What is an ISO 27001 gap analysis?


In the context of ISO/IEC 27001, I've often heard people planning to commission or conduct a ‘gap analysis’ or 'readiness assessment' or 'pre-certification audit' or 'ISMS project review', but what do they mean? What exactly is going to take place?

Good question! There is no formal definition. It is essentially just a consultancy assignment specified by the client and agreed with the consultant/s doing the work. Given the context, its main purpose is generally to review the organization's state of readiness, addressing the question "Is the organization ready to be certified compliant with the ISO standard?" Another way of putting that is to ask "If the certification auditors turned up next week, would they: 
  1. Turn around and walk away during the very first morning, shaking their heads in sheer disbelief at the near total clue deficiency and leaving site with another war-story;

  2. Get stuck in to the audit fieldwork, quickly digging up plenty of issues including some major ones to discuss with management, perhaps serious enough that they would refuse to issue a certificate unless they were resolved;
     
  3. Get stuck in to the fieldwork, finding only a few trivial issues and a lot of good practices, hence having every reason to issue the certificate; or

  4. Struggle to find anything of real concern, perhaps leaving site with enough material for a case study in how to do it?
Determining the organization's certification readiness status is (usually) the obvious focal point of the job, its core objective ... but there's more to it in practice. In addition to the obvious gap-gazing element, an 'ISO27k gap analysis' or whatever the assignment is called will typically also:
  • Review the scope of the ISMS and hence the likely scale and nature of the implementation project, including the timescales and resources needed;

  • Review the information risks and security controls against those required or recommended by ISO/IEC 27001 [this is a surprisingly small element, since the standard and the certification auditors pay far more attention to the Management System than to Information Security];

  • Review the ISMS implementation project or programme - the plans and resources (particularly key players such as the project manager, steering committee and senior management advocate), and various project risks;

  • Introduce various people in the organization to the idea that managing information risk and security really is a bigger, broader, deeper concern than they probably appreciated (e.g. it concerns physical security for smartphones and servers, corporate papers, tablets, laptops and people while they are traveling on business or working from home or whatever - areas that traditional IT security, even in the modern guise of ‘cybersecurity’, may have barely even considered: there's more to ISO27k than IT/technical security!);

  • Inform and hopefully engage management and other stakeholders more fully with the ISMS and the ISMS implementation project, giving them the chance to think about, raise and discuss information risks that are of concern to them and the business, not just of theoretical concern to those paranoid infosec pro's;

  • Pump-prime a productive business dialog between stakeholders and specialists that will continue indefinitely, concerning information risks, opportunities, controls, governance, compliance, privacy And All That, emphasizing their value to the organization (the business context);

  • Provide information and guidance for planning and completing the ISMS implementation, such as prioritizing areas which need some serious effort to bring them up to the required standards. The advice may extend to working out roughly how long it will take and how much more it is likely to cost; identifying the ‘friends' of information security vice those who are more likely to be blockers or enemies, needing some guidance and persuasion to bring them into line;

  • Give management an independent perspective on the ISMS and the project team, from a competent, experienced professional who knows the standards inside-out and has been hands-on using them for a considerable period (hopefully, that is: anyone can claim to be a consultant, so caveat emptor - check their qualifications, background and expertise. An ISO/IEC 27001 Lead Auditor or Lead Implementer certificate may seem impressive but does not, in itself, indicate much beyond confirming somebody's attendance on a short course, especially if it is a fake or was issued under dubious circumstances. Remember that the consultant is likely to gain sensitive inside knowledge about the client's information security arrangements, hence they must be trustworthy);

  • Give the Chief Information Security Officer, Information Security Manager, Information Security team, Cybersecurity guy/gal or ISMS Implementation Project Manager a chance to see how the consultant works, and vice versa. If the assignment goes well for both parties and the working relationship flourishes, there may be opportunities for ongoing contact and support, perhaps further consulting assignments during the journey ahead. If not, well fair enough, maybe it's better to part ways at this point;

  • Support and encourage all concerned in a general sense. As well as gently pointing towards the end goal, boosting team morale, (re)motivating people and reassuring nervous managers are classic side-benefits of a productive project audit or review.
As with the ISO27k standards themselves, factors such as the size or type of organization, its structure, ownership etc. are of limited relevance to the assignment. A gap analysis is likely to be quite quick (perhaps a couple of days on the ground) for a relatively small, simple organization at a single location that doesn’t have a lot of valuable or vulnerable information to protect, doesn’t have many people or business relationships, is already strong on information security, and isn’t subject to stringent compliance obligations (laws, regulations, contracts including PCI-DSS, and more). Conversely a bank, even a small/specialist one, is bound to take longer to assess. Likewise a multinational or a government body.

