Gap analysis for ISO 27001, DORA and NIS2. A free tool and how to get the most out of it.

We are releasing three free gap analysis tools: ISO 27001, DORA and NIS2. Fifteen minutes of questions, an instant score, and a report with the ten gaps worth tackling first.

Let’s get to the point. Before you buy a documentation package, a GRC system or hours of a consultant’s time, you need to know one thing: where you actually stand. Without it, every euro is spent partly blind. That is why we are launching three free gap analysis tools… ISO 27001, DORA and NIS2, all collected at /en/analiza-luk.

What gap analysis is and why you start with it

Gap analysis is a comparison of your current state with what a standard or regulation requires. Simple in principle: here is where we are, there is where we need to be, and in between is a list of things to do. The art is in making that list honest and putting it in order.

The most common mistake we see is doing things in reverse. A company buys a full set of policies or a tool licence, and only half a year later realises the biggest hole was somewhere else entirely. For example, nobody ever did a proper risk assessment, so half the documents rest on thin air.

A gap analysis answers three questions. What you already have and what works. What is missing completely. And what exists on paper but does not live in practice. That third category is reportedly the largest… and the most treacherous.

How our tools work

Each of the three tools is a set of questions grouped into areas. You answer each question on a maturity scale from 1 to 5, and if a requirement does not apply to you at all, you mark “Not applicable”. The whole thing takes roughly a quarter of an hour.

After the last question you immediately see an overall score and a chart with results per area. No registration, no waiting for a sales call. If you want to go further, you click “Show the full report” and it opens right there on the page: ten priority gaps with recommendations on what to do about them, plus a print or PDF version. Also free. Your email is optional and used only to subscribe you to our newsletter, with a separate consent and confirmation via a link (double opt-in). It has no effect on access to the report.

Questions are not equal. Some concern things without which a system simply does not exist, so they carry the highest weight (3) and have a stronger influence on the score and on the order in the report. More on that in a moment.

How to read the 1-5 scale

The scale is deliberately simple. 1, None: nothing exists, nobody owns it. 2, Planned: there is a decision or an item in the plan, but nothing works yet. 3, In progress: something is happening, there are drafts, a pilot, part of the scope. 4, Implemented: it works and is documented, people are trained, but there is no systematic measurement yet. 5, Optimised: it works, it is measured and it is regularly improved based on the results.

The boundary that really matters lies between 3 and 4. “In progress” is a state in which companies get stuck for years. A policy written but not approved. A procedure approved but never rehearsed. Only a 4 means there is something to show an auditor or a supervisor.

Fives are not a goal in themselves. For most organisations a solid 4 in the weight-3 areas is far more valuable than fives in peripheral ones.

How to do it honestly

A tool is only as good as the answers you put into it. If one person from IT fills it in on a Friday afternoon, the result will say more about their mood than about the organisation.

It is best to sit down as a small group: someone from security, someone from IT, someone from the business or compliance, and for the governance questions also someone from the board. The quarter of an hour turns into an hour, but it is an hour well spent, because it surfaces differences in how people see the same reality.

Second rule: evidence, not declarations. For every question, ask yourself directly what you would show an auditor. If the answer is “well, everyone knows that’s how we do it”… that is not a 4. It is a 2 or a 3 at best.

Third: “Not applicable” has to be justified. In ISO 27001 every exclusion of an Annex A control goes into the Statement of Applicability (SoA) with a justification. In DORA and NIS2 exclusions must also follow from the scope of your activity, not from convenience. If you tick “Not applicable”, write down one sentence on why straight away.

What to do with the result

The overall score looks nice, but you work on the gaps. Start with the weight-3 questions where you scored 1 or 2. These are the fundamentals, and without them the rest falls apart; they are also what tops the report.

In ISO 27001 this is usually risk assessment, the Statement of Applicability (SoA), the internal audit and the management review. Without a risk assessment there is no justification for controls, without an SoA nobody knows which controls you apply and why, and without an audit and a review there is no evidence the system is running at all.

In DORA, the top of the list is almost always the register of information on contracts with ICT providers, the process for classifying and reporting major incidents, and the contractual clauses from Article 30. The supervisor sees these three things first, because either you have a register ready to submit or you do not.

In NIS2 and KSC the key items are management approval of risk management measures and board training, the incident reporting process, and supply chain security. Responsibility lands on the management body personally, so if the board has approved nothing in writing, that is gap number one.

Typical gaps we see

A few patterns repeat so often you could print them in advance. A risk analysis done once, at implementation, and untouched since. An asset register in a spreadsheet that remembers the previous administrator… a classic museum piece.

Incidents handled well technically, but with no procedure, no classification thresholds and no clock counting down the reporting deadlines. Suppliers assessed when the contract was signed and never again. Training for employees exists, training for the board somehow does not.

And finally, continuity testing. The plan exists, but nobody has ever run it. The first real test usually happens during a real outage, and by then it is too late.

ISO 27001 gap analysis

The ISO 27001 tool walks you through clauses 4-10 of the standard, meaning context, leadership, planning, support, operation, performance evaluation and improvement, and then through the Annex A areas. You get a picture of both the management system and the controls themselves.

If you are just starting, also read our guide ISO 27001 step by step. And once you know what your documentation lacks, a ready-made set is available as the ISO 27001 documentation package (the templates are in Polish).

DORA gap analysis

The DORA tool covers internal governance, the ICT risk management framework, incidents, resilience testing, third-party ICT risk and information sharing. There is also a separate section for ICT service providers, who are not financial entities in scope of DORA themselves but whose financial sector clients require compliance from them.

Not sure whether DORA applies to you? Check the DORA calculator (in Polish). ICT providers will find more on the page for ICT providers, and we described the whole process in the article DORA step by step. You can close the documentation gap with the DORA package (templates in Polish).

NIS2 and KSC gap analysis

The NIS2 tool checks management obligations, the ten risk management measures from Article 21 and incident reporting. These are exactly the areas the authority asks about and the ones that translate into personal liability for the board.

Start by asking whether you are in scope at all: the NIS2 calculator (in Polish) and the article NIS2 and KSC 2.0, who is affected. Once the scope is clear, the NIS2 / KSC documentation package (templates in Polish) shortens the road from gaps to ready procedures.

When to call an expert

A tool gives you a map, but it will not walk the route for you. If the report shows a dozen weight-3 gaps, if you do not know how to build a risk methodology, or if the supervisor has already announced an inspection, that is the moment to have someone who knows the subject look at it from the outside.

What this can cost in different scenarios is laid out in the article how much DORA and NIS2 implementation costs. And if you want to talk specifics, get in touch. Come with your gap analysis report and we will both skip the first meeting :D

A quarter of an hour now, instead of months of wandering later. Pick your tool at /en/analiza-luk and see where you really stand.

Written by someone on the RealSec team. Want to talk specifics ; get in touch.

← All notes