Why Mid-Size Organizations Get ISO 27001 Gap Assessments Wrong
An ISO 27001 gap assessment is supposed to give your leadership team a clear, honest picture of where your Information Security Management System (ISMS) stands against the standard's requirements. In practice, at mid-size organizations — those operating between roughly 100 and 2,000 employees — these assessments frequently miss the same categories of gaps, year after year.
I have seen this pattern repeatedly across defense contractors, healthcare organizations, and federal vendors. The issue is not that these organizations lack commitment to security. The issue is that gap assessments are often scoped too narrowly, conducted by teams without deep operational knowledge of the business, or treated as a documentation exercise rather than a genuine risk-reduction effort.
What follows are the eight gaps we most commonly find hiding beneath the surface at mid-size organizations pursuing ISO 27001 certification — and what you need to do about each one.
1. Scope Definition That Excludes Critical Business Processes
The single most consequential decision in any ISO 27001 program is how you define the scope. Mid-size organizations routinely draw scope boundaries around their IT infrastructure and stop there. Cloud platforms, managed service providers, remote workers, shared drives accessed by third parties — these routinely fall outside the defined scope even though they handle sensitive information daily.
ISO 27001:2022 is explicit: the scope must reflect the organization's context, including interested parties and the interfaces and dependencies between activities performed by the organization and those performed by external parties. A scope that undercounts your actual information processing environment will produce a certification that does not match operational reality — and will not hold up under a surveillance audit.
Before you finalize scope, map your information flows first. Follow the data, not the org chart.
2. Risk Assessment Methodology That Is Not Repeatable
ISO 27001 requires a formal, documented risk assessment process that produces consistent, comparable, and reproducible results. What we find at most mid-size organizations is a spreadsheet that one person built, filled out once, and filed away. There is no defined risk criteria, no asset-threat-vulnerability linkage, no rationale for risk scoring, and no mechanism for repeating the assessment when something changes.
This matters because the standard requires you to perform risk assessments at planned intervals and whenever significant changes occur. A methodology that lives in someone's head or in an undocumented spreadsheet cannot satisfy Clause 6.1.2 — and auditors will probe this directly.
If your risk assessment cannot be handed to a new employee and reproduced with consistent results, it is not a methodology. It is a worksheet. Our Federal and SLED Risk Assessment services are built around repeatable, defensible methodologies that satisfy both ISO 27001 and federal framework requirements simultaneously.
3. Statement of Applicability That Is Copied, Not Reasoned
The Statement of Applicability (SoA) is one of the most audited documents in an ISO 27001 certification. It lists every Annex A control, states whether each is applicable or excluded, and provides justification for each decision. At mid-size organizations, the SoA is frequently populated by copying a template and marking most controls as applicable to avoid the work of reasoning through exclusions.
The problem with this approach is twofold. First, controls marked applicable must be implemented. Marking a control applicable and then not implementing it is a nonconformity. Second, exclusions must be justified. An auditor will ask why specific controls were excluded and whether those exclusions create unacceptable risk. A copied SoA cannot answer those questions credibly.
Your SoA should trace directly back to your risk assessment results and your risk treatment plan. It is not a standalone document — it is the bridge between your risk decisions and your control implementation.
4. Supplier and Third-Party Risk Controls That Exist Only on Paper
ISO 27001:2022 significantly strengthened its treatment of supplier relationships, particularly through the new controls introduced in Annex A around supplier security and cloud service management. Mid-size organizations almost universally have a supplier policy. Very few have operationalized it.
What operationalized supplier security looks like in practice: documented inventory of suppliers with access to your information assets, tiered risk classification of those suppliers, security requirements embedded in contracts, a process for reviewing supplier security posture at defined intervals, and procedures for handling supplier incidents that affect your environment.
What we typically find: a policy document, a master service agreement template with generic security language, and no active monitoring of any supplier's security posture whatsoever. For organizations in the defense industrial base, this gap compounds quickly because your suppliers may be handling Controlled Unclassified Information subject to additional regulatory requirements beyond ISO 27001.
5. Insufficient Evidence of Leadership Involvement
Clause 5 of ISO 27001 places explicit requirements on top management — not the IT department, not the compliance manager, but the organization's leadership. Top management must demonstrate commitment to the ISMS, establish an information security policy, assign roles and responsibilities, and integrate ISMS requirements into business processes.
At mid-size organizations, the ISO 27001 program is frequently owned entirely by the IT or compliance team, with leadership involvement limited to signing a policy document once a year. Auditors have become increasingly sophisticated at testing whether leadership engagement is genuine or ceremonial. They will ask executives direct questions about information security objectives, risk appetite, and resource allocation decisions.
If your executives cannot speak to these topics without being coached immediately before the audit, your program has a leadership engagement gap — and no amount of documentation will paper over it. This is one area where a Regulatory vCISO engagement adds measurable value, because it creates a structured mechanism for bringing security risk to leadership in language executives understand and can act on.
