ISO 27001 gap analysis
Clauses 4 to 10 of ISO/IEC 27001:2022 and the key Annex A controls. For organisations building an ISMS or preparing for certification.
Start the analysisFree gap analysis tools
Find out how far your organisation is from the requirements of ISO 27001, DORA or NIS2. Each tool walks you through the requirements area by area, calculates your maturity level and points to the highest-priority gaps, with the legal basis next to every recommendation. No registration; your answers stay in your browser.
What a gap analysis is
A gap analysis compares what your organisation does today with what a standard or regulation requires. It is the first step of every implementation: before you write policies or buy tools, you know what is missing, what matters most and where to start.
How the tool works
- Answer the questionsRate each requirement from 1 (none) to 5 (optimized). Every question comes with guidance and its legal basis. About 15 minutes.
- See your result instantlyOverall maturity percentage, maturity level (from initial to mature) and a chart with the score for every area. No personal data needed.
- Show the full reportGaps in every area with recommendations, the top 10 priorities with their legal basis and a print or PDF version. Free; it opens on the page with one click, no e-mail.
Choose your analysis
DORA gap analysis
ICT risk management, incidents, digital operational resilience testing and ICT third-party risk under Regulation (EU) 2022/2554. For financial entities and their ICT providers.
Start the analysisNIS2 gap analysis
Article 21 cybersecurity risk-management measures, incident reporting, supply chain security and management accountability under the NIS2 Directive.
Start the analysisFrequently asked questions
What is a gap analysis?
A comparison of where your organisation is today with what a standard or regulation requires. For each requirement you assess whether it is met; the result is a prioritised list of gaps, which becomes the starting point of your implementation plan.
Is the gap analysis really free?
Yes. The questionnaire, the overall score and the score for every area are available without registration. You open the full report with recommendations and priorities free of charge with one click, no e-mail needed. Your e-mail address is optional and used only to subscribe to the RealSec newsletter (separate consent, double opt-in).
Which analysis should I choose?
ISO 27001 if you are building an information security management system or preparing for certification. DORA if you are a financial entity in the EU or an ICT service provider to one. NIS2 if you operate in a sector covered by the NIS2 Directive and its national implementation (in Poland, the Act on the National Cybersecurity System).
How is the score calculated?
You rate each requirement on a scale from 1 (none) to 5 (optimized). Requirements carry weights from 1 to 3, and the area and overall scores are weighted averages converted to a percentage. "Not applicable" answers do not affect the score.
Is the result legal advice or an audit?
No. It is a self-assessment tool for information purposes. It shows the direction of work and the priorities, but it does not replace an audit, a conformity assessment or legal advice.
These tools are for information only and are not legal advice or an audit. Want to discuss your result? Talk to us.