ISO 27001 Gap Analysis Spreadsheet

The workbook covers Annex A of ISO 27001:2022. Use it to record which controls are in place, where evidence is missing and who will resolve each gap. It is one input to an ISMS review: the management system requirements in clauses 4 to 10, your risk assessment and your Statement of Applicability need attention too.

The file has two sheets: Controls and Dashboard. On Controls, choose a status and record the evidence reference, gap, priority, owner and target date. Keep the reference specific enough for another reviewer to find the same document or system record. If you have not checked an item, leave it as Not Assessed rather than treating the absence of a known problem as evidence that it is working.

The dashboard counts statuses by category. Its percentage is the share of listed entries marked Compliant; it does not measure legal compliance, audit success or the severity of outstanding issues. A single unresolved access or recovery problem can matter more than several completed documentation tasks. Review the findings alongside the count.

Use the workbook locally or keep it in your existing document process. The online assessment is a separate workflow. Paid template imports create question structure; completed answers, formulas, owners and attachments are not transferred automatically. Keep the original workbook as your working record if you choose to continue in the app.