<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-iso-27001-gap-analysis
description: >-
  Perform structured gap analysis against ISO/IEC 27001:2022 Annex A controls.
  Automate Statement of Applicability (SoA) generation, control maturity
  scoring, risk treatment plan mapping, and evidence collection for ISMS
  certification readiness.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - iso-27001
  - isms
  - gap-analysis
  - annex-a
  - risk-treatment
  - certification
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing ISO 27001 Gap Analysis

## Overview

ISO/IEC 27001:2022 specifies requirements for an Information Security Management
System (ISMS). The 2022 revision reorganizes Annex A into 4 themes (Organizational,
People, Physical, Technological) with 93 controls. A gap analysis measures current
posture against these controls to produce a remediation roadmap for certification.

Mode: `[MODE: BLUE]` — Compliance assessment with structured evidence collection.

## Prerequisites

| Requirement | Install |
|---|---|
| InSpec | `gem install inspec` |
| OPA | `curl -L -o opa https://openpolicyagent.org/downloads/latest/opa_linux_amd64_static && chmod +x opa` |
| Python 3.10+ | For agent tooling |
| jq | `apt install jq` |

## Key Concepts

### ISO 27001:2022 Annex A Control Themes

```
Annex A Controls (93 total):
├── A.5 Organizational Controls (37)
│   ├── A.5.1  Policies for information security
│   ├── A.5.2  Information security roles and responsibilities
│   ├── A.5.7  Threat intelligence
│   ├── A.5.23 Information security for cloud services
│   └── ...
├── A.6 People Controls (8)
│   ├── A.6.1  Screening
│   ├── A.6.3  Information security awareness/training
│   └── ...
├── A.7 Physical Controls (14)
│   ├── A.7.1  Physical security perimeters
│   ├── A.7.4  Physical security monitoring
│   └── ...
└── A.8 Technological Controls (34)
    ├── A.8.1  User endpoint devices
    ├── A.8.5  Secure authentication
    ├── A.8.9  Configuration management
    ├── A.8.15 Logging
    ├── A.8.24 Use of cryptography
    └── ...
```

### Maturity Scoring Model

| Level | Score | Description |
|---|---|---|
| Non-existent | 0 | Control not implemented, no awareness |
| Initial | 1 | Ad-hoc, reactive, person-dependent |
| Repeatable | 2 | Documented process exists but inconsistent |
| Defined | 3 | Standardized and communicated across org |
| Managed | 4 | Measured, monitored, predictable outcomes |
| Optimized | 5 | Continuous improvement, automated where possible |

### Statement of Applicability Template

```yaml
# soa_template.yml
controls:
  A.5.1:
    title: "Policies for information security"
    applicable: true
    justification: "Required for ISMS scope"
    current_maturity: 2
    target_maturity: 4
    gap: 2
    risk_treatment: "implement"
    evidence:
      - "IS-POL-001 Information Security Policy v3.2"
      - "Board approval minutes 2026-01-15"
    owner: "CISO"
    deadline: "2026-06-30"

  A.8.24:
    title: "Use of cryptography"
    applicable: true
    justification: "Data at rest and in transit requires encryption"
    current_maturity: 3
    target_maturity: 4
    gap: 1
    risk_treatment: "improve"
    evidence:
      - "Cryptography standard CS-STD-004"
      - "TLS scan report 2026-02-01"
    owner: "Security Architecture"
    deadline: "2026-04-30"
```

### Automated Control Checks

```bash
# Check password policy configuration (A.8.5)
grep -E "^(minlen|dcredit|ucredit|lcredit)" /etc/security/pwquality.conf

# Verify audit logging enabled (A.8.15)
systemctl is-enabled auditd && auditctl -s | grep enabled

# Check encryption at rest (A.8.24)
lsblk -o NAME,FSTYPE,MOUNTPOINT | grep -i crypt
dmsetup status | grep crypt

# Verify TLS configuration (A.8.24)
openssl s_client -connect app.example.com:443 2>/dev/null | \
  openssl x509 -noout -subject -dates -issuer

# Check backup configuration (A.8.13)
restic snapshots --json 2>/dev/null | jq '.[0].time'

# Verify access control lists (A.8.3)
getfacl /etc/shadow
stat -c '%a %U %G' /etc/passwd /etc/shadow /etc/group
```

## Workflow

### Step 1: Initialize Gap Analysis

```bash
node scripts/agent.js --action init --scope "Corporate IT" \
  --output /tmp/iso27001-gap.json
```

### Step 2: Run Automated Control Assessment

```bash
node scripts/agent.js --action assess --themes organizational,technological \
  --target ssh://audit@server1 --output /tmp/iso27001-assess.json
```

### Step 3: Generate SoA and Remediation Plan

```bash
node scripts/agent.js --action report --input /tmp/iso27001-assess.json \
  --format soa --output /tmp/iso27001-soa.json
```

## Verification

- [ ] All 93 Annex A controls assessed with maturity score
- [ ] Statement of Applicability generated with justifications
- [ ] Non-applicable controls documented with exclusion rationale
- [ ] Risk treatment plan maps gaps to remediation actions
- [ ] Evidence artifacts linked to each applicable control
- [ ] Target maturity dates assigned with responsible owners

## References

- [ISO/IEC 27001:2022](https://www.iso.org/standard/27001)
- [ISO/IEC 27002:2022 Control Guidance](https://www.iso.org/standard/75652.html)
- [ISMS Online SoA Template](https://www.isms.online/)
- [Annex A Control Mapping](https://www.iso27001security.com/html/27001.html)
