Before you can close the distance to a standard, someone has to measure it.

Pick a target, such as ISO/IEC 27001, SOC 2 or India's Digital Personal Data Protection Act. Go through its requirements one at a time and ask: do we do this, partly do it, or not at all, and can we prove it? The result is a gap list, ranked so the most important and the slowest fixes start first.

Without one, teams guess. They write policies nobody needed and miss the control an auditor will test first. A gap assessment gives leadership a realistic picture of effort, lets you sequence work and budget, and sets a baseline to measure progress against. It is not an audit and produces no opinion or certificate; it is a planning tool. The NIST Cybersecurity Framework expresses the same idea as comparing a current profile with a target profile.

The project kickoff

Usually the first piece of work once the target and scope are agreed.

The board or investor update

A summary of gaps and their status shows progress in plain terms.

The remediation plan

Each gap becomes a task with an owner and a target date.

The first draft of the Statement of Applicability

For ISO/IEC 27001, the assessment often seeds the first view of which Annex A controls apply.

Readiness assessment

Done closer to the audit, it asks whether you would pass now, often by testing evidence. A gap assessment comes earlier and asks what is missing.

Risk assessment

Looks at threats to your information and what could go wrong. A gap assessment looks at distance from a set of requirements. ISO/IEC 27001 requires the first; the second helps you build it.

Internal audit

A required, independent check of a running management system. A gap assessment is optional and usually happens before the system exists.

• Fix the target and the scope first; a gap list against the wrong scope wastes effort.
• Rate each requirement as met, partly met or not met, and note the evidence behind each rating.
• Rank gaps by audit impact and by how long the fix takes.
• Repeat a short version before the audit to confirm the gaps have closed.

• GuideAn ISO 27001 implementation roadmapThe order of work from scope to certification audit.
• GuideThe readiness assessment, step by stepWhat it produces, what it doesn't, and how to use the result.
• GuideTiers & profilesCurrent vs target profiles, and the four implementation tiers.

Sources: ISO/IEC 27001:2022 clause titles and Annex A control titles; NIST Cybersecurity Framework 2.0 on current and target profiles; AICPA Trust Services Criteria; ISO/IEC 17021-1 on certification body impartiality.