04
Gap Analysis
A structured evaluation of your security, business continuity and privacy arrangements against the frameworks that matter to your business. We identify missing controls, evidence gaps and remediation priorities so you know exactly what to fix and in what order.
Scope
ISO/IEC 27001▶
ISMS scope, clauses 4–10 and Annex A controls against required evidence
ISO 22301▶
Business impact analysis, continuity strategies, incident response, recovery, exercising and continual improvement
GDPR / UK GDPR▶
Governance, lawful basis, data subject rights, DPIAs, retention, processors, breach management and security of personal data
- Documentation, policy and procedure review across selected frameworks
- Stakeholder interviews across people, process and technology
- Maturity scoring per control domain with effort and impact ratings
Deliverables
- Gap analysis report with maturity scoring per domain
- Control-by-control compliance matrix mapped to the selected framework
- Evidence checklist and remediation roadmap sequenced over 3, 6 and 12 months
- Executive presentation of findings and priorities
- Optional readout workshop with leadership and control owners
Typical timeline
Kickoff
Framework selection, scope confirmation and document request list.
Assessment
Evidence review, interviews and control testing.
Reporting
Scoring, roadmap and executive deck.
Readout
Leadership presentation and Q&A.