The timing of the gap analysis is also pertinent. If the job is done very early on in the ISMS implementation project (perhaps even in advance of project approval), there probably won't be much in the way of hard evidence to review, making the assignment very fluid and somewhat perplexing for client employees not already engaged with the project. Conversely if it is done just a few weeks before the formal certification audit, most of the hard work should have been done: a competent consultant should still find a few things to comment on, providing a measure of assurance to management that the audit is likely to go smoothly once the final few pieces slip into place.  

Things can get interesting if the gap analysis falls in the middle period. The basics of an ISMS should all be in place with some parts of it operational already. This is normally such a fraught period for the implementation project team, however, that they may not have the high-level oversight, hence management may well be concerned to find out whether the project is on track and going to plan, teetering on the brink or running off the rails. A gap analysis in this period can be more involved and take longer, if only for the simple reason that everyone is extremely busy. On the up-side, there is still time left to make substantial changes if that is necessary. This is a good point to pencil-in the certification audit, and start lining up the certification body (the details to be confirmed nearer the time, perhaps after a final readiness assessment).

Strong governance of information risk and security, including management engagement with the ISMS is, I venture, crucial to its long term success, one of the if not the biggest Critical Success Factors. To put that another way, limited management understanding and support is, in my experience, the number one reason for problems on ISMS projects and the most likely reason for lack of funds, lack of priority, disinterest, unplanned changes, limited scope, lack of opportunity for improvements, aggravation, stress and, ultimately, marginal value to the organization. A well-timed, well-specified, well-resourced gap analysis can be the turning point.



PS  I am planning to add that updated version of the process diagram to the free ISO27k Toolkit at ISO27001security.com in due course.

PPS Get in touch if you think you might want a gap analysis. I know several gap analysts around the world, even some down here in the South Pacific. 

Popular posts from this blog

Pragmatic ISMS implementation guide (FREE!)

Image
Early this morning ( very  early!) I remotely attended an ISO/IEC JTC 1/SC 27/WG 1 editing meeting in London discussing the planned revision of ISO/IEC 27003:2017 . Overall, the meeting was very productive in that we got through a  long  list of expert comments on the preliminary draft standard, debated the objectives of the project and the standard and reached consensus on most points. In summary: 27003 is to be revised to align with the current 2022 releases of ISO/IEC 27001 , 27002 and 27005 : These changes are  mostly  minor aside from the new section 6.3 on ISMS changes.
Read more

Two dozen information risks that ISO forgot

Image
Selecting the wrong controls - controls that are inappropriate, ineffective, too costly, impracticable, fragile, unnecessary, counterproductive or whatever, often as a result of blind faith in fads and fashions of the day and FOMO e.g. MFA, AI, cyber Failing to select the right controls - controls that are ideal for the particular situation, both now and in perpetuity, for whatever reason - mostly ignorance and prejudice Selecting and implementing controls at the wrong time or in the wrong way (where 'wrong' includes ineffective, inappropriate, sub-optimal e.g. bolting on controls rather than designing and building them in) Inept and inaccurate identification, analysis and quantification of risk, including reliance on p oor quality (incomplete, inaccurate, out of date, misleading, unreliable ...) information about actual risks, particularly subtle and emerging risks plus those involving deliberate concealment and misdirection e.g. fraud, misinformation, disinformation, propagan
Read more

Philosophical phriday - compliance risk

Image
According to a vendor's promotional video interview I saw recently, the 'cybersecurity compliance burden' has allegedly become so significant that [customer] organisations are eagerly buying [their] software tools and services to help them manage and fulfil their obligations. The vendor's argument goes that, instead of accumulating a ragtag bunch of policies and other controls relating to user Identification and Authentication (I&A), for instance, it makes sense to:  Identify all the cybersecurity-related laws, regulations and standards that apply to the organisation; Examine them for any security control requirements relating to, say, I&A; Rationalise the I&A controls down to the smallest set that satisfies all the requirements - the lowest common denominator; Design, implement, use, manage and maintain those I&A controls; Have the I&A controls checked or audited to gain assurance that the compliance requirements are met.  OK so far? Sounds reasonab
Read more

