July 10, 202611 min read

Compliance Gap Assessment: How to Measure Your Current State Against NIST CSF and ISO 27001

Sources:NIST CSF 2.0 Self-Assessment Methodology|ISO/IEC 27001:2022 Standard Information|CISA Cyber Performance Goals

Eric Bang

Founder & Cybersecurity Evangelist

NIST CSF 2.0

released February 2024 — the updated framework adds a new Govern function and expands from 5 to 6 core functions, requiring organizations to reassess prior CSF 1.1 gap assessments

Annex A

ISO 27001:2022 has 93 controls in 4 themes (Organizational, People, Physical, Technological) — down from 114 controls in 14 domains in ISO 27001:2013

3-6 months

typical duration for a structured external gap assessment for an organization of 500-2000 employees — internal-only assessments often complete faster but with lower objectivity

30-40%

average gap rate found in first-time ISO 27001 gap assessments at organizations with informal security programs — most gaps are in documentation, not technical controls

Scoping decisions before starting a gap assessment

Poor scope definition is the most common cause of gap assessments that produce useless outputs. Define scope before any evidence collection begins.

Choose the right framework for your assessment

NIST CSF: voluntary framework originally for critical infrastructure, widely used for internal security program maturity measurement and board-level communication. Produces a maturity tier rating (Partial, Risk-Informed, Repeatable, Adaptive) for each function. Not a certification framework. ISO 27001: certification standard — passing an ISO 27001 audit results in a third-party certification. Requires formal documentation, an ISMS (Information Security Management System) with documented scope, and an Annex A control implementation decision record (Statement of Applicability). SOC 2 Type II: attestation framework focused on cloud service providers and service organizations — auditor-tested controls over a 6-12 month observation period. If the goal is customer trust or contract compliance, SOC 2 may be more relevant than ISO 27001.

Define the ISMS scope for ISO 27001 assessments

ISO 27001 requires a defined scope — the physical locations, business units, information assets, and services covered by the ISMS. A common scoping mistake: attempt to certify the entire organization in a first audit, producing an enormous scope that makes the initial certification impractical. Better approach: define a limited initial scope (one product line, one geographic region, one service) that represents a meaningful certification while being achievable. The certification can be expanded in subsequent surveillance audits.

Determine assessment approach: internal, external, or hybrid

Internal assessment: security team assesses their own controls. Advantage: low cost, deep organizational knowledge. Disadvantage: confirmation bias — teams tend to view their own controls more favorably than an outsider would. External assessment: a third party performs the assessment. Advantage: objectivity, benchmark data from other organizations, and findings more credible to leadership and auditors. Disadvantage: cost ($30K-$150K for organizations of 200-2000 employees depending on scope and framework). Hybrid: internal team collects evidence, external assessor validates and rates. Often the best balance of cost and objectivity for first assessments.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The NIST CSF 2.0 gap assessment methodology

NIST CSF 2.0 organizes security outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Each function contains categories and subcategories — 106 subcategories in total — that represent specific security outcomes.

Step 1: Create the current profile (where you are today)

For each CSF subcategory (or a prioritized subset): rate your current implementation on a 0-4 scale. 0: not implemented. 1: partial implementation, significant gaps. 2: risk-informed, implemented but not fully consistent. 3: repeatable, consistently implemented with formal process. 4: adaptive, continuously improved based on metrics. Evidence collection per subcategory: interview the control owner, review documentation, and if possible observe or test the control functioning. Avoid self-rating by control owners without evidence validation — this produces inflated scores.

Step 2: Define the target profile (where you need to be)

The target profile is not necessarily all 4s across all subcategories. Define the target tier for each function based on your organization's risk tolerance, regulatory requirements, and business context. A small organization without a formal security team may target Tier 2 (Risk-Informed) across most functions as a realistic near-term goal. A financial services firm with regulatory requirements and incident history may target Tier 3 (Repeatable) for all functions. Gap = target tier minus current tier, per category.

Step 3: Prioritize gaps by function risk weight

Not all CSF subcategory gaps are equal priority for remediation. Prioritize by: risk to critical assets (gaps in controls protecting your highest-value data get highest priority), regulatory requirement (gaps in controls tied to specific regulatory obligations like HIPAA or PCI), and operational impact (gaps that represent active risk rather than documentation gaps). The CISA Cyber Performance Goals (CPGs) identify the highest-impact subset of CSF controls for critical infrastructure — these are a useful prioritization reference for most organizations.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

The ISO 27001:2022 gap assessment methodology

ISO 27001:2022 gap assessment has two components: clause requirements (organizational requirements for the ISMS) and Annex A controls (the specific security controls). Both must be assessed.

Clause gap assessment: the ISMS requirements (clauses 4-10)

ISO 27001 clauses 4-10 define requirements for how the ISMS must be structured: context of the organization (clause 4), leadership commitment (clause 5), planning including risk assessment process (clause 6), support including awareness and documentation (clause 7), operational implementation (clause 8), performance evaluation (clause 9), and continual improvement (clause 10). Gaps in clauses are often documentation and process gaps: no documented risk assessment methodology, no management review records, no ISMS scope statement. These gaps are typically fast to remediate with documentation work but require real organizational commitment to implement meaningfully.

