ISO 27001:2022 Gap Analysis

When to Use

If a target is provided via arguments, focus the review on: $ARGUMENTS

• Organization is pursuing ISO 27001:2022 certification for the first time
• Transitioning from ISO 27001:2013 to the 2022 revision
• Conducting a pre-certification readiness assessment or surveillance audit preparation
• Building or refining an Information Security Management System (ISMS)
• Clients or partners require ISO 27001 certification evidence
• Evaluating ISMS scope definition and Statement of Applicability completeness

Context

ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS. The 2022 revision restructured Annex A from 14 domains (114 controls) to 4 themes (93 controls), aligning with ISO/IEC 27002:2022. The ISMS requirements in Clauses 4 through 10 remain the certifiable core; Annex A provides the reference control set used in the Statement of Applicability (SoA).

ISMS Requirement Clauses (Certifiable)