Gap assessment
Start from the framework, not a blank spreadsheet. Every requirement is listed with its controls, so you can see what is in place and what is missing.
- Requirement-by-requirement status
- Statement of Applicability for ISO 27001
- Owners and due dates for every gap