How far are we from ISO 27001?

Questions CTOs ask

What is an ISO 27001 gap analysis?

An ISO 27001 gap analysis compares your current information security practices against the requirements of the ISO 27001:2022 standard, including its 93 Annex A controls organized across organizational, people, physical, and technological themes. It identifies which controls are fully implemented, partially implemented, or missing entirely, and the results create a prioritized remediation roadmap for achieving certification. This tool covers 51 of those 93 controls — the ones that most often decide whether a first certification audit goes well — so use it to size the work, then build a full Statement of Applicability with your auditor.

How long does ISO 27001 certification take?

Most organizations achieve ISO 27001 certification in 6-18 months depending on their starting maturity. The process includes gap analysis (2-4 weeks), ISMS design and policy creation (2-3 months), control implementation (3-6 months), internal audit (2-4 weeks), management review, and the external certification audit (Stage 1 and Stage 2). Companies with existing SOC 2 or similar frameworks can often accelerate this to 6-9 months due to overlapping controls.