ISMS internal audit priorities

Image
A thread on the ISO27k Forum sparked my imagination over coffee this morning. Hope had previously asked for assistance with an ISO/IEC 27001:2022 audit plan.  Bhushan offered a lengthy and generally sound response explaining how to use a spreadsheet with tabs to plan and record the audit work performed on 100% of the main body clauses and 50% of the 93 Annex A controls, day-by-day. That's OK ... except it wasn't entirely clear that he was interpreting and elaborating on the standard's actual requirements. ISO/IEC 27001 does not explicitly require, for example, that (as Bhushan stated) "ALL the management system clauses from 4 to 10 AND their sub-clauses need to be listed and audited" in an ISMS internal audit, although evidently he interprets it in that way. In clause 9.2.1, the standard states a requirement for internal audits to provide information on whether the ISMS conforms to the organization’s own requirements for the ISMS plus the requirements of the stan
Read more

Reading between the lines of ISO27001 [L O N G]

Image
ISO/IEC 27001 is a succinct, formally-worded standard for two key reasons: It is deliberately generic, being applicable to all manner of organisations regardless of difference in location/s, size, industry, maturity, structure, information risk and security status ... and so on. In effect, it specifies the lowest common denominator - the things that ALL organisations should be doing to manage their information security controls, as a minimum. The hurdle is set low enough that every organisation ought to find value in designing, implementing and operating an I nformation S ecurity M anagement S ystem as laid out in the standard. It is a certifiable standard, explicitly specifying the characteristics that every certified organisation's ISMS is expected to have. Again, it is a minimal specification with no concept of typical, average or maximum security: that is entirely down to the organisations themselves to determine, following the information risk management processes minimally de
Read more

Passionate dispassion

Image
Someone who is actively involved in, or is managing, an activity is patently not independent of it. They may well make a conscious, rational and determined effort to be objective, dispassionately reviewing evidence etc ., but their subconscious/emotional biases/prejudices and beliefs/value-systems will inevitably influence what they do. With the best will in the world, they will struggle to challenge and assess their past decisions and activities, especially if they were "certain" or "determined" or genuinely believed they were "doing the right thing". Furthermore, it is very hard for anyone to review the things they did not do, decisions they did not make or options they did not even consider. Mostly, they remain out of sight or out of the question.
Read more

45 ISO Management Systems Standards

Image
The ISO website  currently lists 45 published M anagement S ystems S tandards: 1. ISO 7101:2023 Healthcare organization management — Management systems for quality in healthcare organizations — Requirements 2. ISO 9001:2015 Quality management systems — Requirements 3. ISO 10012:2003 Measurement management systems — Requirements for measurement processes and measuring equipment 4. ISO 13485:2016 Medical devices — Quality management systems — Requirements for regulatory purposes 5. ISO 14001:2015 Environmental management systems — Requirements with guidance for use 6. ISO 14298:2021 Graphic technology — Management of security printing processes
Read more

Philosophical phriday - a noncompliance ramble

Image
In a previous philosophical phriday post , I moaned about vendors of security compliance support/management tools and services over-promising and under-delivering - an admittedly biased, even cynical opinion piece about the compliance imperative . A recent article in Corporate Compliance Insights notes that "CISOs are not just defenders against cyber threats but also champions of compliance and operational resilience". Hmmm, are CISOs 'compliance champs', really? Today, I'm discussing alternatives to being compliance-driven. How else can organisations drive their information risk, security and related concerns in a positive direction?
Read more

Adaptive SME security Crowdstrike special

Image
As if on cue, along comes a golden opportunity to consider what the Adaptive SME security  approach has to say regarding the Crowdstrike incident: That's not 20/20 hindsight but foresight: I've picked out the most relevant rows from the security controls table published in the guide 24 hours before the incident.  Although Crowdstrike primarily supplies much larger enterprises than SMEs, the incident could equally have afflicted other security software, or indeed operating systems such as Windows and assorted cloud apps commonly used by SMEs. Regardless of the details, it is a wake-up call, an opportunity to consider and respond to the information risks ... and to adapt , accordingly.
Read more