ISO 27001 gap self-assessment

Six questions to gauge how far your ISMS is from ISO 27001 certification. A rough guide, not a formal gap analysis — answers stay in your browser.

1. Have you defined the scope of your information security management system (ISMS)?

The scope sets which parts of the business, systems and locations ISO 27001 covers.

Yes — documented and agreed We have a rough idea No

2. Do you maintain an information security risk assessment?

Yes — with a defined methodology and treatment plan We’ve started, but it’s incomplete No

3. Do you have the core ISO 27001 policies and procedures in place?

Yes — a full policy set, approved and in use Some policies, but gaps remain Little or nothing documented

4. Have you produced a Statement of Applicability (SoA)?

Yes I know what it is but haven’t written one No / not sure what it is

5. Do you run internal audits and management reviews of the ISMS?

Yes — both, on a schedule Occasionally / informally No

6. How are your Annex A controls (access, backups, supplier security, etc.) implemented?

Implemented and evidenced Partly — some controls in place Not yet addressed

This quick self-check is for guidance only and isn’t a formal assessment.

Not sure where you stand?

Check your DSPT readiness or book a free 15-minute review.

360 Cyber Compliance

DSPT, Cyber Essentials, ISO 27001 and data protection made simple for care homes and GP, dental & pharmacy practices across the UK.

Led by a BCS Fellow and NEXT CIO 2025, with 20+ years in IT, cyber security and compliance. Meet the team →

Services

DSPT · Cyber Essentials · ISO 27001 · IASME · PCI DSS · UK GDPR