Most ISO 27001 gap assessments focus on Annex A and skip clauses 4 to 10, which is backwards: the management system clauses are mandatory and are where certification audits most often find problems.
Assess the clauses before the controls. Clauses 4 to 10 define the management system and are not optional. Organisations with excellent technical controls still fail certification on management review, internal audit, and documented objectives.
Score honestly against evidence. Rate each item on whether you could produce evidence today. 'We do that' without an artefact is a gap, because the auditor samples evidence rather than accepting assertion.
Sequence by dependency. Scope, risk assessment, and the Statement of Applicability come first because everything else references them. Starting with technical controls means reworking them once scope is settled.
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
Score 0 (nothing) to 3 (fully implemented with evidence). These are mandatory.
| Clause | Requirement | Score | Evidence today | Gap | Effort (days) | Owner |
|---|---|---|---|---|---|---|
| 4 | Context, interested parties, and ISMS scope defined | 1 | Informal understanding only | No documented scope statement | 3 | CISO |
| 5 | Leadership commitment, policy, roles and responsibilities | 2 | Security policy approved | Roles not formally assigned | 2 | CISO |
More free templates IT teams use alongside this one.
The Statement of Applicability is the document a certification auditor works from, and the column they actually test is justification, particularly for controls you have excluded. 'Not applicable' without a defensible reason is a finding.
A SOC 2 Type II does not test whether you have a control. It tests whether the control operated throughout the period, and asks you to prove it with artefacts from specific dates. This tracker is organised around that reality: per control, per evidence artefact, per sample date.
Risk registers fail in one of two ways: everything scores medium, or the register is written once for an audit and never opened again. This one forces a treatment decision and a review date on every row, because a risk with neither is a note, not a managed risk.
Clauses 4 to 10, which define the mandatory management system, and the 93 Annex A controls across organisational, people, physical, and technological themes. Each scored against evidence you could produce today, with effort estimates.
Most often on the management system clauses rather than technical controls: no internal audit programme, no management review, no measurable objectives, or no corrective action process. Technical maturity does not compensate for these.
Scope, risk methodology, and the Statement of Applicability first, since every other artefact references them. Then the mandatory processes, then control gaps, then a period of operating the controls to generate evidence for the stage 2 audit.
