Sector: Hosting and IT Infrastructure
Service: ISO/IEC 27001 GAP Analysis
Objective: Assess existing security practices and the organisation’s readiness for further ISMS implementation
Assessment framework: ISO/IEC 27001:2022 and applicable Annex A controls

Client and business context

The client provides hosting and server services to business customers and manages infrastructure whose availability and security directly affect customer services. The organisation already had established technical security practices and experienced staff. Backup and restore processes, as well as day-to-day infrastructure operations, were particularly well developed.

Interest in ISO/IEC 27001 was driven primarily by increasingly frequent security and contractual requirements from existing and prospective customers.

Challenge

The starting point was not weak. A significant portion of security activities was already being carried out, and the organisation had a solid technical foundation. The main issue was that some of those practices were not sufficiently formalised, standardised or reviewed on a regular basis. In certain areas, a process existed in practice but was difficult to demonstrate through documentation and records.

The purpose of the GAP analysis was to determine what could already be used as a foundation for the ISMS, where genuine gaps existed and which areas needed to be addressed before progressing with ISO/IEC 27001 implementation.

How the assessment was conducted

The assessment began with defining the scope and collecting information about the organisation’s business and technical environment. Through a structured questionnaire and an agreed evidence submission process, the client provided relevant documentation and information about existing security practices.

AresISEC reviewed the requirements of ISO/IEC 27001:2022, available policies, procedures and records, as well as how individual processes were actually carried out in day-to-day operations. The applicability of Annex A controls was also assessed, and additional discussions were held with responsible personnel where the available documentation was not sufficient to reach a reliable conclusion.

The assessment was not limited to checking whether a document existed. It was equally important to determine whether there was evidence that the defined process was actually being followed.

Key observations

Patch and change management

System updates were performed regularly, but the process was not sufficiently defined through policy or standardised criteria for planning, prioritising and recording changes.

Access management

The granting and removal of access generally worked well. The weaker area was the periodic review of existing access rights, which was not performed consistently enough. This made it more difficult to demonstrate that users and administrators continued to retain only the access they still required.

Retention and backups

Backup and restore were among the organisation’s stronger areas. However, retention periods for certain types of data and backups were not clearly defined or formally documented.

Standardisation of new servers

There was no single security baseline for provisioning new servers. Configuration relied heavily on administrator experience. While this can work well in a small and experienced team, it makes consistent configuration, deviation checking and long-term maintenance of a larger number of systems more difficult.

Redundancy and knowledge transfer

Some areas of the infrastructure showed room for improvement in redundancy. Another risk was the concentration of specialised knowledge among a small number of employees. The knowledge existed, but some operational procedures were not documented well enough to reduce dependency on individuals.

Information classification

Information classification had been defined, but it was not applied consistently in day-to-day work. This created a gap between documented rules and actual practice.

Internal reviews and performance measurement

Internal reviews of security processes were not carried out in a sufficiently structured manner. The organisation also lacked useful security KPIs for monitoring areas such as periodic access reviews, update status, restore test results and other activities relevant to ISMS effectiveness.

Outcome

The GAP analysis showed that the organisation already had a substantial part of the required security foundation in place and did not need to build its ISMS from scratch. At the same time, the assessment clearly identified areas where existing practices needed to be formalised, documented more effectively or technically improved.

This gave the client a more realistic view of its starting position and allowed further implementation work to be planned around actual priorities rather than treating all ISO/IEC 27001 requirements as equally urgent. The assessment also highlighted the difference between technically sound security practices and processes that are sufficiently consistent, documented and measurable to form part of a managed ISMS.

What the client received

At the end of the assessment, the client received an overview of its current state against ISO/IEC 27001 requirements, prioritised GAP findings, a review of relevant Annex A controls and an initial outline of the scope and assumptions for further implementation. Assessment limitations and recommended next steps were also documented.

Considering ISO/IEC 27001?

If your organisation already has security processes in place, a GAP analysis can help determine what can be retained, where genuine gaps exist and what should be addressed before continuing with ISMS implementation.