How many controls are in ISO 27001:2022 Annex A?

ISO/IEC 27001:2022 Annex A contains 93 controls grouped into 4 themes: Organisational (37 controls), People (8), Physical (14) and Technological (34). This is a reduction from the 114 controls in ISO 27001:2013, achieved by consolidating overlapping controls and adding 11 new ones covering threat intelligence, cloud security, ICT readiness, secure coding, data leakage, monitoring, web filtering, secure development lifecycle, data masking and configuration management.

Do I need to be certified before running a gap assessment?

No, a gap assessment is the opposite: it is what you run before deciding to seek certification. It tells you what a certification audit would find. Most organisations discover they are 40-60% ready on first assessment and use the gap output to plan a 6-12 month remediation before booking a Stage 1 certification audit.

What deliverables does dcomply produce?

A ready-to-present PDF gap report with: overall maturity score, theme-by-theme heatmap, per-control finding (implemented / partial / not implemented / not applicable), prioritised remediation list ranked by risk × effort, and a first-draft Statement of Applicability. Everything is exportable and mapped to the ISO 27001:2022 clause structure so an auditor can walk through it directly.

How long does a gap assessment take?

For a 100-person organisation with existing documented policies, 4-6 hours of assessment work spread across security, IT, HR and legal. dcomply's guided assessment lets multiple stakeholders answer their own domain in parallel; the aggregated score is available immediately. Compare with 3-4 weeks for a consultant-led gap assessment.

Does the ISO 27001 Gap Assessment cover DPDP overlap?

Yes, dcomply cross-maps each Annex A control to the equivalent DPDP Act 2023 obligation, so organisations pursuing both certification and DPDP compliance see where the same evidence satisfies both. This typically compresses total compliance work by 30-40%.

ISO 27001:2022

ISO 27001 Gap Assessments
for Indian Businesses

Run ISO 27001 Gap Assessments across all 93 Annex A controls of ISO/IEC 27001:2022. Get an instant maturity score, theme-by-theme heatmap, and a prioritised remediation plan with first-draft Statement of Applicability, ready to present to management or a certification auditor.

Try the live product

ISO 27001 ASSESSMENT Completed

Overall Score 72.5%

Maturity Level Level 3. Defined

Controls Assessed 51 / 51

High Priority Gaps 8

4 domains × 51 controls assessed

The Problem

ISO 27001 Gap Assessments Shouldn't Cost ₹5-10 Lakhs

Traditional gap assessments are expensive, slow, and give you a static snapshot that's outdated within months

Expensive Consultants

External ISO consultants charge ₹5-10 Lakhs for a gap assessment that takes weeks. Most SMEs can't afford this before even starting certification.

Spreadsheet Chaos

Most teams manage ISO controls in Excel, no scoring, no prioritization, no history. Spreadsheets don't tell you where to focus first.

No Re-assessment

After fixing gaps, you need another expensive engagement to check progress. There's no easy way to re-assess and compare over time.

Capabilities

Complete ISO 27001:2022 Annex A Coverage

4 Domains, 51 Controls

All Annex A domains covered: Organizational (A5), People (A6), Physical (A7), and Technological (A8). Each control with description and assessment guidance.

5-Level Maturity Model

Automatic scoring: Initial → Managed → Defined → Quantitatively Managed → Optimizing. Know exactly where you stand on the maturity scale.

Prioritized Recommendations

Every non-compliant or partial control gets a prioritized recommendation. High-priority gaps listed first so you focus where it matters most.

Domain Score Breakdown

Visual progress bars for each domain, see at a glance which areas are strong and which need work. Compare domains side by side.

Professional Printable Report

One-click printable report with executive summary, domain scores, gap findings, and detailed control responses. Ready for management or auditors.

Re-assess Anytime

Fix gaps and re-run the assessment to see your progress. Previous responses pre-filled so you only update what's changed. Track improvement over time.

How It Works

From Assessment to Certification Roadmap in 4 Steps

No consultants needed for the initial gap assessment.

Select client and start assessment

Choose an optional client, give the assessment a title, and begin answering control questions domain by domain.

Assess each control: Compliant, Partial, Non-Compliant, or N/A

Each control includes a description and assessment guidance. Quick bulk actions let you set all controls at once if needed.

Review auto-generated scores and recommendations

The system calculates domain scores, overall maturity, and generates a prioritized list of recommendations for every gap.

Export the report and start remediating

Print or save as PDF. Share with management. Use the recommendations as your certification roadmap. Re-assess after fixing gaps.

ISO 27001 Gap Assessments. FAQ

Everything Indian security teams ask before booking a Stage 1 audit.

Comparison of your current security posture against every ISO/IEC 27001:2022 Annex A control. Produces a maturity score, prioritised remediation list and Statement of Applicability draft, the mandatory first step before certification and the most useful pre-audit tool for organisations already certified.

93 controls in 4 themes: Organisational (37), People (8), Physical (14), Technological (34). Reduction from 114 in ISO 27001:2013 by consolidating and adding 11 new controls covering threat intel, cloud security, ICT readiness, secure coding, data leakage, monitoring, web filtering, secure SDLC, data masking and config management.

No, a gap assessment is what you run before deciding to seek certification. It tells you what a certification audit would find. Most organisations are 40-60% ready on first assessment and use the output for a 6-12 month remediation plan before Stage 1.

PDF gap report with overall maturity score, theme heatmap, per-control finding, prioritised remediation ranked by risk × effort, first-draft Statement of Applicability, all mapped to the ISO 27001:2022 clause structure.

For a 100-person organisation with documented policies: 4-6 hours across security, IT, HR and legal. Multiple stakeholders answer their own domain in parallel; aggregated score available immediately. Vs 3-4 weeks for consultant-led.

Yes, each Annex A control is cross-mapped to the equivalent DPDP Act 2023 obligation, so organisations pursuing both see where the same evidence satisfies both. Typically compresses total compliance work 30-40%.

Start Your ISO 27001 Journey

Know your gaps before the auditor finds them. Self-assess in under an hour.

View All Features

ISO 27001 Gap Assessmentsfor Indian Businesses