface first.
Owner
A named person per gap. Unowned gaps do not get fixed.
Evidence
The policy, log, or screenshot an auditor would ask to see.
Target Date
A committed date, which is what turns a list into a plan.
How to Run the Gap Analysis
Five steps from download to a dated plan
Download the workbook
Open the Gap Analysis sheet. All 93 Annex A controls are already listed in order.
Mark where you stand
Fill in Implementation Status for each control, honestly. Audit realism beats optimism.
Flag and rank the gaps
Set Gap? to Yes, then assign a priority. Start with anything an auditor would test first.
Assign and date
Give every gap an owner, the evidence you already have, and a realistic target date.
Re-run it quarterly
A gap analysis is a snapshot. Re-assess to prove the trend is moving up, not sideways.
All 93 ISO 27001 Annex A Controls
The full control set, exactly as it appears in the downloadable template — grouped by the four domains of ISO/IEC 27001:2022.
Organizational Controls
37 controlsPolicies for information security
Define and publish enterprise information security policy with strategy documents
information security roles and responsibilities
Clearly define information security roles and responsibilities
Segregation of duties
Conflicting duties and areas of responsibility should be segregated
Management responsibilities
Management should support information security policy and procedures
Contact with authorities
Establish contact with relevant government authorities
Contact with special interest groups
Maintain contact with industry associations and security communities
Threat intelligence
Collect, analyze and use Threat intelligence
information security in project management
Integrate information security requirements into projects
Inventor y of information and other assets
Establish and maintain information asset inventory
Acceptable use of information and other assets
formulate acceptable use of assets rules
Return of assets
Return all assets when personnel leave
information classification
Classify information according to confidentiality requirements
information marking
Label information according to classification scheme
information transfer
Formulate information transfer rules with procedures
Access control
Establish and implement access control rules
Identity management
Manage full lifecycle of identities
Authentication information
control authentication with management
Access permissions
Allocate and manage access rights as needed
information security in supplier relationships
management should define risk
information security in supplier agreements
Clarify security requirements in agreements
information security management in ICT supply chains
Management ICT should define risk
monitoring, reviewing, and managing changes in supplier services
Monitoring review
information security in cloud services
Manage security of cloud services
Planning and preparation for information security events
Establish incident management
Assessment and decision-making for information security events
Assess and classify security incidents
Response to information security incidents
Procedures should define
Learning from information security incidents
Post-incident analysis and improvement
Collection and preservation of evidence
Establish evidence procedures
information security during interruptions
Protect information during interruptions
ICT preparedness for business continuity
ICT system business continuity readiness
Legal, regulatory, contractual, and other requirements
Identify and comply with requirements
Intellectual property
Protect intellectual property rights
Protection of records
Protect records from loss and tampering
Protection of privacy and personal information
Protect PII
Independent review of information security
Regularly independently review information security
Compliance of policies, procedures, and controls
Ensure compliance
Operational procedures for records
Records procedures
People Controls
8 controlsSelection
Conduct background checks on candidates
Employment terms and conditions
Clarify security responsibilities in contracts
information security awareness, education, and training
Provide security awareness training
Disciplinary action procedures
Establish procedures
Continuing responsibilities after employment termination or change
Define post-employment security responsibilities
Confidentiality or non-disclosure agreements
Sign NDA
Remote working
Protect information security in remote work
reporting of information security events
Provide incident reporting channels
Physical Controls
14 controlsPhysical security boundaries
Define and protect physical perimeters
Physical entry points
Protect entry to secure areas
Security of offices, rooms, and facilities
Design and protect office areas
Physical security monitoring
Continuously monitor premises
Protection against physical and environmental threats
Protect against natural and human threats
Wor k in secure areas
formulate
Cleaning of desktops and screens
Implement clear screen policy
Placement and protection of equipment
Securely site equipment
Security of assets outside organizational premises
Protect assets off-premises
storage media
Manage lifecycle of storage media
Suppor t facilities
Protection support facility
Cabling security
Protect cabling carrying data
Maintenance of equipment
Maintain equipment
Disposal or reuse of equipment
Securely dispose or erase equipment
Technological Controls
34 controlsUser equipment
Protect user endpoint devices
Privileged access management
Limit and manage privileged access
Access control to information
According to access control policy access
Access to source code
Protect access to source code
Security authentication
Implement authentication technology procedures
Capacity management
Monitor and adjust resource usage
Malware protection
Implement malware protection
Technical vulnerability management
Identify and fix vulnerabilities
Configuration management
Establish and maintain configuration
Data deletion
Securely delete information no longer needed
Data masking
According to policy use data masking
Data loss prevention
Prevent data leakage
Data backup
Maintain test backup
Redundancy of information processing facilities
Implement redundancy requirements
Logging
Log activities and events
monitoring of activities
Monitor network and system behavior
clocksynchronization
Synchronize clocks of all systems
Use of privileged utilities
Procedures
Software installation on operational systems
Control software installation
network security
Protect networks and their devices
Security of network services
Implementnetwork service
network segmentation
Network segregated service system
Web filtering
Manage access to external websites
Use of cryptography
Define and implement
Security in the software development lifecycle
Establish development
Security requirements for applications
Identify and specify security requirements
Security architecture and engineering principles
Establish
Security coding
Should define
Security testing in development and acceptance
Define and implementtest
Outsourcing of development
outsourcing development
Separation of development, testing, and production environments
segregatedenvironment
Change management
Control facility change
Test information
protectiontest data
Protection of information systems during audit testing
audit test
All 93 controls, pre-formatted and ready to fill in.
Four Mistakes That Waste the Exercise
- Treating it as a documentation exercise — a gap analysis is about whether controls actually operate, not whether a policy exists.
- Leaving status blank for controls you are unsure about. "Unsure" is a gap until proven otherwise.
- Ranking every gap as high priority, which makes the list unusable as a plan.
- Filling it in once and never revisiting it. Your environment changes every quarter.
Filling it in by hand takes hours. Run the free ISO 27001 self-assessment first — you get a status and score for every control, which you can then paste straight into this template.
Need the plan, not just the list? The gap analysis report ranks every missing control by severity and pairs it with fix guidance and a 30/90/180-day roadmap.
Turn the Template Into a Scored Report
Answer the same 93 controls online and get your score, gaps, and prioritised fixes in one pass.
Start Free Assessment