ISO 27001/2 Gap Analysis Issues
ISO 27001 is the internationally accepted standard for Information Security management. Organisations of all sizes have identified the value of compliance, either pursuing formal certification through accreditation agencies, or adopting the standard through implementing ISO 27001 as their guiding framework for internal security management.
This issue been reinforced by a number of regulating agencies declaring ISO 27001 as their benchmark for prudent and competent practice, including the Data Protection Commissioner. There is also growing support within government contracting circles for ISO 27001 to be a future mandated standard.
There is obviously increased pressure to comply with ISO 27001. However, the scope of the standard is wide, and experienced, professional interpretation and guidance is essential for effective and economical application of the standard.
It can be difficult for an enterprise to make objective, well-informed decisions about how to adopt the standard cost-effectively, and whether to seek formal certification. It is a sensible first step to commission an independent expert review to assess how current practice compares with the standard and with accepted industry practice.
The gap analysis is essentially an audit focused on identifying the appropriate implementation of ISO 27001, and outlining the improvements required to achieve this.
The steps followed are:
- Review information security policy and advise on and agree scope of the Information Security Management System
- Conduct a risk assessment workshop
- Agree control objectives (Statement of Applicability)
- Review controls (interview, observation, and inspection)
- Information Security Management status report and findings workshop – agree gap analysis
- Final report with recommendations for improvement and options for implementation of ISO 27001
An ISO 27001/2 gap analysis identifies:
- Improvements in security based upon industry best practice
- Achievement and shortfall in ISO 27001/2 control areas relevant to the business
- Plan of activities for ISO 27001 compliance
- Expert comment on formal ISO 27001 certification
- Provision of an expert, independent assessment of the gap between current security management and an implementation of ISO 27001 appropriate to the customer’s organisation
- Recommendations on business areas, systems and processes requiring improvements in security, based upon industry best practice
- Statement of achievement and shortfall in ISO 27001 control areas relevant to the business
- Outline plan of activities for ISO 27001 compliance
- Expert comment on the advisability of seeking formal ISO 27001 certification
Download the ISO 27000 Transition Management PDF now (43.4 KB)