6. Internal Audit Programs That Do Not Actually Test Controls
ISO 27001 requires internal audits at planned intervals. At mid-size organizations, internal audits are routinely conducted as document reviews — someone checks whether policies exist, whether they are signed, and whether they were reviewed in the past year. This is not an audit. It is a file check.
A conforming internal audit program tests whether controls are actually operating as designed. That means interviewing personnel, observing processes, sampling records, and evaluating whether the control achieves its intended outcome. It also means your internal auditors must be independent of the areas they audit, which is a real structural challenge at organizations with small compliance teams.
We consistently find internal audit findings that are recycled year over year with no evidence of remediation, internal audit schedules that slip without documented justification, and audit reports that contain observations but no nonconformity classifications. All of these will generate findings during a certification audit.
7. Incomplete or Untested Business Continuity and Incident Response Integration
ISO 27001 Annex A addresses information security continuity and requires that information security requirements be embedded in business continuity planning. Most mid-size organizations have a business continuity plan and a separate incident response plan. Very few have verified that these two documents are consistent with each other, reference the same assets and recovery objectives, and have both been tested within the audit period.
Gaps here are particularly common in three areas. First, the ISMS does not reflect updated recovery time objectives after systems or processes have changed. Second, incident response procedures do not include escalation paths for events that trigger continuity plan activation. Third, tabletop exercises are conducted for business continuity scenarios but not for information security incident scenarios, or vice versa, leaving half the picture untested.
For organizations that also operate under HIPAA, CMMC, or other regulatory frameworks, integration between information security incident response and regulatory notification obligations is another frequently missed connection. Reviewing your existing ISO 27001 compliance program with this lens is foundational — our post on ISO 27001 compliance and risk management provides useful context for understanding how these elements interconnect.
8. Measurement and Monitoring That Cannot Demonstrate Effectiveness
Clause 9.1 of ISO 27001 requires the organization to evaluate the performance of the ISMS and the effectiveness of the controls it has implemented. This means defining what you will measure, how you will measure it, when you will measure it, who will analyze and evaluate results, and who will be informed of those results.
At mid-size organizations, metrics programs are either absent or consist of IT operational metrics — patch rates, vulnerability counts, uptime percentages — that do not speak to ISMS control effectiveness. Knowing that 94 percent of endpoints are patched does not tell you whether your access control policy is working. Knowing that you had three help desk tickets related to unauthorized access attempts does tell you something.
Effective ISMS measurement connects directly to the controls in your risk treatment plan. For each implemented control, there should be at least one indicator that tells you whether the control is operating as intended. Developing this program requires deliberate design work, not just data collection, and it is one area where a structured Compliance Program Development engagement produces lasting, sustainable value rather than a one-time deliverable.
How These Gaps Interact With Each Other
These eight gaps rarely appear in isolation. A weak scope definition produces a risk assessment that misses material threats. A risk assessment built on flawed methodology produces a Statement of Applicability that does not reflect real risk. An SoA that is not grounded in risk produces a control implementation program that addresses the wrong problems. Weak leadership engagement means that when these problems surface in internal audits, they do not get prioritized or resourced for remediation.
The compounding nature of these gaps is why organizations that treat an ISO 27001 gap assessment as a documentation review consistently struggle to achieve or maintain certification. The assessment must examine the logic chain that connects your organization's context and risk environment to your implemented controls — not just verify that documents exist.
For organizations operating in defense and federal sectors, this challenge is amplified by the need to align ISO 27001 controls with overlapping requirements from NIST SP 800-171, CMMC, and DFARS. Our work across the Federal and Defense industry gives us a practical understanding of how to design ISMS programs that satisfy multiple frameworks simultaneously without redundant effort.
What a Rigorous ISO 27001 Gap Assessment Should Produce
A well-executed ISO 27001 gap assessment should deliver four things. First, a clause-by-clause conformance analysis that distinguishes between fully conforming, partially conforming, and nonconforming areas — not a simple yes/no checklist. Second, a prioritized remediation roadmap that accounts for your organization's risk profile, available resources, and certification timeline. Third, an honest assessment of whether your current scope definition accurately represents your information processing environment. Fourth, specific, actionable findings that your team can begin addressing immediately, not generic recommendations that require another engagement to translate into action.
If your last gap assessment did not produce all four of these outputs, the assessment itself has gaps.
Take the Next Step Toward ISO 27001 Certification
At Cleared Systems, we conduct ISO 27001 gap assessments that go beyond document review to examine whether your ISMS is actually built to work — not just built to look right on paper. If your organization is preparing for initial certification, planning a surveillance audit, or has received findings from a previous assessment that have not been resolved, we can help you identify exactly where you stand and build a realistic path forward. Request a quote today, or explore our engagement models to find the right level of support for where you are in your compliance journey.