Free ISO 27001 gap analysis tool
See how far your organisation is from the requirements of ISO/IEC 27001:2022. You answer the questions area by area (about 15 minutes) and get your result instantly: an overall maturity percentage and a score for every area. Open the full report with the list of gaps, recommendations and top 10 priorities for free with one click, no e-mail needed.
How to rate the requirements (scale 1 to 5)
The questions cover clauses 4 to 10 of the standard (context, leadership, planning, support, operation, performance evaluation, improvement) and the key Annex A controls. For each requirement choose the level that best describes the situation today, not the plan for next quarter. If you have no evidence (a document, a record, a report), choose the lower level.
- 1None: the activity is neither performed nor planned.
- 2Planned: there is a decision or plan, but implementation has not started.
- 3In progress: implementation is under way, it works partially and documentation is incomplete.
- 4Implemented: it works and is documented, people are trained, but there is no systematic measurement yet.
- 5Optimized: it works, is measured, reviewed and improved in a regular cycle.
- n/aNot applicable: only for selected questions; the requirement does not apply (justify this in your documentation). It does not affect the score.
Your answers are stored only in your browser; you can stop and come back later. The result appears after the last area, or earlier once you have answered at least 60% of the questions.
Frequently asked questions
What is an ISO 27001 gap analysis?
A comparison of your current information security practices with the requirements of ISO/IEC 27001:2022: clauses 4 to 10 (the management system) and the Annex A controls. The result is a prioritised list of gaps that becomes your ISMS implementation plan.
Does the result replace a certification audit?
No. It is a self-assessment. An ISO/IEC 27001 certificate is issued by an accredited certification body after a two-stage audit: a documentation review and an assessment of how effectively the system is implemented. The gap analysis helps you prepare and estimate the scope of work.
How long does it take and can I stop halfway?
About 15 minutes. Your answers are saved in your browser, so you can stop and come back later on the same device. You see the result immediately after the last area.
Is the 2022 version of the standard covered?
Yes. The questions are based on ISO/IEC 27001:2022 and its 93 Annex A controls in four themes: organisational, people, physical and technological. The transition period for certificates against the 2013 version ended on 31 October 2025.
What happens to my answers and my e-mail address?
Your answers are not sent to a server; the result is calculated in your browser. Your e-mail is optional and used only to subscribe you to the RealSec newsletter, with a separate consent and confirmation via a link (double opt-in). It has no effect on access to the report. You can unsubscribe at any time.
Related tools
This tool is for information and self-assessment only. It is not legal advice, an audit or a conformity assessment, and it does not replace an analysis by a specialist. The result depends on the accuracy of your answers. Need a second opinion? Talk to us.