Annex A control gap assessment: the Statement of Applicability

ISO 27001:2022 Annex A contains 93 controls in four themes. The Statement of Applicability (SoA) is a required document that records, for each Annex A control: is it applicable to your organization? If applicable, is it implemented? If not applicable, the justification for exclusion. Assessing each control requires: reviewing existing policies and procedures, interviewing control owners, and where possible testing control function. Rate each control: Implemented, Partially Implemented (documented gap), or Not Implemented. Controls rated Not Implemented or Partially Implemented become remediation items.

Risk assessment integration: linking gaps to risk treatment

ISO 27001 requires a risk assessment tied to the control implementation decisions. For each information asset at risk: identify threats and vulnerabilities, assess likelihood and impact, determine acceptable risk level, and choose a treatment option (implement a control, accept the risk, transfer via insurance, avoid the activity). Control gaps in the SoA should map to risks in the risk register — a gap with no associated risk assessment record is a documentation gap that auditors will flag. Maintaining the risk register as a living document (updated when new threats or assets emerge) is both an audit requirement and an operational best practice.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Building the remediation roadmap from gap assessment output

The gap assessment output is a list of gaps. The remediation roadmap converts that list into a sequenced, resourced plan that leadership can fund and the security team can execute.

Categorize gaps by type: documentation, process, and technical

Documentation gaps (policies exist as concepts but are not written): fast and cheap to remediate, typically 1-5 days of security team effort per document. Process gaps (controls exist technically but are not consistently followed — no formal change management despite change management software being deployed): require process design and training, typically 2-8 weeks per control. Technical gaps (the control does not exist — no MFA, no EDR, no log centralization): require procurement, deployment, and configuration — weeks to months and budget approval. Categorizing gaps this way produces a quick-win list (documentation gaps) that can be completed before the certification audit while the longer technical remediation work proceeds.

Sequence remediation by dependencies and certification timeline

Some controls depend on others: centralized logging (the technical control) must exist before log review procedures (the process control) can be meaningful. Sequence technical foundation controls first, then process controls that depend on them, then documentation that describes the process. If working toward ISO 27001 certification: the risk assessment and SoA must be complete before the stage 1 audit; all controls must be implemented (or justified as not applicable) before the stage 2 audit. Work backward from the target certification date to set remediation deadlines per control category.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

A compliance gap assessment produces value proportional to the rigor of the evidence collection and the quality of the remediation roadmap. Document-only assessments produce optimistic current-state views that fail under auditor scrutiny. Control testing and evidence validation produce accurate current-state baselines. A remediation roadmap sequenced by risk, type, and certification timeline converts the gap list into a funded, executable security improvement program — the ultimate output of a gap assessment done correctly.

Frequently asked questions

How often should we run a compliance gap assessment?

For organizations targeting ISO 27001 certification: run a gap assessment 9-12 months before your target certification date, allowing time for remediation before the formal audit. After certification, ISO 27001 requires annual surveillance audits and a full recertification audit every 3 years — run internal assessments 3-6 months before each external audit to identify and remediate gaps before the auditor arrives. For NIST CSF: run annual self-assessments to track maturity progression over time. Organizations in regulated industries (financial services, healthcare, critical infrastructure) may have more frequent external assessment requirements driven by regulatory frameworks (FFIEC, HIPAA, NERC CIP).

What is the difference between a gap assessment and a risk assessment?

A gap assessment measures the distance between current controls and framework requirements — it is framework-centric. A risk assessment identifies threats, vulnerabilities, and potential impacts to your organization's specific assets — it is risk-centric. ISO 27001 requires both: a risk assessment to identify what risks to treat, and a gap assessment (the SoA) to document which controls are implemented to treat those risks. NIST CSF integrates both in a single framework. In practice, they are complementary: the risk assessment identifies what needs protecting; the gap assessment confirms whether the controls protecting it meet the required standard.

Can we use the same gap assessment for multiple frameworks?

Yes — with a control crosswalk. NIST, ISO 27001, SOC 2, and other frameworks share significant control overlap. A single evidence collection effort can feed multiple framework gap assessments if you map the control evidence to each framework's requirements. Tools that support multi-framework management (Vanta, Drata, Secureframe, OneTrust) maintain a single control library and map each control to its corresponding requirements in ISO 27001, SOC 2, NIST CSF, PCI DSS, and others — reducing the evidence collection effort by 40-60% compared to running separate gap assessments for each framework.

Sources & references

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Free newsletter

Get threat intel before your inbox does.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.

Unsubscribe anytime. We never sell your data.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Back to all briefings

Subscribe for Updates

compliance gap assessment NIST CSF gap assessment ISO 27001 gap assessment security compliance methodology SOC 2 gap analysis compliance current state assessment security program gap analysis 2026 compliance remediation roadmap

Black Hat Giveaway

Win a $2,495 Black Hat pass.

Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.

Compliance Gap Assessment: How to Measure Your Current State Against NIST CSF and ISO 27001

Scoping decisions before starting a gap assessment

The NIST CSF 2.0 gap assessment methodology

The ISO 27001:2022 gap assessment methodology

Building the remediation roadmap from gap assessment output

The bottom line

Frequently asked questions

How often should we run a compliance gap assessment?

What is the difference between a gap assessment and a risk assessment?

Can we use the same gap assessment for multiple frameworks?

Sources & references

Critical CVE Reference Card 2025–2026

Ransomware Incident Response Playbook

Get threat intel before your inbox does.

Subscribe to enter the giveaway