Service
Gap & Readiness Assessments
Find out exactly where you stand before you commit to an audit.
A gap and readiness assessment measures your current state against the framework you are aiming for, whether that is SOC 2, ISO 27001, PCI DSS or a privacy regime. It is the step that tells you, honestly, whether you are months or weeks away from being audit-ready.
The result is a prioritised plan: what you already satisfy, what is partially there and what needs building, with enough detail to scope the work and brief your team.
What we cover
Control coverage
We map every requirement in the target framework to the controls you run today and record where each one stands.
Policies and documentation
We examine the written policies, standards and procedures that an auditor will later expect to see in place.
Evidence readiness
We check whether the artefacts that prove a control is operating actually exist and can be produced on request.
Tooling and technical controls
We look at the systems behind the controls, such as logging, access management and monitoring, to confirm they do what the framework asks.
Ownership and operation
We confirm each control has a named owner and is being run in practice rather than only described on paper.
Remediation effort
We size the work left to do for each gap so your team can plan sequencing, resourcing and timing.
Standards we work to
What's included
- A control-by-control comparison against the target framework
- A clear rating of met, partial and missing for each requirement
- Prioritised remediation actions with owners and effort estimates
- Review of existing policies, evidence and tooling
- A realistic view of your path to audit readiness
What you walk away with
- An honest baseline of where you stand against the framework
- A prioritised list of what to fix and in what order
- Enough detail to scope the certification work with confidence
How it runs
Define
We confirm the framework and scope you are targeting, so the assessment measures against the right standard.
Review
We work through your controls, policies and evidence, interviewing the people who run them where it helps.
Rate
We mark each requirement as met, partial or missing, with the reasoning behind each call.
Plan
We hand back a prioritised remediation plan you can use to scope the work and set a realistic timeline.
Why start with a readiness assessment
Going straight to a formal audit without knowing your position is where timelines and budgets tend to slip.
| A readiness assessment first | Straight to the audit | |
|---|---|---|
| Starting point | You begin knowing exactly which controls are met, partial or missing | You find out mid-audit, when it is harder and costlier to react |
| Timeline | You set a realistic date based on the work the gaps actually need | You commit to a date before you know what the work involves |
| Remediation | You fix gaps in priority order on your own schedule | You scramble to close findings against an auditor's clock |
| Cost | You scope the effort up front and avoid surprises | You risk a failed or extended audit and repeat fees |
What this supports
The assessment measures you against whichever of these frameworks you are targeting and hands back a prioritised path to readiness for it.
- SOC 2
- Rates your controls against the SOC 2 Trust Services Criteria before you commit to a Type I or Type II examination.
- ISO 27001
- Compares your information security management system and the controls in ISO 27001 Annex A against what you have in place.
- PCI DSS
- Checks your cardholder data environment against the PCI DSS requirements so you know the scope before validation.
- NIST CSF
- Measures your current posture across the NIST Cybersecurity Framework functions to show where maturity is uneven.
- HIPAA
- Reviews your safeguards against the HIPAA Security Rule to show where protected health information is still exposed.
FAQ
- Is a gap assessment the same as an audit?
- No. An audit is a formal assessment by an independent body. A gap assessment is our internal review to tell you how ready you are before you reach that stage.
- What do we get at the end?
- A requirement-by-requirement rating and a prioritised remediation plan with effort estimates, so you can decide the sequence and timing of the work.
- Should we do this before starting certification?
- In most cases yes. It stops you committing to an audit timeline before you know what the work actually involves.
Related services
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read