Baseline measurement and gap analysis for ISO 27001
A baseline measurement and a gap analysis are the first steps in preparing for ISO 27001 . You map out where you stand now and what is still missing compared with the standard. The difference: a baseline measurement describes your current situation, while a gap analysis sets that against the requirements of the standard and names the gaps. You can buy the standard itself from NEN . Want to see the whole process? Read the step-by-step plan.
This step prevents surprises. You know in advance how much work lies ahead, what you already do well, and where your budget and time will go.
What is the difference between a baseline measurement and a gap analysis?
People use the terms interchangeably, but there is a logical difference.
| Part | What it is | Result |
|---|---|---|
| Baseline measurement | A snapshot of your current information security | Overview of what you have now |
| Gap analysis | Comparing that snapshot with the requirements of ISO 27001 | List of gaps and actions |
In practice you do both in one process. First the baseline measurement (what is there?), then the gap analysis (what is missing?). An installation company that already has firewalls, backups and a password policy often finds that the measures exist, but the documentation and structure do not.
The steps of a gap analysis
You can do a gap analysis yourself with the standard in hand, or bring in an external adviser for a fresh perspective. Both work. For a first certification, experience helps.
- Collect your current documentation and measures. Policies, procedures, technical settings.
- Go through the requirements in clauses 4 to 10. Do you already comply, partly comply, or not comply?
- Review the 93 Annex A controls. Which do you already have, sometimes without calling them that?
- Note the gaps and their impact. What is missing, and how important is it?
- Prioritise based on risk. Start with the gaps that cover the most risk.
Checklist per clause (4 to 10)
ISO 27001 consists of the management requirements in clauses 4 to 10. The table shows what you check for each clause during the gap analysis. A detailed explanation of each clause is on requirements of the standard.
| Clause | What you check |
|---|---|
| 4. Context | Do you know your interested parties, and has the scope of the ISMS been defined? |
| 5. Leadership | Is the board involved, and is there an information security policy? |
| 6. Planning | Is there a risk assessment and a SoA? |
| 7. Support | Are resources, competences, awareness and documentation arranged? |
| 8. Operation | Are the chosen measures actually carried out? |
| 9. Performance evaluation | Do you take measurements, run internal audits and hold a management review? |
| 10. Improvement | Do you address nonconformities and improve continually? |
What do you do with the outcome?
The gap analysis produces a prioritised action list. That list is your project plan. For each gap, you decide who is the owner, what the action is and when it must be finished.
The biggest gaps are usually not in the technology, but in documentation, ownership and the risk assessment. Start there. After that the process moves on to building your ISMS and finally the certification audit.
Are you a small company? Read how to keep the process affordable in ISO 27001 for a small business.
More information
- Step-by-step plan: from zero to certificate
- Defining the scope: how do you set the boundaries before you start?
- Requirements of the standard: all clauses explained
- Risk assessment: the foundation of your ISMS
- The ISMS: the heart of ISO 27001
- Costs and timeline: what does certification cost?