// ISO 27001 READINESS · HANS STUDY · ONTARIO, CANADA
ISO 27001 and NIST CSF readiness
A customer security questionnaire or a contract clause has made an information security management system a requirement, and nobody on staff has run one before. This gap assessment maps what exists today against ISO/IEC 27001 or the NIST Cybersecurity Framework and sets out what's missing.
What it covers
A control-by-control gap assessment against ISO/IEC 27001 Annex A or the NIST CSF functions, whichever the organization is targeting, covering policy, access control, asset management, risk treatment, supplier security, incident response, and the evidence an auditor or assessor would expect to see for each one.
What you receive
- A control-by-control gap report against the chosen framework
- A remediation plan sequenced by what an auditor checks first
- A statement of applicability draft, where ISO 27001 is the target
Where this sits next to the rest of the practice
A gap assessment is a point-in-time deliverable. Running the program that comes after it, risk register, ongoing policy maintenance, and audit cycles, is fractional CISO work.
Questions
What is an ISO 27001 gap assessment?
A control-by-control gap assessment against ISO/IEC 27001 Annex A or the NIST CSF functions, whichever the organization is targeting. It maps what exists today and sets out what's missing. Where ISO 27001 is the target, a statement of applicability draft is part of it.
Does the gap assessment certify us for ISO 27001?
No. It's a point-in-time gap assessment, not a certification audit. The remediation plan is sequenced by what an auditor checks first.
Can I use the NIST CSF instead of ISO 27001?
Yes. The assessment maps against ISO/IEC 27001 or the NIST Cybersecurity Framework, whichever you are targeting. It covers policy, access control, asset management, risk treatment, supplier security, incident response, and the evidence an auditor or assessor would expect for each.
Who runs the program after the gap assessment?
Running the program that comes after it, with the risk register, ongoing policy maintenance, and audit cycles, is fractional CISO work.
Can you write the policies ISO 27001 needs?
Yes, through the policy pack, which writes policies against your real environment and maps each to the requirements it answers. The free policy builder also has a general set for ISO 27001 buyers.
How is the engagement priced?
A short call confirms the framework, the staff count, and the scope. A written quote comes before any work starts.
Book a scoping call
A short call confirms the framework, the staff count, and the scope.
Delivered remotely, or through the DHD, a remote access device shipped to site.