Why run an ISO 27001 gap analysis now
The transition is over. Under IAF MD 26, organizations had “36 months from the last day of publication month of ISO/IEC 27001:2022 (i.e. 31 October 2025)” to move, and “All certifications based on ISO/IEC 27001:2013 shall expire or be withdrawn at the end of the transition period” (IAF MD 26). Any organization still running 2013-era controls, or preparing for first certification, needs a gap analysis against the 2022 edition.
Demand keeps growing. The ISO Survey 2024 reports 96,709 ISO/IEC 27001 certificates, up from 47,291 the year before (ISO Survey 2024 infographic). Part of that jump likely reflects a change in data collection: ISO now compiles the survey from IAF CertSearch (ISO).
For how ISO 27001 certification compares with a SOC 2 examination, see ISO 27001 vs SOC 2 Assessment: Choosing a Security Compliance Assessment.
What you are measuring against
| Part | Contents |
|---|---|
| Clauses 4–10 (mandatory) | Context, leadership, planning (including new 6.3 planning for changes), support, operation, performance evaluation, improvement |
| Annex A (93 controls) | Organizational (37), People (8), Physical (14), Technological (34) (Secureframe) |
| Amendment 1:2024 | ”Climate action changes,” published February 23, 2024 (ISO) |
The 2022 edition replaced 114 controls with 93, and 11 controls are new (Cloud Security Alliance), including threat intelligence, cloud services security, data masking, data leakage prevention and secure coding.
Related standard to watch: ISO/IEC 42001. Published December 18, 2023, it specifies requirements for an AI management system (ISO). Organizations building AI products increasingly run 27001 and 42001 gap analyses together, and questionnaires such as SIG 2026 now map to ISO 42001.
ISO 27001:2022 gap analysis checklist
Management system (clauses 4–10)
- 4: Scope defined, with internal and external issues and interested parties’ requirements
- 5: Information security policy approved; roles and responsibilities assigned
- 6.1: Risk assessment and treatment methodology defined; risk treatment plan approved
- 6.1.3: Statement of Applicability lists all 93 Annex A controls with justification
- 6.2: Measurable security objectives set
- 6.3: Changes to the ISMS are planned (new in 2022)
- 7: Resources, competence, awareness and documented information controlled
- 8: Risk assessments and treatment carried out at planned intervals
- 9: Monitoring, internal audit and management review performed
- 10: Nonconformities corrected; continual improvement evidenced
- Climate change considered in context and interested parties (Amendment 1:2024)
Annex A: new 2022 controls to check first
- Threat intelligence
- Information security for use of cloud services
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities
- Web filtering
- Secure coding
For each control, record
| Field | Example |
|---|---|
| Control | 5.23 Cloud services security |
| Status | Partially met |
| Evidence | Cloud security policy v2 §3; vendor review records |
| Gap | No exit strategy for critical SaaS providers |
| Owner and due date | IT Security lead, Q1 |
What to look for in ISO 27001 gap analysis software
| Capability | Why it matters | Red flag |
|---|---|---|
| Evidence linked to each control | Auditors test evidence, not checkboxes | Self-attested status with no documents |
| Passage-level citations | Reviewers can verify in seconds | Scores with no source |
| SoA generation from assessment | Keeps SoA and reality in sync | SoA maintained in a separate spreadsheet |
| Multi-framework mapping | Reuse evidence for SOC 2, NIST CSF, ISO 42001 | One framework only |
| Human review and audit trail | Accountability for each judgment | AI decides status alone |
Assess your ISMS documents in hours
The bulk of a gap analysis is reading: policies, procedures, risk registers and records, each checked against clauses and controls. AI evidence assessment can map your documents to ISO 27001:2022, flag controls with no supporting evidence and cite the passage behind every finding.
Try a security evidence assessment on your current policy set. AskDona shows the evidence; your team decides.
FAQ
Is ISO 27001:2013 still valid? No. Certifications to the 2013 edition expired or were withdrawn after October 31, 2025 (IAF MD 26).
How many controls are in ISO 27001:2022 Annex A? 93, in four themes: organizational, people, physical and technological (Secureframe).
What did Amendment 1:2024 change? It adds climate action changes to the standard, published February 23, 2024 (ISO).
Should we do ISO 42001 at the same time? If you build or deploy AI, a combined gap analysis saves effort, since both are management system standards (ISO).
References
All pages opened and checked by October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| ISO: ISO/IEC 27001:2022 | Standards body | Oct 25, 2022 | Standard status |
| ISO: Amendment 1:2024 | Standards body | Feb 23, 2024 | Climate action changes |
| IAF MD 26 Issue 2 | Accreditation body | Feb 15, 2023 | Transition deadline |
| Secureframe: ISO 27001 controls | Vendor blog | Undated | Annex A themes |
| CSA: ISO/IEC 27002:2022 update | Industry body | Feb 23, 2022 | 93 controls, 11 new |
| ISO Survey 2024 infographic | Secondary (ISO data) | Oct 2025 | Certificate counts |
| ISO: The ISO Survey | Standards body | 2025 | Method change |
| ISO: ISO/IEC 42001 | Standards body | Dec 18, 2023 | AI management system |